www.huntress.com Open in urlscan Pro
52.17.119.105 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-ac...
Effective URL:
https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-ac...
Submission: On June 06 via api (June 6th 2024, 8:19:58 am UTC) from NL — Scanned from NL

Summary HTTP 138 Redirects Links 22 Behaviour Indicators

Summary

This website contacted 59 IPs in 6 countries across 45 domains to perform 138 HTTP transactions. The main IP is 52.17.119.105, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is www.huntress.com. The Cisco Umbrella rank of the primary domain is 300217.
TLS certificate: Issued by R3 on June 1st 2024. Valid for: 3 months.

This is the only time www.huntress.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	52.17.119.105 52.17.119.105	16509 (AMAZON-02) (AMAZON-02)
24	172.64.153.29 172.64.153.29	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	142.250.185.132 142.250.185.132	15169 (GOOGLE) (GOOGLE)
13	2.17.100.184 2.17.100.184	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	34.111.224.162 34.111.224.162	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	151.101.65.91 151.101.65.91	54113 (FASTLY) (FASTLY)
5	2a04:4e42:200... 2a04:4e42:200::485	54113 (FASTLY) (FASTLY)
1	18.244.20.40 18.244.20.40	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:89d1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	76.76.21.61 76.76.21.61	16509 (AMAZON-02) (AMAZON-02)
3	76.76.21.164 76.76.21.164	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:810::2008	15169 (GOOGLE) (GOOGLE)
1	18.245.86.14 18.245.86.14	16509 (AMAZON-02) (AMAZON-02)
6	2600:9000:235... 2600:9000:235a:f000:11:3b84:d200:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:20:... 2606:4700:20::681a:1ad	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	151.101.129.229 151.101.129.229	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6811:80ac	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:8b11	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2606:4700::68... 2606:4700::6810:7674	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2606:4700:440... 2606:4700:4400::ac40:991b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:afc9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6810:6dfe	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:350... 2a02:26f0:3500:16::215:148d	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a04:4e42::396 2a04:4e42::396	54113 (FASTLY) (FASTLY)
1	162.159.152.17 162.159.152.17	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	146.75.120.157 146.75.120.157	54113 (FASTLY) (FASTLY)
1 4	2620:1ec:c11:... 2620:1ec:c11::237	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a03:2880:f08... 2a03:2880:f084:105:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2606:4700:440... 2606:4700:4400::6812:2b1f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	54.93.141.152 54.93.141.152	16509 (AMAZON-02) (AMAZON-02)
1	18.66.102.51 18.66.102.51	16509 (AMAZON-02) (AMAZON-02)
1	18.245.46.63 18.245.46.63	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:440... 2606:4700:4400::6812:24c4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.4.177.222 52.4.177.222	14618 (AMAZON-AES) (AMAZON-AES)
2	2a00:1450:400... 2a00:1450:4001:82f::200e	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c04::9d	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
2 4	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	151.101.65.140 151.101.65.140	54113 (FASTLY) (FASTLY)
2	151.101.129.140 151.101.129.140	54113 (FASTLY) (FASTLY)
1	93.184.221.165 93.184.221.165	15133 (EDGECAST) (EDGECAST)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
2	104.19.175.188 104.19.175.188	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a02:26f0:710... 2a02:26f0:7100::210:172	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	13.32.27.54 13.32.27.54	16509 (AMAZON-02) (AMAZON-02)
2	2620:1ec:29:1... 2620:1ec:29:1::43	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	34.111.208.231 34.111.208.231	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	3.223.190.23 3.223.190.23	14618 (AMAZON-AES) (AMAZON-AES)
1	18.66.112.110 18.66.112.110	16509 (AMAZON-02) (AMAZON-02)
2	2a03:2880:f17... 2a03:2880:f177:185:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	4.227.249.197 4.227.249.197	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	185.89.210.244 185.89.210.244	29990 (ASN-APPNEX) (ASN-APPNEX)
3	172.64.150.44 172.64.150.44	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	68.219.88.97 68.219.88.97	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	104.16.117.43 104.16.117.43	13335 (CLOUDFLAR...) (CLOUDFLARENET)
138	59

1 52.17.119.105 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-17-119-105.eu-west-1.compute.amazonaws.com

www.huntress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 172.64.153.29 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

cdn.prod.website-files.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.185.132 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2.17.100.184 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-17-100-184.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.111.224.162 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 162.224.111.34.bc.googleusercontent.com

js.na.chilipiper.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.65.91 (San Francisco, United States)

ASN54113 (FASTLY, US)

client-registry.mutinycdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a04:4e42:200::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.244.20.40 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-244-20-40.fra56.r.cloudfront.net

d3e54v103j8qbb.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:89d1 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 76.76.21.61 (Walnut, United States)

ASN16509 (AMAZON-02, US)

tools.refokus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 76.76.21.164 (Walnut, United States)

ASN16509 (AMAZON-02, US)

hubspotonwebflow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:810::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.245.86.14 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-86-14.fra60.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2600:9000:235a:f000:11:3b84:d200:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets.website-files.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:1ad (United States)

ASN13335 (CLOUDFLARENET, US)

huntresscdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.129.229 (San Francisco, United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:80ac (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:8b11 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:7674 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cta-service-cms2.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:4400::ac40:991b (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:afc9 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:6dfe (United States)

ASN13335 (CLOUDFLARENET, US)

js.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:16::215:148d (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.159.152.17 (None, )

ASN13335 (CLOUDFLARENET, US)

a.quora.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.120.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:c11::237 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f084:105:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:4400::6812:2b1f (United States)

ASN13335 (CLOUDFLARENET, US)

tracking.g2crowd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 54.93.141.152 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-93-141-152.eu-central-1.compute.amazonaws.com

tags.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.102.51 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-102-51.fra56.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.245.46.63 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-46-63.fra56.r.cloudfront.net

cdn.neverbounce.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:24c4 (United States)

ASN13335 (CLOUDFLARENET, US)

trk.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.4.177.222 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-4-177-222.compute-1.amazonaws.com

q.quora.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c04::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:21::14 (United States) 2 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.65.140 (San Francisco, United States)

ASN54113 (FASTLY, US)

pixel-config.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.129.140 (San Francisco, United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 93.184.221.165 (London, United Kingdom)

ASN15133 (EDGECAST, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.19.175.188 (None, )

ASN13335 (CLOUDFLARENET, US)

perf-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:7100::210:172 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.54 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-54.fra56.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:29:1::43 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.208.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.208.111.34.bc.googleusercontent.com

ibc-flow.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.223.190.23 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-223-190-23.compute-1.amazonaws.com

api.neverbounce.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.112.110 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-112-110.fra56.r.cloudfront.net

vc.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f177:185:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 4.227.249.197 (Washington, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

u.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.89.210.244 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.64.150.44 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

js.zi-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.219.88.97 (Dublin, Ireland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.16.117.43 (None, )

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
30	website-files.com cdn.prod.website-files.com — Cisco Umbrella Rank: 10954 assets.website-files.com — Cisco Umbrella Rank: 16428	2 MB
15	6sc.co j.6sc.co — Cisco Umbrella Rank: 6003 c.6sc.co — Cisco Umbrella Rank: 8539 ipv6.6sc.co — Cisco Umbrella Rank: 6141 b.6sc.co — Cisco Umbrella Rank: 3870	23 KB
7	stackadapt.com tags.srv.stackadapt.com — Cisco Umbrella Rank: 3134	9 KB
6	clarity.ms 1 redirects www.clarity.ms — Cisco Umbrella Rank: 783 u.clarity.ms — Cisco Umbrella Rank: 7176 c.clarity.ms — Cisco Umbrella Rank: 1541	28 KB
6	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 354	32 KB
6	google.com www.google.com — Cisco Umbrella Rank: 5 google.com — Cisco Umbrella Rank: 1 region1.analytics.google.com — Cisco Umbrella Rank: 3163	1 KB
5	linkedin.com 2 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 351 px4.ads.linkedin.com — Cisco Umbrella Rank: 6771	3 KB
4	bing.com 1 redirects bat.bing.com — Cisco Umbrella Rank: 361 c.bing.com — Cisco Umbrella Rank: 231	16 KB
3	zi-scripts.com js.zi-scripts.com — Cisco Umbrella Rank: 7653	4 KB
3	reddit.com pixel-config.reddit.com — Cisco Umbrella Rank: 2141 alb.reddit.com — Cisco Umbrella Rank: 1407	800 B
3	techtarget.com trk.techtarget.com — Cisco Umbrella Rank: 29848 ibc-flow.techtarget.com — Cisco Umbrella Rank: 26034	2 KB
3	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2553	19 KB
3	hubspot.com js.hubspot.com — Cisco Umbrella Rank: 4638 cta-service-cms2.hubspot.com — Cisco Umbrella Rank: 4658 track.hubspot.com — Cisco Umbrella Rank: 2847	27 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 78	308 KB
3	hubspotonwebflow.com hubspotonwebflow.com — Cisco Umbrella Rank: 47760	26 KB
2	zoominfo.com ws.zoominfo.com — Cisco Umbrella Rank: 5230	2 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 119	4 KB
2	hsforms.com perf-na1.hsforms.com — Cisco Umbrella Rank: 4907 forms.hsforms.com — Cisco Umbrella Rank: 5060	2 KB
2	neverbounce.com cdn.neverbounce.com — Cisco Umbrella Rank: 72264 api.neverbounce.com — Cisco Umbrella Rank: 143256	29 KB
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 887 script.hotjar.com — Cisco Umbrella Rank: 1282	60 KB
2	g2crowd.com tracking.g2crowd.com — Cisco Umbrella Rank: 8674	1 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 205	73 KB
2	quora.com a.quora.com — Cisco Umbrella Rank: 7277 q.quora.com — Cisco Umbrella Rank: 4586	15 KB
2	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1228	13 KB
2	hscollectedforms.net js.hscollectedforms.net — Cisco Umbrella Rank: 5381 forms.hscollectedforms.net — Cisco Umbrella Rank: 5510	25 KB
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 524	703 B
1	hotjar.io vc.hotjar.io — Cisco Umbrella Rank: 3438	233 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 943	726 B
1	t.co t.co — Cisco Umbrella Rank: 713	376 B
1	google.nl www.google.nl — Cisco Umbrella Rank: 10670	409 B
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 130	256 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 907	15 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 880	17 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2604	25 KB
1	hsleadflows.net js.hsleadflows.net — Cisco Umbrella Rank: 5889	92 KB
1	hsadspixel.net js.hsadspixel.net — Cisco Umbrella Rank: 3888	4 KB
1	huntresscdn.com huntresscdn.com — Cisco Umbrella Rank: 4622	112 KB
1	driftt.com js.driftt.com — Cisco Umbrella Rank: 7191	60 KB
1	gstatic.com www.gstatic.com	209 KB
1	refokus.com tools.refokus.com — Cisco Umbrella Rank: 97919	1 KB
1	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 2948	1 KB
1	cloudfront.net d3e54v103j8qbb.cloudfront.net	30 KB
1	mutinycdn.com client-registry.mutinycdn.com — Cisco Umbrella Rank: 20847	17 KB
1	chilipiper.com js.na.chilipiper.com — Cisco Umbrella Rank: 294881	25 KB
1	huntress.com www.huntress.com — Cisco Umbrella Rank: 300217	32 KB
138	45

	Domain	Requested by
24	cdn.prod.website-files.com	www.huntress.com cdn.prod.website-files.com
7	b.6sc.co
7	tags.srv.stackadapt.com	www.huntress.com tags.srv.stackadapt.com js.driftt.com
6	assets.website-files.com	cdn.prod.website-files.com
6	cdn.jsdelivr.net	www.huntress.com cdn.jsdelivr.net
4	px.ads.linkedin.com	2 redirects snap.licdn.com
4	j.6sc.co	www.huntress.com j.6sc.co www.googletagmanager.com
3	js.zi-scripts.com	www.huntress.com js.driftt.com
3	bat.bing.com	www.googletagmanager.com bat.bing.com www.huntress.com
3	js.hs-banner.com	js.hs-scripts.com js.driftt.com
3	www.googletagmanager.com	www.huntress.com www.googletagmanager.com
3	hubspotonwebflow.com	www.huntress.com js.driftt.com
3	www.google.com	www.huntress.com www.gstatic.com
2	ws.zoominfo.com	js.driftt.com
2	c.clarity.ms	1 redirects
2	u.clarity.ms	js.driftt.com
2	www.facebook.com	www.huntress.com
2	ibc-flow.techtarget.com	js.driftt.com
2	www.clarity.ms	bat.bing.com www.clarity.ms
2	ipv6.6sc.co	js.driftt.com
2	c.6sc.co	js.driftt.com
2	alb.reddit.com	www.huntress.com
2	google.com	www.googletagmanager.com
2	tracking.g2crowd.com	www.huntress.com tracking.g2crowd.com
2	connect.facebook.net	www.huntress.com connect.facebook.net
2	www.redditstatic.com	www.googletagmanager.com www.redditstatic.com
1	c.bing.com	1 redirects
1	track.hubspot.com
1	secure.adnxs.com	js.driftt.com
1	vc.hotjar.io	js.driftt.com
1	api.neverbounce.com	cdn.neverbounce.com
1	script.hotjar.com	static.hotjar.com
1	forms.hsforms.com	www.huntress.com
1	perf-na1.hsforms.com	www.huntress.com
1	analytics.twitter.com	www.huntress.com
1	t.co	www.huntress.com
1	pixel-config.reddit.com	www.redditstatic.com
1	px4.ads.linkedin.com	www.huntress.com
1	www.google.nl	www.huntress.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	region1.analytics.google.com	www.googletagmanager.com
1	forms.hscollectedforms.net	js.hscollectedforms.net
1	cta-service-cms2.hubspot.com	js.hubspot.com
1	q.quora.com	www.huntress.com
1	trk.techtarget.com	www.huntress.com
1	cdn.neverbounce.com	www.googletagmanager.com
1	static.hotjar.com	www.huntress.com
1	static.ads-twitter.com	www.googletagmanager.com
1	a.quora.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	js.hscollectedforms.net	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	js.hubspot.com	js.hs-scripts.com
1	js.hsleadflows.net	js.hs-scripts.com
1	js.hsadspixel.net	js.hs-scripts.com
1	huntresscdn.com	www.huntress.com
1	js.driftt.com	www.huntress.com
1	www.gstatic.com	www.google.com
1	tools.refokus.com	www.huntress.com
1	js.hs-scripts.com	www.huntress.com
1	d3e54v103j8qbb.cloudfront.net	www.huntress.com
1	client-registry.mutinycdn.com	www.huntress.com
1	js.na.chilipiper.com	www.huntress.com
1	www.huntress.com
138	64

This site contains links to these domains. Also see Links.

Domain
huntress.io
support.huntress.io
assets-global.website-files.com
www.facebook.com
twitter.com
www.linkedin.com
www.reddit.com
blog.talosintelligence.com
x.com
nvd.nist.gov
www.cisa.gov
learn.microsoft.com
www.proofpoint.com
attack.mitre.org
www.microsoft.com
unit42.paloaltonetworks.com
www.mcafee.com
redcanary.com

Subject Issuer	Validity	Valid
www.huntress.com R3	`2024-06-01` - `2024-08-30`	3 months	crt.sh
prod.website-files.com GTS CA 1P5	`2024-04-26` - `2024-07-25`	3 months	crt.sh
*.google.com WR2	`2024-05-21` - `2024-08-13`	3 months	crt.sh
6sc.co R3	`2024-04-09` - `2024-07-08`	3 months	crt.sh
chilipiper.com GoGetSSL RSA DV CA	`2024-02-05` - `2025-03-07`	a year	crt.sh
client-registry.mutinycdn.com GlobalSign Atlas R3 DV TLS CA 2024 Q1	`2024-03-06` - `2025-04-07`	a year	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3	`2023-09-27` - `2024-10-28`	a year	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2023-10-10` - `2024-09-19`	a year	crt.sh
hs-scripts.com E1	`2024-05-31` - `2024-08-29`	3 months	crt.sh
tools.refokus.com R3	`2024-04-21` - `2024-07-20`	3 months	crt.sh
*.hubspotonwebflow.com R3	`2024-05-15` - `2024-08-13`	3 months	crt.sh
*.gstatic.com WR2	`2024-05-21` - `2024-08-13`	3 months	crt.sh
*.google-analytics.com WR2	`2024-05-21` - `2024-08-13`	3 months	crt.sh
drift.com Amazon RSA 2048 M02	`2023-08-15` - `2024-09-11`	a year	crt.sh
*.website-files.com Amazon RSA 2048 M03	`2023-09-11` - `2024-10-08`	a year	crt.sh
huntresscdn.com E1	`2024-04-08` - `2024-07-07`	3 months	crt.sh
hsadspixel.net E1	`2024-04-16` - `2024-07-15`	3 months	crt.sh
hsleadflows.net E1	`2024-06-02` - `2024-08-31`	3 months	crt.sh
hubspot.com E1	`2024-05-23` - `2024-08-21`	3 months	crt.sh
hs-banner.com E1	`2024-05-30` - `2024-08-28`	3 months	crt.sh
hs-analytics.net GTS CA 1P5	`2024-04-13` - `2024-07-12`	3 months	crt.sh
hscollectedforms.net E1	`2024-05-27` - `2024-08-25`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-05-23` - `2024-11-18`	6 months	crt.sh
quora.com R3	`2024-05-12` - `2024-08-10`	3 months	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-21` - `2024-07-19`	a year	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 02	`2024-05-01` - `2024-06-27`	2 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-03-15` - `2024-06-13`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-24` - `2024-07-23`	a year	crt.sh
*.srv.stackadapt.com Amazon RSA 2048 M02	`2023-09-09` - `2024-10-07`	a year	crt.sh
*.hotjar.com Amazon RSA 2048 M03	`2024-05-22` - `2025-06-20`	a year	crt.sh
neverbounce.com Amazon RSA 2048 M03	`2024-01-29` - `2025-02-25`	a year	crt.sh
trk.techtarget.com GTS CA 1P5	`2024-05-24` - `2024-08-22`	3 months	crt.sh
*.quora.com R3	`2024-06-02` - `2024-08-31`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-05-13` - `2024-08-05`	3 months	crt.sh
*.google.nl WR2	`2024-05-21` - `2024-08-13`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-01-30` - `2024-07-30`	6 months	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2024-05-30` - `2024-11-26`	6 months	crt.sh
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-05-08` - `2025-05-07`	a year	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-31` - `2024-10-29`	a year	crt.sh
hsforms.com GTS CA 1P5	`2024-04-17` - `2024-07-16`	3 months	crt.sh
www.clarity.ms DigiCert TLS RSA SHA256 2020 CA1	`2023-12-07` - `2024-12-07`	a year	crt.sh
ibc-flow.techtarget.com GTS CA 1D4	`2024-05-06` - `2024-08-04`	3 months	crt.sh
*.hotjar.io Amazon ECDSA 256 M02	`2024-02-07` - `2025-03-08`	a year	crt.sh
a.clarity.ms Microsoft Azure TLS Issuing CA 01	`2024-01-14` - `2024-06-27`	5 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2024-02-14` - `2025-03-16`	a year	crt.sh
zi-scripts.com GTS CA 1P5	`2024-05-27` - `2024-08-25`	3 months	crt.sh
zoominfo.com E1	`2024-05-20` - `2024-08-18`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Frame ID: A21E423F9917B922A529279137820F7E
Requests: 132 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LchEywUAAAAAAdAXlscEm7Kcb3DJ38pngRCQJsC&co=aHR0cHM6Ly93d3cuaHVudHJlc3MuY29tOjQ0Mw..&hl=nl&v=DH3nyJMamEclyfe-nztbfV8S&size=normal&cb=yb0nmse5bonp
Frame ID: 3791B5F143A87084C1F086374A5A3D1C
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=nl&v=DH3nyJMamEclyfe-nztbfV8S&k=6LchEywUAAAAAAdAXlscEm7Kcb3DJ38pngRCQJsC
Frame ID: 984692579189B4261F75AD6BE1C8B696
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Netscaler Exploitation to Social Engineering: Mapping Convergence of Adversary Tradecraft Across Victims

Page URL History Show full URLs

http://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adv... HTTP 307
https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adv... Page URL

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Slick (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

(?:/([\d.]+))?/slick(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

138
Requests

97 %
HTTPS

45 %
IPv6

45
Domains

64
Subdomains

59
IPs

6
Countries

3848 kB
Transfer

8274 kB
Size

52
Cookies

22 Outgoing links

These are links going to different origins than the main page.

URL: https://huntress.io/
Title: Partner Login

Search URL Search Domain Scan URL

URL: https://support.huntress.io/hc/en-us
Title: Support Documentation

Search URL Search Domain Scan URL

URL: https://assets-global.website-files.com/6579dd0b5f9a54376d296939/6598317ed13aaee7ad5b2b9b_CascadeTechnologies-CaseStudy.pdf

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Search URL Search Domain Scan URL

URL: https://twitter.com/share?url=https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Search URL Search Domain Scan URL

URL: http://www.reddit.com/submit?url=https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Search URL Search Domain Scan URL

URL: https://blog.talosintelligence.com/hunting-for-lolbins/
Title: LOLBins

Search URL Search Domain Scan URL

URL: https://x.com/SophosXOps/status/1695143572272738790?s=20
Title: following social media posts from researchers at Sophos

Search URL Search Domain Scan URL

URL: https://nvd.nist.gov/vuln/detail/CVE-2023-3519
Title: CVE-2023-3519

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a
Title: CISA-issued alert

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/sysinternals/downloads/adexplorer
Title: Sysinternals AD Explorer tool for gathering Active Directory information

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msg
Title: Windows MSG command

Search URL Search Domain Scan URL

URL: https://www.proofpoint.com/us/blog/threat-insight/how-threat-actors-are-adapting-post-macro-world
Title: programmatic disabling of macros in Microsoft Office documents

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1574/001/
Title: search order hijacking

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1574/002/
Title: sideloading

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/
Title: Nobelium’s FoggyWeb backdoor installation

Search URL Search Domain Scan URL

URL: https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/
Title: abuse of signed Microsoft executables to install Brute Ratel

Search URL Search Domain Scan URL

URL: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/rise-of-lnk-shortcut-files-malware/
Title: concerning

Search URL Search Domain Scan URL

URL: https://www.proofpoint.com/us/blog/threat-insight/welcome-new-york-exploring-ta453s-foray-lnks-and-mac-malware
Title: trends

Search URL Search Domain Scan URL

URL: https://redcanary.com/threat-detection-report/techniques/mark-of-the-web-bypass/
Title: intrusion activity

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a
Title: abuse of RMM tools

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims HTTP 307
https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 78

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1717661992858&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1717661992858&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&cookiesTest=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1717661992858&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&cookiesTest=true&e_ipv6=AQIDdzChcCF6uAAAAY_sogmmsjs8HpCgwILSHqPpPHEUEQs8TWdWqv1udpztF91Zm6klAYAB57Sn1GItvg

Request Chain 122

https://c.clarity.ms/c.gif HTTP 302
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=6110F06BCE824BD2926104F49CB1C23F&RedC=c.clarity.ms&MXFR=1EEB616FA2236A0B03BD75F9A6236449 HTTP 302
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=6110F06BCE824BD2926104F49CB1C23F&MUID=381F7233DA70667A2D1566A5DBB067CB

138 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Show response
www.huntress.com/blog/
Redirect Chain

http://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

130 KB
32 KB

305ms
90ms

Document
text/html

52.17.119.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.17.119.105 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-17-119-105.eu-west-1.compute.amazonaws.com

Software

Resource Hash

8638fe41461414860127cd8d9a0672e3aae30ae76bc69e5398c3a0bd630bd98b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: nl-NL,nl;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 129359
content-encoding: gzip
content-length: 32374
content-security-policy: frame-ancestors 'self'
content-type: text/html
date: Thu, 06 Jun 2024 08:19:51 GMT
referrer-policy: origin
vary: Accept-Encoding,x-wf-forwarded-proto
x-cache: HIT, HIT
x-cache-hits: 11, 0
x-cluster-name: eu-west-1-prod-hosting-red
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-lambda-id: af3f8b8c-19a9-4fe3-a509-99dc63983000
x-served-by: cache-iad-kcgs7200176-IAD, cache-dub4338-DUB
x-timer: S1717661991.266028,VS0,VE1
x-xss-protection: 1; mode=block

Redirect headers

Location: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Non-Authoritative-Reason: HttpsUpgrades

GET
H3 200 huntress-new.3ca223936.min.css
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/ 420 KB
68 KB 134ms
77ms Stylesheet
text/css 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.3ca223936.min.css
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2f0faa86c85189cabbfc56460c57a61d8480ac15c7868dd0363c6c035730d1af

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:51 GMT
content-encoding: gzip
x-amz-version-id: zrQMsloZAi7Q72AO2UxNf4.UK3D5.ykk
cf-cache-status: HIT
x-amz-request-id: VCC62VY0VC0W41QS
age: 44942
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 69506
x-amz-id-2: exqOMhpfVd7K9zxYKAQ6Bj9uKaOCBP2QfwPYMJqtlimsmpM4Nk/1YEl+1SUotgvJz9+G3I69PWM=
last-modified: Tue, 04 Jun 2024 16:54:24 GMT
server: cloudflare
etag: "ac85358c920c7838ea235e5fde4f5e1c"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=84600
accept-ranges: bytes
cf-ray: 88f6fad6595a3671-FRA
expires: Fri, 07 Jun 2024 07:49:51 GMT

GET
H3 200 api.js Show response
www.google.com/recaptcha/ 1 KB
946 B 203ms
84ms Script
text/javascript 142.250.185.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f4.1e100.net

Software

GSE /

Resource Hash

53748d29b45a93b53aeaf58adb6c2754f7b2260cd419d67204ad5c37a3ee0ef6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Thu, 06 Jun 2024 08:19:51 GMT

GET
H2 200 8769192b-20ba-4df2-8d62-2740a805c3e8.js Show response
j.6sc.co/j/ 1002 B
1 KB 647ms
463ms Script
application/javascript 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/j/8769192b-20ba-4df2-8d62-2740a805c3e8.js
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-184.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: f143cdd47f943dca511fec190f6f8dc72123af1a03b0acc0b85006d3827469db

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: o9ChablSSl2gd.7kIpRQzAV8W8L4w9AI
date: Thu, 06 Jun 2024 08:19:51 GMT
x-amz-cf-pop: FRA60-P8
x-amz-server-side-encryption: AES256
x-amz-meta-content-type: application/json
content-length: 1002
pragma: no-cache
last-modified: Wed, 08 May 2024 20:22:17 GMT
server: AmazonS3
etag: "924fd1c8fe1063b3e4acf99764018260"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
x-amz-cf-id: L18sHM0pozR2dgTIqqrLkuHW1n5ZZm_8_roRJC5bYSG4fUcfmNGG-w==
expires: Thu, 06 Jun 2024 08:19:51 GMT

GET
H2 200 marketing.js Show response
js.na.chilipiper.com/ 73 KB
25 KB 234ms
165ms Script
application/javascript 34.111.224.162
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://js.na.chilipiper.com/marketing.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.111.224.162 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

162.224.111.34.bc.googleusercontent.com

Software

Resource Hash

02c65a6d1cdc752f31b0be2157d9c6f65e72c7f3e781eea941bd848caf8a332e

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: data: wss://.chilipiper.com wss://.chilipiper.io wss://.chilipiper.cool wss://.chilipiper.team https://.chilipiper.com https://.chilipiper.io https://.chilipiper.cool https://.chilipiper.team https://www.google-analytics.com https://www.googletagmanager.com https://static2.sharepointonline.com https://ajax.aspnetcdn.com https://appsforoffice.microsoft.com https://.rollout.io https://.facebook.com https://.marketo.com https://.mixpanel.com https://.hubspot.com https://.pardot.com https://.getdrip.com https://.google.com https://.googleapis.com https://.hsforms.net https://.clearbit.com https://www.youtube.com https://s3.amazonaws.com https://sentry.io https://cdn.ravenjs.com https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://twemoji.maxcdn.com https://.cloudfront.net https://intercom-sheets.com https://static.intercomassets.com https://js.intercomcdn.com https://cdn.segment.com https://api.segment.io https://maxcdn.bootstrapcdn.com https://.intercom.io https://.mutinycdn.com https://.mutinyhq.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io https://.bugsnag.com https://zoom.us https://.gotomeeting.com https://.rollout.io https://.codox.io https://cdn.tiny.cloud https://js.stripe.com https://.zdassets.com https://.zendesk.com https://.zopim.com wss://chilipiper.zendesk.com wss://.zopim.com https://.googleusercontent.com https://.facebook.net https://.doubleclick.net https://.licdn.com https://.googleadservices.com https://.digitaloceanspaces.com https://.ingest.sentry.io https://.ingest.us.sentry.io https://canny.io/sdk.js https://changelog-widget.canny.io https://edge.fullstory.com https://rs.fullstory.com https://.lr-in-prod.com https://polyfill.io https://.planhat.com https://.sprig.com https://com-chilipiper-prod1.mini.snplow.net https://com-chilipiper-prod1.collector.snplow.net https://fast.chameleon.io https://js.chargify.com https://selfservice.maxio.com https://hooks.slack.com https://.logr-ingest.com https://.posthog.com 'unsafe-inline'; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://fonts.gstatic.com https://fonts.googleapis.com https://js.intercomcdn.com; img-src * data: blob: 'unsafe-inline';
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Security-Policy	default-src 'self' blob: data: wss://.chilipiper.com wss://.chilipiper.io wss://.chilipiper.cool wss://.chilipiper.team https://.chilipiper.com https://.chilipiper.io https://.chilipiper.cool https://.chilipiper.team https://www.google-analytics.com https://www.googletagmanager.com https://static2.sharepointonline.com https://ajax.aspnetcdn.com https://appsforoffice.microsoft.com https://.rollout.io https://.facebook.com https://.marketo.com https://.mixpanel.com https://.hubspot.com https://.pardot.com https://.getdrip.com https://.google.com https://.googleapis.com https://.hsforms.net https://.clearbit.com https://www.youtube.com https://s3.amazonaws.com https://sentry.io https://cdn.ravenjs.com https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://twemoji.maxcdn.com https://.cloudfront.net https://intercom-sheets.com https://static.intercomassets.com https://js.intercomcdn.com https://cdn.segment.com https://api.segment.io https://maxcdn.bootstrapcdn.com https://.intercom.io https://.mutinycdn.com https://.mutinyhq.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io https://.bugsnag.com https://zoom.us https://.gotomeeting.com https://.rollout.io https://.codox.io https://cdn.tiny.cloud https://js.stripe.com https://.zdassets.com https://.zendesk.com https://.zopim.com wss://chilipiper.zendesk.com wss://.zopim.com https://.googleusercontent.com https://.facebook.net https://.doubleclick.net https://.licdn.com https://.googleadservices.com https://.digitaloceanspaces.com https://.ingest.sentry.io https://.ingest.us.sentry.io https://canny.io/sdk.js https://changelog-widget.canny.io https://edge.fullstory.com https://rs.fullstory.com https://.lr-in-prod.com https://polyfill.io https://.planhat.com https://.sprig.com https://com-chilipiper-prod1.mini.snplow.net https://com-chilipiper-prod1.collector.snplow.net https://fast.chameleon.io https://js.chargify.com https://selfservice.maxio.com https://hooks.slack.com https://.logr-ingest.com https://.posthog.com 'unsafe-inline'; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://fonts.gstatic.com https://fonts.googleapis.com https://js.intercomcdn.com; img-src * data: blob: 'unsafe-inline';
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
content-encoding: gzip
via: 1.1 google
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
age: 0
content-security-policy: default-src 'self' blob: data: wss://*.chilipiper.com wss://*.chilipiper.io wss://*.chilipiper.cool wss://*.chilipiper.team https://*.chilipiper.com https://*.chilipiper.io https://*.chilipiper.cool https://*.chilipiper.team https://www.google-analytics.com https://www.googletagmanager.com https://static2.sharepointonline.com https://ajax.aspnetcdn.com https://appsforoffice.microsoft.com https://*.rollout.io https://*.facebook.com https://*.marketo.com https://*.mixpanel.com https://*.hubspot.com https://*.pardot.com https://*.getdrip.com https://*.google.com https://*.googleapis.com https://*.hsforms.net https://*.clearbit.com https://www.youtube.com https://s3.amazonaws.com https://sentry.io https://cdn.ravenjs.com https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://twemoji.maxcdn.com https://*.cloudfront.net https://intercom-sheets.com https://static.intercomassets.com https://js.intercomcdn.com https://cdn.segment.com https://api.segment.io https://maxcdn.bootstrapcdn.com https://*.intercom.io https://*.mutinycdn.com https://*.mutinyhq.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io https://*.bugsnag.com https://zoom.us https://*.gotomeeting.com https://*.rollout.io https://*.codox.io https://cdn.tiny.cloud https://js.stripe.com https://*.zdassets.com https://*.zendesk.com https://*.zopim.com wss://chilipiper.zendesk.com wss://*.zopim.com https://*.googleusercontent.com https://*.facebook.net https://*.doubleclick.net https://*.licdn.com https://*.googleadservices.com https://*.digitaloceanspaces.com https://*.ingest.sentry.io https://*.ingest.us.sentry.io https://canny.io/sdk.js https://changelog-widget.canny.io https://edge.fullstory.com https://rs.fullstory.com https://*.lr-in-prod.com https://polyfill.io https://*.planhat.com https://*.sprig.com https://com-chilipiper-prod1.mini.snplow.net https://com-chilipiper-prod1.collector.snplow.net https://fast.chameleon.io https://js.chargify.com https://selfservice.maxio.com https://hooks.slack.com https://*.logr-ingest.com https://*.posthog.com 'unsafe-inline'; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://fonts.gstatic.com https://fonts.googleapis.com https://js.intercomcdn.com; img-src * data: blob: 'unsafe-inline';
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22403
x-xss-protection: 1; mode=block
referrer-policy: origin-when-cross-origin
last-modified: Mon, 20 May 2024 07:11:53 GMT
etag: W/"664af7b9-122e0"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=0, s-maxage=60, must-revalidate
x-cache-hit: revalidated
x-content-security-policy: default-src 'self' blob: data: wss://*.chilipiper.com wss://*.chilipiper.io wss://*.chilipiper.cool wss://*.chilipiper.team https://*.chilipiper.com https://*.chilipiper.io https://*.chilipiper.cool https://*.chilipiper.team https://www.google-analytics.com https://www.googletagmanager.com https://static2.sharepointonline.com https://ajax.aspnetcdn.com https://appsforoffice.microsoft.com https://*.rollout.io https://*.facebook.com https://*.marketo.com https://*.mixpanel.com https://*.hubspot.com https://*.pardot.com https://*.getdrip.com https://*.google.com https://*.googleapis.com https://*.hsforms.net https://*.clearbit.com https://www.youtube.com https://s3.amazonaws.com https://sentry.io https://cdn.ravenjs.com https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://twemoji.maxcdn.com https://*.cloudfront.net https://intercom-sheets.com https://static.intercomassets.com https://js.intercomcdn.com https://cdn.segment.com https://api.segment.io https://maxcdn.bootstrapcdn.com https://*.intercom.io https://*.mutinycdn.com https://*.mutinyhq.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io https://*.bugsnag.com https://zoom.us https://*.gotomeeting.com https://*.rollout.io https://*.codox.io https://cdn.tiny.cloud https://js.stripe.com https://*.zdassets.com https://*.zendesk.com https://*.zopim.com wss://chilipiper.zendesk.com wss://*.zopim.com https://*.googleusercontent.com https://*.facebook.net https://*.doubleclick.net https://*.licdn.com https://*.googleadservices.com https://*.digitaloceanspaces.com https://*.ingest.sentry.io https://*.ingest.us.sentry.io https://canny.io/sdk.js https://changelog-widget.canny.io https://edge.fullstory.com https://rs.fullstory.com https://*.lr-in-prod.com https://polyfill.io https://*.planhat.com https://*.sprig.com https://com-chilipiper-prod1.mini.snplow.net https://com-chilipiper-prod1.collector.snplow.net https://fast.chameleon.io https://js.chargify.com https://selfservice.maxio.com https://hooks.slack.com https://*.logr-ingest.com https://*.posthog.com 'unsafe-inline'; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://fonts.gstatic.com https://fonts.googleapis.com https://js.intercomcdn.com; img-src * data: blob: 'unsafe-inline';

GET
H2 200 c9c27905c1e445d6.js Show response
client-registry.mutinycdn.com/personalize/client/ 52 KB
17 KB 689ms
453ms Script
application/javascript 151.101.65.91
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://client-registry.mutinycdn.com/personalize/client/c9c27905c1e445d6.js
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.91 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2bc7927791354f14b1cea4f8560731a590146eb2743d72146228fea0449599af

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: do7wOFVyz7xKQJPyJuyc5oxq9ylgvgXv
x-continent-code: EU
content-encoding: gzip
date: Thu, 06 Jun 2024 08:19:51 GMT
via: 1.1 varnish
x-edge-region: EU-West
x-amz-request-id: JM328F1ERMX5J8RW
age: 0
x-amz-server-side-encryption: AES256
x-cache: MISS
x-edge-datacenter: MAD
content-length: 16940
x-amz-id-2: tHdujPNauJ+OHK9kYWtUtlB7/gZFsL5h6RPGNSq/n6hsW5IXrCHv2AmSIR9Rcsv/c8s6gCMW3RE=
x-served-by: cache-mad22033-MAD
x-connection-speed: broadband
last-modified: Wed, 05 Jun 2024 13:35:03 GMT
server: AmazonS3
etag: "4a63772dfa4d6368dda007b91d618f10"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: s-maxage=3600, max-age=0
vary: X-Continent-Code, Accept-Encoding
accept-ranges: bytes
x-country-code: NL
x-cache-hits: 0

GET
H2 200 slick.css
cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/ 2 KB
1 KB 253ms
94ms Stylesheet
text/css 2a04:4e42:200::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/slick.css

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

de1e399b07289f3b0a8d35142e363e128124a1185770e214e25e58030dad48e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 06 Jun 2024 08:19:51 GMT
x-content-type-options: nosniff
content-encoding: br
age: 6836304
x-jsd-version: 1.8.1
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 590
x-served-by: cache-fra-etou8220022-FRA, cache-mad2200096-MAD
x-jsd-version-type: version
etag: W/"6f0-qUoFmzF4tK3sCeMoGs4oGaMAlaQ"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 index.umd.min.js Show response
cdn.jsdelivr.net/npm/@snowplow/browser-plugin-button-click-tracking@latest/dist/ 5 KB
2 KB 252ms
95ms Script
application/javascript 2a04:4e42:200::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@snowplow/browser-plugin-button-click-tracking@latest/dist/index.umd.min.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

dd479f154c8d4604ca2fba1ef0cb7cae4988a550fd4f6fb3bed41e5055f54e9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 06 Jun 2024 08:19:51 GMT
x-content-type-options: nosniff
content-encoding: br
age: 40218
x-jsd-version: 3.23.1
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 2045
x-served-by: cache-fra-etou8220149-FRA, cache-mad2200096-MAD
x-jsd-version-type: version
etag: W/"1257-2vakSVb/c/6JFLnSEZ9eV42zJl4"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 richtext.js Show response
cdn.jsdelivr.net/npm/@finsweet/attributes-richtext@1/ 8 KB
4 KB 64ms
58ms Script
application/javascript 2a04:4e42:200::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@finsweet/attributes-richtext@1/richtext.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

2c699eb55ae3fe61b3d783c8936ab1eb949c596a5c89118f703e328ede2b8308

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 06 Jun 2024 08:19:52 GMT
x-content-type-options: nosniff
content-encoding: br
age: 41154
x-jsd-version: 1.10.2
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 3918
x-served-by: cache-fra-eddf8230147-FRA, cache-mad2200096-MAD
x-jsd-version-type: version
etag: W/"2147-I41v+oq443LPQB6aPqMil27q9QY"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 65f75020c99f25928927347f_banner-blue-halo.webp
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/ 23 KB
23 KB 180ms
127ms Image
image/webp 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/65f75020c99f25928927347f_banner-blue-halo.webp
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 889e4055351e629718cc9647a7f696cb4fb1e246bcf29bd25e2f8ce5105c27b5

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:51 GMT
x-amz-version-id: VQxidV2D7M0v1MjkNARxPZzB4FkcrZg4
cf-cache-status: HIT
x-amz-request-id: FVC0AG6Z8KQDK4ZY
age: 570457
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 23574
x-amz-id-2: kI2yL3uRQSWZW5KqNaMbP8PThCMXuQay7I29RXR+7AffhNpP1L2pCRjUTEYwvkndpM0eyek1RJ8=
last-modified: Sun, 17 Mar 2024 20:18:41 GMT
server: cloudflare
etag: "cd3521a7574865352fcc31cd4d968864"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 88f6fad659573671-FRA
expires: Fri, 06 Jun 2025 08:19:51 GMT

GET
H3 200 66267cd1946bdc414612a045_banner-blue-halo-mobile.webp
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/ 11 KB
11 KB 272ms
219ms Image
image/webp 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/66267cd1946bdc414612a045_banner-blue-halo-mobile.webp
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 640d525f0c6d09a6cdc4c6f6b0d44c4d2d92ce5e35ae1a945ccac5da67071f9d

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:51 GMT
x-amz-version-id: 5.DnT5LYsjXZnxPaoCXpF7pRsl7yIEO1
cf-cache-status: HIT
x-amz-request-id: 674THVYTRCAQ75KT
age: 570457
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 11112
x-amz-id-2: p4x6HN1xxlACclsPyCooqJeyly1+SQpSDYgdp6+A2BfoGP6VZRY35v2eorepfYTMsM0y6nqiV3s=
last-modified: Mon, 22 Apr 2024 15:05:55 GMT
server: cloudflare
etag: "308d32f3c0dd65a14316ec46469ba463"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 88f6fad659593671-FRA
expires: Fri, 06 Jun 2025 08:19:51 GMT

GET
H3 200 655d92689c415e9fefcf2400_Hero-grapic-right-02.png
cdn.prod.website-files.com/655d92689c415e9fefcf2368/ 5 KB
5 KB 85ms
84ms Image
image/png 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/655d92689c415e9fefcf2368/655d92689c415e9fefcf2400_Hero-grapic-right-02.png
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a1e79865576e220b93dfe34d011286a8335ee8ac4eb6450300fb45a4f15a600e

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:51 GMT
x-amz-version-id: ds4He9jpqLhVudpNkauPNw12aaYIjxRr
cf-cache-status: HIT
x-amz-request-id: 4YCWPAEVDDMJMV8N
age: 569892
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 5002
x-amz-id-2: bFgTwodJJG5mDtD+rxPE2KwNVF/rFzNjz9XwG3gupt0i1usAevzx8TN1qnd6NazOqqld5niV+EA=
last-modified: Wed, 22 Nov 2023 05:32:26 GMT
server: cloudflare
etag: "d360d7cfb07b3fdc3fbc56204caa4c06"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 88f6fad79ad03671-FRA
expires: Fri, 06 Jun 2025 08:19:51 GMT

GET
H3 200 6579dd0b5f9a54376d296a87_Blog%20detail%20Banner%20Glitch%20Left%20Bottom.webp
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/ 7 KB
7 KB 89ms
89ms Image
image/webp 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a87_Blog%20detail%20Banner%20Glitch%20Left%20Bottom.webp
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6f3642cd8faa981a6b7f71cb0bd88a222ed7c92510100761c38f4bfd689853f2

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:51 GMT
x-amz-version-id: .9LTfep43eO88TqIHc3WnYAIb3vaJe3A
cf-cache-status: HIT
x-amz-request-id: 4YCR1FB4DR8S60ZM
age: 11304
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 6778
x-amz-id-2: a4/BBfn4/xT9GiFonft7PzXACqXoTj/migMdNrdoldT2Rojnj84zhnNX1rcGD6lux0ECasMwp1k=
last-modified: Thu, 21 Dec 2023 07:39:51 GMT
server: cloudflare
etag: "2deea30793899f56a236f1ba505155ab"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=84600
accept-ranges: bytes
cf-ray: 88f6fad7bb033671-FRA
expires: Fri, 07 Jun 2024 07:49:51 GMT

GET
H3 200 6579dd0b5f9a54376d296a5b_facebook.svg
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/ 368 B
676 B 61ms
60ms Image
image/svg+xml 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a5b_facebook.svg
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f2314da0b26cc727445f74c19d54f2f75944ea1a610497231ba6a5d9e541acf0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:51 GMT
x-amz-version-id: RZplueeOMT9I2ezQMMUJ8cw13HoQeV5p
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: 4YCYPC8MA0DPNYKD
age: 569891
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: sMyY1/K0a4fBORsGXvQgv7rCLzRtvk836VJQihoX6c0FHxRCMicx+o+LczMXE5iQzSnhlTgRrvI=
last-modified: Wed, 13 Dec 2023 16:34:21 GMT
server: cloudflare
etag: W/"b92a7c9703a268bda64464e9f8c245fd"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 88f6fad81b793671-FRA
expires: Fri, 06 Jun 2025 08:19:51 GMT

GET
H3 200 6579dd0b5f9a54376d296a6f_twitter.svg
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/ 351 B
690 B 52ms
48ms Image
image/svg+xml 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a6f_twitter.svg
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 553797b86e5516ebb3b4a6ffc794d7d9eca1fc1f3ca8ab0703e5eff9934e29c8

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
x-amz-version-id: qTS56BoR0gVqfX6mJuOtV4Wu10z6D4RY
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: 4YCW6KHZQFXNM3SV
age: 569892
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: UwkUGaL7c44O3NgBVKEce3ME5FEnvjsHhbYSQJfWS9i2npQlhgz08REAx4E45q+6ABVaDZQvut2KeooHcivWrudud62xsTZBwPdex/0w9Cs=
last-modified: Wed, 13 Dec 2023 16:34:21 GMT
server: cloudflare
etag: W/"e0a4b7f37d6875804665234ecff1cb23"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 88f6fada6e6d3671-FRA
expires: Fri, 06 Jun 2025 08:19:52 GMT

GET
H3 200 6579dd0b5f9a54376d296a70_linkedin.svg
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/ 675 B
821 B 51ms
47ms Image
image/svg+xml 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a70_linkedin.svg
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8f0f089b8d2746c56340171bba62f027d4d2dc0f520588d9480432693381e14a

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
x-amz-version-id: mMxIOUbXDP4hW6NdJCWI58VrmvAg.At1
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: 4YCJZM58NRF6KQPY
age: 569892
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: ZV/sIVDF7BksYTCipnDYPvY3RsIzarQt8H5yW0Gq3s97MqFEsRgHMvDR01EYcIYGFKXjZIMCBeO5Aof8DxVz71HNvwdr9q3h2e0jV5YwXCM=
last-modified: Wed, 13 Dec 2023 16:34:21 GMT
server: cloudflare
etag: W/"67b0ebebe9b8817edbfa41bdfd2e8c6e"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 88f6fada6e6e3671-FRA
expires: Fri, 06 Jun 2025 08:19:52 GMT

GET
H3 200 6579dd0b5f9a54376d296a5a_download.svg
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/ 820 B
799 B 49ms
45ms Image
image/svg+xml 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a5a_download.svg
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 350cf9ff67297ce9f79b1a35fb7205326d21f149ab404f81ec875968f0b7d083

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
x-amz-version-id: 5Ss_XSS0A3iWbPuuBVg7J8jICwbGfHO4
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: 4YCS40244C6BAVSC
age: 569892
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: T4C+SZuNuuCT1zi93ok8pCTUb7j1LuZ0dYg28v0B4J8zZn8I5Q8lYjaq7GFb6Xp+VveF5GwwU04=
last-modified: Wed, 13 Dec 2023 16:34:21 GMT
server: cloudflare
etag: W/"8d8c0614e1e224001d7c6dec535490b1"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 88f6fada6e703671-FRA
expires: Fri, 06 Jun 2025 08:19:52 GMT

GET
H3 200 6579dd0b5f9a54376d296a71_Blog%20banner%20Thumb%20Glitch%20Left.webp
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/ 2 KB
2 KB 53ms
49ms Image
image/webp 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a71_Blog%20banner%20Thumb%20Glitch%20Left.webp
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1402811141d6cf6956918acd3398468bd385081a50b90a5d251fe7a3312c0801

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
x-amz-version-id: X1oARd.5yRkM1108eqnTnHXez5VJo2XZ
cf-cache-status: HIT
x-amz-request-id: B2HAM0G64B66AMJP
age: 44422
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 1996
x-amz-id-2: 34T1ErqzyJnyvE+rjeZv9QP3Gib/5/cbXphGiiQHIm7GZe2CjrOdSxkYsUgMft5el3mXIPZnUSU=
last-modified: Thu, 21 Dec 2023 07:39:50 GMT
server: cloudflare
etag: "8a941746cf0b15b4b601f10dac732f1c"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=84600
accept-ranges: bytes
cf-ray: 88f6fada6e723671-FRA
expires: Fri, 07 Jun 2024 07:49:52 GMT

GET
H3 200 6579dd0b5f9a54376d296cb5_P-kZVXzLk34AiIQfGPLwk7aKSZHpgm9pwN8RZFWgoomkBCnOokwMREsV6PIuxQ_K1YbBrLrWRPbXvGX1MPE1rZ4vCsyfMOh0hnsQlbpOUTNsKtEjIHKg2uc7CffkI_T_119rmZHlGkqEroaLXQpzCqA.png
cdn.prod.website-files.com/6579dd0b5f9a54376d296939/ 214 KB
214 KB 183ms
179ms Image
image/png 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296cb5_P-kZVXzLk34AiIQfGPLwk7aKSZHpgm9pwN8RZFWgoomkBCnOokwMREsV6PIuxQ_K1YbBrLrWRPbXvGX1MPE1rZ4vCsyfMOh0hnsQlbpOUTNsKtEjIHKg2uc7CffkI_T_119rmZHlGkqEroaLXQpzCqA.png
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1bfde0b481cfb834c5ed8d6c6eb9597692c2df5d2f0be5352b50d4dca3749541

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
x-amz-version-id: pQy2nbe1pW1DR6bc6iH3PjcJpCSYpQL9
cf-cache-status: HIT
x-amz-request-id: EKGA1D4077XGM2F6
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
content-length: 219078
x-amz-id-2: E5xSEsSa96lUZaPCHb9Oh0UUro46xXHPasY+FzruTFmb8Crsy2KfDxsq2K/fkzIj0P5X2CFLiB4=
last-modified: Wed, 13 Dec 2023 16:34:22 GMT
server: cloudflare
etag: "1310bf4ef18508224bc49257df01fee6"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=84600
accept-ranges: bytes
cf-ray: 88f6fada6e753671-FRA
expires: Fri, 07 Jun 2024 07:49:52 GMT

GET
H3 200 6579dd0b5f9a54376d296cb7_2p2UFrEGBKLZsVjQqkGJruEbibVvNQfCjrY6bIsBw1tD06xArAeFlvRJ2drPXjsln71BUMhbFhi7L6uSzcdh8SGwunayJ7ykXzYvXFDYb4Xf_weR-kGgGHwhN0FikJs57lPowASEVp2sTZXXLZg4QFA.png
cdn.prod.website-files.com/6579dd0b5f9a54376d296939/ 980 KB
980 KB 290ms
286ms Image
image/png 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296cb7_2p2UFrEGBKLZsVjQqkGJruEbibVvNQfCjrY6bIsBw1tD06xArAeFlvRJ2drPXjsln71BUMhbFhi7L6uSzcdh8SGwunayJ7ykXzYvXFDYb4Xf_weR-kGgGHwhN0FikJs57lPowASEVp2sTZXXLZg4QFA.png
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d967ffcdff803d61e47cc2c176d0b5a86c9c5ba820aeabc27c6341b434aa11ba

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
x-amz-version-id: FpAfnWE2va.08SQUquwTM_fvSjF1x.MJ
cf-cache-status: REVALIDATED
x-amz-request-id: 7GKYHA6WED2XNYYD
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
content-length: 1003057
x-amz-id-2: iSbHjECecIWjhaKFVhASI0kIKeZTkyT0rS+nVUH0qGZuXUD8AqaTDhB119OsNI2+zl983qlgeFI=
last-modified: Wed, 13 Dec 2023 16:34:22 GMT
server: cloudflare
etag: "14dc6d0b324527e3638be18086c9674d"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=84600
accept-ranges: bytes
cf-ray: 88f6fada6e763671-FRA
expires: Fri, 07 Jun 2024 07:49:52 GMT

GET
H3 200 6579dd0b5f9a54376d296cb8_EdkY5ZS4W_go-ZjdQfGAIgqLmjXDn95suj9TjvBzgVf1chYT0gaopUMHwkgnXhi-7VVhXakXV5rFS0ig-oXkQrna8kgzjqvTaiEpjZrtWQItLZGzY6039U5LpYjz0zvKRwg-dgFOe5pyUAKc5sNXvRA.png
cdn.prod.website-files.com/6579dd0b5f9a54376d296939/ 244 KB
244 KB 235ms
231ms Image
image/png 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296cb8_EdkY5ZS4W_go-ZjdQfGAIgqLmjXDn95suj9TjvBzgVf1chYT0gaopUMHwkgnXhi-7VVhXakXV5rFS0ig-oXkQrna8kgzjqvTaiEpjZrtWQItLZGzY6039U5LpYjz0zvKRwg-dgFOe5pyUAKc5sNXvRA.png
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: baeb614251f7dbe98452c10ab2d3b7178259cb108dba86782e119dfa404eaf40

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
x-amz-version-id: 6hz.k3KVolrgrkNe04vR6U6gEC3W5y8K
cf-cache-status: REVALIDATED
x-amz-request-id: 7GKMKW4FZAYK5VJQ
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
content-length: 249380
x-amz-id-2: ujf36/Hex0ILujWOJmK9TrdiJ1s2vag5eQs0XP9/hSa6E+Ym99Gum7S7UdqQFgg1AB/OAZI/Aww=
last-modified: Wed, 13 Dec 2023 16:34:22 GMT
server: cloudflare
etag: "333ac8dfe3326426397eb95e7b245244"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=84600
accept-ranges: bytes
cf-ray: 88f6fada6e773671-FRA
expires: Fri, 07 Jun 2024 07:49:52 GMT

GET
H3 200 6579dd0b5f9a54376d296cb3__waaUDuigE2bpWItPi-SXaLP8VfgnC86zJ7TDFXpAfoYz0ePN3_F313queZEp-t4AXIYwa1gtzcIaV2EqU3ZIYvdzLWnPHExJBOTKqVuBig27as8pnQEJUvBpsmpzhQlqhvmbNtiEpKGuiXxXQwffNI.png
cdn.prod.website-files.com/6579dd0b5f9a54376d296939/ 103 KB
104 KB 404ms
401ms Image
image/png 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296cb3__waaUDuigE2bpWItPi-SXaLP8VfgnC86zJ7TDFXpAfoYz0ePN3_F313queZEp-t4AXIYwa1gtzcIaV2EqU3ZIYvdzLWnPHExJBOTKqVuBig27as8pnQEJUvBpsmpzhQlqhvmbNtiEpKGuiXxXQwffNI.png
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8ea3b372815e369458fc9043141a09847d93b9b6531a526d3cb3e3b9901bb872

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
x-amz-version-id: TCColATggaLZ7BYQUqoG3aeG.GqitiHL
cf-cache-status: REVALIDATED
x-amz-request-id: G88FBVTQ1W056JGN
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 105983
x-amz-id-2: zhwcY6BCsg6bS/3fXTdVsDVoZs5Vd4cC1c+xgXukS1JcQ2wmw4U/t5tU5sv8rNTHrp0DgeNGzxc=
last-modified: Wed, 13 Dec 2023 16:34:22 GMT
server: cloudflare
etag: "144426db0c1648fda1b75a56f67e71d8"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=84600
accept-ranges: bytes
cf-ray: 88f6fada6e783671-FRA
expires: Fri, 07 Jun 2024 07:49:52 GMT

GET
H3 200 6579dd0b5f9a54376d296cb9_TnlJMhJrEdhj5OEWVX68v1-MyT_MIbttA1Qk6uYR7wfIUNG48sV1UFS1gw5aDVcJThg1D_aUwyfavjV9wxEaOdaRqlY6Q_p4jXhifmDSWv3JfTMhyJSI7bq334bZrMtre4ScjnvgrasF8LuOKiF9h0s.png
cdn.prod.website-files.com/6579dd0b5f9a54376d296939/ 243 KB
243 KB 462ms
459ms Image
image/png 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296cb9_TnlJMhJrEdhj5OEWVX68v1-MyT_MIbttA1Qk6uYR7wfIUNG48sV1UFS1gw5aDVcJThg1D_aUwyfavjV9wxEaOdaRqlY6Q_p4jXhifmDSWv3JfTMhyJSI7bq334bZrMtre4ScjnvgrasF8LuOKiF9h0s.png
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 80224a6fb2c440d16519651d4f75ad89a263c0bba1abe4cce0c99e14fff30e1c

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
x-amz-version-id: Whz7LR9Ifs09NOluER0y7CmMdAhvBtWZ
cf-cache-status: REVALIDATED
x-amz-request-id: G889APP83KZJB5XB
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
content-length: 248482
x-amz-id-2: jrq0rAlHe9oXE3i3Dyo3elUsFLCdxHVjfatK0TlB0zum4W9/Mn1ePYLfkyxTrY8LQ4bhJgbwh2o=
last-modified: Wed, 13 Dec 2023 16:34:22 GMT
server: cloudflare
etag: "42b9928e00e8a67049e0bf30eb896fcb"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=84600
accept-ranges: bytes
cf-ray: 88f6fada6e793671-FRA
expires: Fri, 07 Jun 2024 07:49:52 GMT

GET
H3 200 6579dd0b5f9a54376d296cb4_nwTvh_ErT5tCzQjwXh4DtZ1sWLjlXbZ6OHB5Fn4s4QE0Kom2mUAXmoblZMLIs6tJ3aO8INkOp0Y_Xoj3Sjbd8yqyA04xGaQzsxK7be14RF53GFOQpmnGkC27yL53fOeFkjhm5M3Vwf6EYm5IBrRUQck.png
cdn.prod.website-files.com/6579dd0b5f9a54376d296939/ 86 KB
87 KB 490ms
486ms Image
image/png 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296cb4_nwTvh_ErT5tCzQjwXh4DtZ1sWLjlXbZ6OHB5Fn4s4QE0Kom2mUAXmoblZMLIs6tJ3aO8INkOp0Y_Xoj3Sjbd8yqyA04xGaQzsxK7be14RF53GFOQpmnGkC27yL53fOeFkjhm5M3Vwf6EYm5IBrRUQck.png
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa7cce711c78daac41c6eb65fdabdfea32daf468b2f6d699afce48f3839441ce

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
x-amz-version-id: RRZRAp71pDYRXLG8Pjo45AVOqNpgaS9x
cf-cache-status: REVALIDATED
x-amz-request-id: PPMD0K61SP4VQEHM
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 88384
x-amz-id-2: RKV9XkbnSLbwCMMnjQPDWucZ1ILMf2h8hiCboReVVxFBxfKhRgnu/VjIn7VVzPITUzEXbRmaJtA=
last-modified: Wed, 13 Dec 2023 16:34:22 GMT
server: cloudflare
etag: "cdfe63eba4768237467aa86ce9bdba00"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=84600
accept-ranges: bytes
cf-ray: 88f6fada6e7a3671-FRA
expires: Fri, 07 Jun 2024 07:49:52 GMT

GET
H3 200 6579dd0b5f9a54376d296cb6_DZwKEjd8Vgxf7NqBUgBZ16pS39dUIbnomsyuW-nzpbW9oQyBGxxuGa_VkqXkRkujSApLat-b7cZpTIgemrk3CXHfUTqgItjKm45Ke-dFA07O_iEJm_ekS5_8W5d2FSzaQKb1Df1KtBuP0jW8gxc3euM.png
cdn.prod.website-files.com/6579dd0b5f9a54376d296939/ 134 KB
134 KB 500ms
496ms Image
image/png 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296cb6_DZwKEjd8Vgxf7NqBUgBZ16pS39dUIbnomsyuW-nzpbW9oQyBGxxuGa_VkqXkRkujSApLat-b7cZpTIgemrk3CXHfUTqgItjKm45Ke-dFA07O_iEJm_ekS5_8W5d2FSzaQKb1Df1KtBuP0jW8gxc3euM.png
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7a293bb67e4fa8bd050bd5d553e254f66004a254eb5f5a7b56608a22fe72af81

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
x-amz-version-id: a6FCA.QqEeXs7ltQMGUQlG_m_mfiKma6
cf-cache-status: REVALIDATED
x-amz-request-id: 7GKSC6YB8X0QEKP2
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
content-length: 136790
x-amz-id-2: fhxHxbUq6m1AmKIxEmW4uEfotrJyT+RPVFr2jQdAsuWB/bVOSidGwPAPK+gLimSQV3UhKdSqgnM=
last-modified: Wed, 13 Dec 2023 16:34:22 GMT
server: cloudflare
etag: "f0f33f720ceb5ac91e7b21156a74a8b5"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=84600
accept-ranges: bytes
cf-ray: 88f6fada6e7b3671-FRA
expires: Fri, 07 Jun 2024 07:49:52 GMT

GET
H2 200 jquery-3.5.1.min.dc5e7f18c8.js Show response
d3e54v103j8qbb.cloudfront.net/js/ 87 KB
30 KB 162ms
65ms Script
application/javascript 18.244.20.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=6579dd0b5f9a54376d296915
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.244.20.40 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-244-20-40.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Origin: https://www.huntress.com
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 03:10:05 GMT
content-encoding: br
via: 1.1 5034084c037ff19008ba7c2c0b849a4c.cloudfront.net (CloudFront)
age: 18587
x-amz-cf-pop: FRA56-P11
x-cache: Hit from cloudfront
last-modified: Mon, 20 Jul 2020 17:53:02 GMT
server: AmazonS3
etag: W/"dc5e7f18c8d36ac1d3d4753a87c98d0a"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
vary: Accept-Encoding
x-amz-cf-id: _D5OzobA4331bKp_K8WI6HqxeHMoxdpyDlRpP-r6FrfEfcii7FAgLA==

GET
H3 200 huntress-new.27cb99f43.js Show response
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/js/ 1 MB
215 KB 58ms
57ms Script
text/javascript 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/js/huntress-new.27cb99f43.js
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a80b4664433645c7f13050b4a6e670df38a428e546c579ff003439c5bf45dfdb

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:51 GMT
content-encoding: gzip
x-amz-version-id: CWpgMFdWY_O1F.Kbq7.RPndxD6bVqKuz
cf-cache-status: HIT
x-amz-request-id: 89X0HQCFFK64QMZD
age: 44942
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 219967
x-amz-id-2: G2FlK9dnKc+TYN3fBh6M9X/QVCLRw5m1cz1UTZgZsAutxgSrGJaLzWFWQkW8CnPQL8nq+jpUW2g=
last-modified: Tue, 04 Jun 2024 13:58:52 GMT
server: cloudflare
etag: "9fbf72ab6f6f940c16205d0d869e54a5"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=84600
accept-ranges: bytes
cf-ray: 88f6fad87bf53671-FRA
expires: Fri, 07 Jun 2024 07:49:51 GMT

GET
H2 200 3911692.js Show response
js.hs-scripts.com/ 3 KB
1 KB 269ms
179ms Script
application/javascript 2606:4700::6810:89d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/3911692.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:89d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9fd098017af2261bad16d71f16eb849642460d7ac0d7f0651e9a086a245c853c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: b3333477-d5fa-485e-9ca8-102d755d0758
x-envoy-upstream-service-time: 10
content-length: 693
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: b3333477-d5fa-485e-9ca8-102d755d0758
last-modified: Thu, 06 Jun 2024 08:12:55 GMT
server: cloudflare
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://www.huntress.com
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-5d47c8d44f-jzhts
access-control-allow-credentials: true
cache-control: public, max-age=90
accept-ranges: bytes
cf-ray: 88f6fadaea711d8e-FRA
expires: Thu, 06 Jun 2024 08:21:22 GMT

GET
H2 200 slick.min.js Show response
cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/ 42 KB
11 KB 62ms
59ms Script
application/javascript 2a04:4e42:200::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/slick.min.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

0c7178cc6ca34fb18e30f070a5e7a1c287b2d7ccfcba2cfdf06e0f46eda55740

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 06 Jun 2024 08:19:52 GMT
x-content-type-options: nosniff
content-encoding: br
age: 10777490
x-jsd-version: 1.8.1
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 11325
x-served-by: cache-fra-eddf8230096-FRA, cache-mad2200096-MAD
x-jsd-version-type: version
etag: W/"a76f-O0GzvJVmhQFaNHoiOOcdsp36Dbs"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 bundle.v1.0.0.js Show response
tools.refokus.com/rich-text-enhancer/ 2 KB
1 KB 282ms
51ms Script
application/javascript 76.76.21.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tools.refokus.com/rich-text-enhancer/bundle.v1.0.0.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.61 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

a577cc713533d7a1edbc5186c3f7b8788bbf317a857111150778d6a617220cec

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
content-encoding: br
strict-transport-security: max-age=63072000
server: Vercel
x-vercel-id: fra1::gm7jf-1717661992127-8509aeef0836
age: 4430870
etag: W/"bfd9ff53d0c1baa43dbb0f44751f23e9"
x-vercel-cache: HIT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
content-disposition: inline; filename="bundle.v1.0.0.js"

GET
H2 200 medium-zoom.min.js Show response
cdn.jsdelivr.net/npm/medium-zoom@1.0.3/dist/ 9 KB
3 KB 61ms
60ms Script
application/javascript 2a04:4e42:200::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/medium-zoom@1.0.3/dist/medium-zoom.min.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

89aa43cb2db8717165e898b18806ad757585f8815f9f514bb0afbd3c390def95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 06 Jun 2024 08:19:52 GMT
x-content-type-options: nosniff
content-encoding: br
age: 773355
x-jsd-version: 1.0.3
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 3091
x-served-by: cache-fra-etou8220020-FRA, cache-mad2200096-MAD
x-jsd-version-type: version
etag: W/"2408-5ck9kUxd8AglB+1wj1aqAh/vLDs"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 form-124.js Show response
hubspotonwebflow.com/assets/js/ 10 KB
3 KB 174ms
83ms Script
application/javascript 76.76.21.164
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://hubspotonwebflow.com/assets/js/form-124.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.164 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

10ef3ba5308697292067120aee8cea7f3341a9a5e691475bc4a29805a5194939

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Origin: https://www.huntress.com
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
content-encoding: br
strict-transport-security: max-age=63072000
server: Vercel
x-vercel-id: fra1::jqs8p-1717661992149-4f9fb50f4c76
age: 1692792
x-matched-path: /assets/js/form-124.js
etag: W/"392ca1f460caa2aa9439969a89f31c13"
x-vercel-cache: HIT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
content-disposition: inline; filename="form-124.js"

GET
H3 200 6579dd0b5f9a54376d296915%2F6470f5217e03b0faa8a404de%2F658a9a0642f212b4ef59b0b2%2Fhs_trackcode_3911692-1.0.6.js Show response
cdn.prod.website-files.com/ 144 B
557 B 51ms
49ms Script
application/javascript 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915%2F6470f5217e03b0faa8a404de%2F658a9a0642f212b4ef59b0b2%2Fhs_trackcode_3911692-1.0.6.js
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6ee38878cd3f57c918114ecd1a74bc75e5165f45fd1e9503056e8dc2e542288f

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
content-encoding: gzip
x-amz-version-id: fKVYVp7VLozdKwo7Gp68VwPn_1qCAcOV
cf-cache-status: HIT
x-amz-request-id: SYEPP1MBFVBP058T
age: 61858
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 131
x-amz-id-2: It1eBzpZVnFTLQ7hYsT/FOvvhmuILy6yJgP12wGRKjX00CTwd4kQtBd4BAb5qP9uRg4/NzC0EliEsezE5I7hkm/94Jtwo3YhPk6dRyrr67Q=
last-modified: Tue, 26 Dec 2023 09:16:55 GMT
server: cloudflare
etag: "94d95acc94c6624c39cb9873e3da3787"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=84600
accept-ranges: bytes
cf-ray: 88f6fada6e6b3671-FRA
expires: Fri, 07 Jun 2024 07:49:52 GMT

GET
H2 200 recaptcha__nl.js Show response
www.gstatic.com/recaptcha/releases/DH3nyJMamEclyfe-nztbfV8S/ 526 KB
209 KB 133ms
44ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/DH3nyJMamEclyfe-nztbfV8S/recaptcha__nl.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

81bb134d1bbd3e31e1ddac9449ef1c509b7061a14e15554d625569cb38af44d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Origin: https://www.huntress.com
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 04 Jun 2024 14:26:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 150786
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 213502
x-xss-protection: 0
last-modified: Mon, 27 May 2024 02:00:43 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 04 Jun 2025 14:26:46 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 363 KB
109 KB 179ms
92ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

dab9d3dbee663364025cd763f3dbb199e33f5dcf5b978f5c8699aa6368aed589

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 111428
x-xss-protection: 0
last-modified: Thu, 06 Jun 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 06 Jun 2024 08:19:52 GMT

GET
H2 200 6si.min.js Show response
j.6sc.co/ 66 KB
18 KB 37ms
34ms Script
application/javascript 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/j/8769192b-20ba-4df2-8d62-2740a805c3e8.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dc93c5b3243e66c7b2e27c51b76fa6a11bd7a6d7546c5fa26bbffa001f885305

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 06 Jun 2024 08:19:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 09 May 2024 06:01:25 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "663c66b5-106b3"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 18038
expires: Thu, 06 Jun 2024 08:19:52 GMT

GET
H2 200 5d3cypit2iz8.js Show response
js.driftt.com/include/1717662000000/ 212 KB
60 KB 687ms
426ms Script
application/javascript 18.245.86.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1717662000000/5d3cypit2iz8.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.14 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-14.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

93a2fd82dd3a13a9e9ce0583f3bde1b6e88da6ebce30fa8c87cee4d9d927e4d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: fwT06mdOrTHjuLmyd8.idzR8VPd5.dxi
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
via: 1.1 c396de17c1b5d58233088e40dd170cf4.cloudfront.net (CloudFront), 1.1 9ed190c9d6b2f812d19cbb317856ed88.cloudfront.net (CloudFront)
date: Thu, 06 Jun 2024 08:19:52 GMT
content-encoding: gzip
x-amz-cf-pop: IAD66-C1, FRA60-P6
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 36
last-modified: Mon, 21 Aug 2023 14:57:31 GMT
server: istio-envoy
etag: W/"576cdc1c0941a520c47b54aef3b463f7"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=10
access-control-allow-credentials: true,true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 0ugOsf3oLnPInq-7RFVpATl2CPCcq1610sb6JRQ5V2-FIYgjOySWMA==

GET
H3 200 6579dd0b5f9a54376d296a7c_search.svg
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/ 654 B
712 B 46ms
46ms Image
image/svg+xml 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a7c_search.svg
Requested by: Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.3ca223936.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 442375f1dd6362e4a3e889f3f11e7d14aa686899a36f112ae73986a80475681b

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.3ca223936.min.css
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
x-amz-version-id: ZAs7majvHYt8oLX63btjRfdozrskAdOe
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: FVC6ENAZS09JPTQT
age: 569800
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: iMwtTJTlsQic062ldR2tWWe/QpI/twW/kC08NAuSkE36Uv1Ip3dKhA5wwkH3rJWcJmGyDJqQCFeIpDIE2IHBQQ==
last-modified: Wed, 13 Dec 2023 16:34:21 GMT
server: cloudflare
etag: W/"166c01555262c9617db663ec8a38364b"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 88f6fada7e873671-FRA
expires: Fri, 06 Jun 2025 08:19:52 GMT

GET
H2 200 6579dd0b5f9a54376d296925_hknova-regular-webfont.woff2
assets.website-files.com/6579dd0b5f9a54376d296915/ 17 KB
18 KB 361ms
185ms Font
application/octet-stream 2600:9000:235a:f000:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296925_hknova-regular-webfont.woff2
Requested by: Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.3ca223936.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:f000:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 71425f588c17edb9905c3ed73aee0404b58772b91c8154fe53d3157f58f0b2e2

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://cdn.prod.website-files.com/
Origin: https://www.huntress.com
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Dec 2023 20:23:09 GMT
x-amz-version-id: At.YFBHJO4EQclecPPM23aBnfk3j2h1H
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
age: 13867004
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 17728
last-modified: Wed, 13 Dec 2023 16:34:20 GMT
server: AmazonS3
etag: "fd0185054945b2abe907dc7e524389c9"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: IBzrYfbdorQd065YNM6y_-j1LeBn6EJGjR9UK6pXkjkwhdyDIbNl3Q==

GET
H2 200 6579dd0b5f9a54376d29691d_hknova-bold-webfont.woff2
assets.website-files.com/6579dd0b5f9a54376d296915/ 18 KB
18 KB 350ms
175ms Font
application/octet-stream 2600:9000:235a:f000:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d29691d_hknova-bold-webfont.woff2
Requested by: Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.3ca223936.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:f000:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a4aba4543a40b2e2d78e4006eb941a3a18cf95dc81041ad362321a3995bcc898

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://cdn.prod.website-files.com/
Origin: https://www.huntress.com
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Dec 2023 20:23:17 GMT
x-amz-version-id: 4JksoGDTlz479HpJYtobtrz0YXSwp3Rx
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
age: 13866996
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 18204
last-modified: Wed, 13 Dec 2023 16:34:20 GMT
server: AmazonS3
etag: "5aec097021a58170197314c745d296db"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: AfPCzqrTDw-oQdLL-0d1XkkItEFDsHpdGQdPHbBLrKu2O5kJTFdcFw==

GET
H2 200 6579dd0b5f9a54376d296961_visuelt-bold-webfont.woff2
assets.website-files.com/6579dd0b5f9a54376d296915/ 21 KB
21 KB 403ms
228ms Font
application/octet-stream 2600:9000:235a:f000:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296961_visuelt-bold-webfont.woff2
Requested by: Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.3ca223936.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:f000:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 36b097a74149a547cc7fe1da7b5a9cacf6c36d2f91872f11874479e1d4fafee2

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://cdn.prod.website-files.com/
Origin: https://www.huntress.com
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Dec 2023 20:23:09 GMT
x-amz-version-id: 6cft5KdwVHtlIu77Lo8AxPLF1V_1aCGv
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
age: 13867004
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 21280
last-modified: Wed, 13 Dec 2023 16:34:20 GMT
server: AmazonS3
etag: "4be3159e8cb3fb66b8e847dd0bedb2ed"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: _zh7heqFqtsN_IyIAM_WjtzoUjbbmzeSP7trREOIrmu4GTC0d3BNdg==

GET
H2 200 6579dd0b5f9a54376d296927_hknova-semibold-webfont.woff2
assets.website-files.com/6579dd0b5f9a54376d296915/ 18 KB
18 KB 398ms
223ms Font
application/octet-stream 2600:9000:235a:f000:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296927_hknova-semibold-webfont.woff2
Requested by: Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.3ca223936.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:f000:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ace449f8c185f9f62716fd9998c8f4d09f6849ead77ec8c3849aa69f4c8c1d36

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://cdn.prod.website-files.com/
Origin: https://www.huntress.com
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 30 May 2024 14:18:18 GMT
x-amz-version-id: SgNlIeK2CMt3IfgkJzcYPm6BQJFO8VdG
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
age: 583295
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 18124
last-modified: Wed, 13 Dec 2023 16:34:20 GMT
server: AmazonS3
etag: "b62b51b8a8a1c83c200a484a4149c151"
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: dAEUvBkrX6hDNVWfPkDK02WqKgOJnUfTZueWoRZfVnqCUSzvT4uFDA==

GET
H2 200 6579dd0b5f9a54376d296a6e_DMSans_24pt-Bold.ttf
assets.website-files.com/6579dd0b5f9a54376d296915/ 55 KB
29 KB 267ms
92ms Font
application/x-font-ttf 2600:9000:235a:f000:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a6e_DMSans_24pt-Bold.ttf
Requested by: Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.3ca223936.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:f000:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0020be3f1555293342637940e02d32e0f0c3b1951f6a274c00a6e3afe91610d1

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://cdn.prod.website-files.com/
Origin: https://www.huntress.com
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 30 May 2024 18:10:34 GMT
x-amz-version-id: quM.7z1k_e9xiPUszqLumStS9j4JLmMp
content-encoding: br
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
age: 569359
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Wed, 13 Dec 2023 16:34:21 GMT
server: AmazonS3
etag: W/"541d84af93ed55a92a75644198c26ca5"
vary: Accept-Encoding
content-type: application/x-font-ttf
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
x-amz-cf-id: OiGtwE-5f4dUdeyR-KEOoFuuvXkmFxdNCPEBlrACJ3I-BcVpaD5aTw==

GET
H2 200 6579dd0b5f9a54376d29694d_roboto-regular-webfont.woff2
assets.website-files.com/6579dd0b5f9a54376d296915/ 19 KB
19 KB 346ms
171ms Font
application/octet-stream 2600:9000:235a:f000:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d29694d_roboto-regular-webfont.woff2
Requested by: Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.3ca223936.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:f000:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7f62ee80b8c824f30ad6c278146632d25b7e159e0a9cd91a356068eb9340061c

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://cdn.prod.website-files.com/
Origin: https://www.huntress.com
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 30 May 2024 17:52:16 GMT
x-amz-version-id: 1upZc36cdk27x7Arg8l9thaL3L34ome5
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
age: 570457
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 19348
last-modified: Wed, 13 Dec 2023 16:34:20 GMT
server: AmazonS3
etag: "a0118c6d18835732ae0eb880babc7598"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: I_gfaizGJuuqV3ztp9bORvXNUDXCybhUl_BE0P0cB2LSKOELQpyA8w==

GET
H3 200 655ddcc107aef728354e9cbf_Huntress-logo.svg
cdn.prod.website-files.com/655ddcc107aef728354e9c2a/ 16 KB
13 KB 68ms
60ms Image
image/svg+xml 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/655ddcc107aef728354e9c2a/655ddcc107aef728354e9cbf_Huntress-logo.svg
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3e74699ee2810c89e5df5bd0d0506256c46f1e73108f40dc993b49cc210203db

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
x-amz-version-id: ll9DT5jxvCo6dqqJTOhzWIKk94gBwQHc
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: FVC9ZRCHG5AA2V2J
age: 570458
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 77qMVv7ufETdG50NGIu6BByCVbU86Yqk2d1mXcr/mrGnWmPWKixKwdXe8oP4KiDVh/s0IY+STdE+A9dgsR1cdXcisL1GVgdGzALwNYVvDEY=
last-modified: Wed, 22 Nov 2023 10:49:38 GMT
server: cloudflare
etag: W/"1b58a7f9d25209475f7150623a7b9993"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 88f6fadaceea3671-FRA
expires: Fri, 06 Jun 2025 08:19:52 GMT

GET
H3 200 656079b2a6c055ce7d368e61_Secondary%20Text%20CTA%20Black%20(1).svg
cdn.prod.website-files.com/655d92689c415e9fefcf2368/ 407 B
677 B 77ms
68ms Image
image/svg+xml 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/655d92689c415e9fefcf2368/656079b2a6c055ce7d368e61_Secondary%20Text%20CTA%20Black%20(1).svg
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ad1a0bf17b8433241806ec0b3cb9c17be616ea295df90068ab3e646de802e111

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
x-amz-version-id: 6MUyKzg7.UI2lqy3cc43_aNDTQO42ExF
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: 4FKCZYHHJ70JJPYD
age: 569893
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: fcnhmpJThlBI1SiSJSolHRvOCLzCcQY8u0NRwMZ+qQUT9xdwftby5XlqaNhH2G0IzvlOQJeuSpA=
last-modified: Fri, 24 Nov 2023 10:23:48 GMT
server: cloudflare
etag: W/"7b97da408ecd186da2775e85d3b5fc35"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 88f6fadaceef3671-FRA
expires: Fri, 06 Jun 2025 08:19:52 GMT

GET
H3 200 6579dd0b5f9a54376d296a89_Landing%20WWW%20Glitch%20Right.webp
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/ 2 KB
3 KB 68ms
60ms Image
image/webp 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a89_Landing%20WWW%20Glitch%20Right.webp
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c99531b584c2990420c6cf8f267e27bca20375cf89d4afdcaa5b3afb7a9f35d2

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
x-amz-version-id: 0.i3tZnqpf4mpcjZIZI6k.PdzUSOLecT
cf-cache-status: HIT
x-amz-request-id: BEDZACE7WHACFJ9Q
age: 11305
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 2196
x-amz-id-2: qvMIhiWq/WQAtXFhkHVXbQx/Mz5uvFn+30JgPpivsiuKT8hEi6s5LaslaLKRDq20ZhUCk+vHznc=
last-modified: Thu, 21 Dec 2023 07:39:51 GMT
server: cloudflare
etag: "3574559fb267295e5e44a4509e2e6e4f"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=84600
accept-ranges: bytes
cf-ray: 88f6fadacef13671-FRA
expires: Fri, 07 Jun 2024 07:49:52 GMT

GET
H2 200 19680a27e88da4a3713af26571b4849096e75d617f2845574af7fd15746256bb.js Show response
huntresscdn.com/ 111 KB
112 KB 272ms
102ms Script
text/plain 2606:4700:20::681a:1ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://huntresscdn.com/19680a27e88da4a3713af26571b4849096e75d617f2845574af7fd15746256bb.js
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:1ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 19680a27e88da4a3713af26571b4849096e75d617f2845574af7fd15746256bb

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
cf-cache-status: HIT
last-modified: Thu, 06 Jun 2024 08:04:47 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 905
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uCZLm0rQiXvwXzRRD0rXQ5vsMHXQG1%2B6GAIgxVIKofjis0sbIlOZx7r753ejJljAzhKtFk35HrmMSyjED27Zs3YGrq%2BjuXcZgPbrdDwNY3TzDEtIgWA%2BrJViTHseIMbAZN9h4BMp%2BXriSaRKnw%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=14400, maxage=14400
accept-ranges: bytes
cf-ray: 88f6fadc69d89013-FRA
content-length: 113865

GET
H3 200 purify.es.min.js Show response
cdn.jsdelivr.net/npm/dompurify@2/dist/ 24 KB
10 KB 224ms
128ms Script
application/javascript 151.101.129.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/dompurify@2/dist/purify.es.min.js

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/@finsweet/attributes-richtext@1/richtext.js

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a5b09c5d507da92ea94a3f319e31f6196954b0ea63f9890388a37e8facdae2a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Origin: https://www.huntress.com
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 06 Jun 2024 08:19:52 GMT
x-content-type-options: nosniff
content-encoding: br
age: 24505
x-jsd-version: 2.5.5
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 9720
x-served-by: cache-fra-eddf8230112-FRA, cache-mad22076-MAD
x-jsd-version-type: version
etag: W/"613f-gBbu2pe4IQTFv2qqb/i7EJWgI6o"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 6 KB
4 KB 245ms
84ms Script
application/javascript 2606:4700::6811:80ac
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsadspixel.net/fb.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3911692.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:80ac , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

47d1036cdfb7fa765e45f0f3d193baadcd53005e95a2f9bf7b531ebfbf41ea2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
x-amz-version-id: tGbAtiolnAFnleIlWBGAzvQOiFsm5cIW
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 4715507645a6516d2df35cd342cb5be0.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
age: 521
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.563/bundles/pixels-release.js&cfRay=88f6ee221e340394-FRA
x-cache: Hit from cloudfront
x-hubspot-correlation-id: d8390914-39de-4aa9-a982-5c90ba739a8e
cache-tag: staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 0
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: d8390914-39de-4aa9-a982-5c90ba739a8e
last-modified: Thu, 30 May 2024 14:14:49 UTC
server: cloudflare
etag: W/"7f1cb0f6264fd05edb4cc0ec6a9bc096"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-wlmbb
cf-ray: 88f6fadd1a8e9bb9-FRA
x-amz-cf-id: _IlvJ1TNDXjxyPMXSnj2M1PVqMg0iKFKTzYuU7p1mBArypberqakGg==
x-hs-target-asset: adsscriptloaderstatic/static-1.563/bundles/pixels-release.js

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 551 KB
92 KB 245ms
81ms Script
application/javascript 2606:4700::6812:8b11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsleadflows.net/leadflows.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3911692.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:8b11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dd26d9d88899d0587c9377964b7d1ab478a318b0fdbee7b9d6a084e4aa6425f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Origin: https://www.huntress.com
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
age: 73985
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1355/bundle/main/lead-flows-release.js&cfRay=88efec964e841e33-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"be45bdb720f44c8db4ee42bc228ff2a8"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=86400, max-age=0
x-hs-target-asset: lead-flows-js/static-1.1355/bundle/main/lead-flows-release.js
date: Thu, 06 Jun 2024 08:19:52 GMT
x-amz-version-id: HLkmxotJV8gQ_mnvhNwLT9fnVmh1uWjb
x-content-type-options: nosniff
cf-cache-status: HIT
via: 1.1 e21fbbed60133ff896ee44224814dc5c.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: e866a2a5-cb6f-4f21-b3fa-14dbf5694d97
x-cache: Hit from cloudfront
cache-tag: staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 8
x-evy-trace-route-configuration: listener_https/all
x-request-id: e866a2a5-cb6f-4f21-b3fa-14dbf5694d97
last-modified: Thu, 30 May 2024 10:22:15 UTC
server: cloudflare
access-control-max-age: 3000
x-hs-cache-status: MISS
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-vdptk
cf-ray: 88f6fadd1d7d3a3d-FRA
x-amz-cf-id: 3jltYW9p5-2V7rmBvF5YPwIOr1xl4jq2yOQH0qlLroA_VG7sqaWrmA==

GET
H2 200 web-interactives-embed.js Show response
js.hubspot.com/ 82 KB
24 KB 317ms
151ms Script
application/javascript 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hubspot.com/web-interactives-embed.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3911692.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2af4c240d46b3e99eea9ccbfd9c0c1c856c710a5ed3692f455767a96224171b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Origin: https://www.huntress.com
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.1159/bundles/project.js&cfRay=88f6fadd2ade9f54-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"e6c06eb0663c717e3d4635531672a1e1"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-hs-target-asset: web-interactives-embed/static-2.1159/bundles/project.js
date: Thu, 06 Jun 2024 08:19:52 GMT
x-amz-version-id: V4YhUHRJMuZkqxb1cpgehoNLVpfwce83
x-content-type-options: nosniff
cf-cache-status: EXPIRED
via: 1.1 872e43fac89d80c9557000efb9c31650.cloudfront.net (CloudFront)
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: bc348f84-b22f-4019-8dd4-991b88c2d28d
x-cache: Hit from cloudfront
cache-tag: staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 1
x-evy-trace-route-configuration: listener_https/all
x-request-id: bc348f84-b22f-4019-8dd4-991b88c2d28d
last-modified: Mon, 03 Jun 2024 20:17:08 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YpW7GiNBaxg82FgYY0xYkS7sF%2F%2FD71ZjzOPSEwR%2FYF65kuQ4s6Uc85%2FgImtnEXDcnB6ZPYO3ZuK8iyh42Qg%2BcPHR3KyPERkoyQO%2BYintNP5pV1PekjBmji3uvEalz86JJ50PRWqK7ulhK2o0"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-tk5t7
cf-ray: 88f6fadd2ade9f54-FRA
x-amz-cf-id: VePSv28CAMESA6YPk4K13KZOOAfhqGfXHI6qSgTrmD4o2Ff1TeQqdQ==

GET
H2 200 3911692.js Show response
js.hs-banner.com/ 61 KB
19 KB 557ms
394ms Script
text/javascript 2606:4700:4400::ac40:991b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/3911692.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3911692.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:991b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0a7e62074b4311ed600655962e3217c9f2c33bd454457523a1d0fe36dfbb2207

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
x-amz-version-id: RDrUrFX49NqTvtKL.PRguE6RUBzrS.gk
content-encoding: gzip
cf-cache-status: REVALIDATED
x-amz-request-id: W6T8JJRB5W5324PZ
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 8e2f2d60-cff0-4479-a596-9bd1012eb950
x-envoy-upstream-service-time: 58
x-amz-id-2: 1DIeYPN7YHX3Z/Xj93n8ajjKmTdjNc/fMHzxAiWdWhLYnrcKff3f2X1X8Rfl7t2vs4pZQLUlrEA=
x-evy-trace-listener: listener_https
x-request-id: 8e2f2d60-cff0-4479-a596-9bd1012eb950
x-evy-trace-route-configuration: listener_https/all
last-modified: Wed, 10 Apr 2024 21:07:09 GMT
server: cloudflare
etag: W/"381b0631a0eece43d9975eebeac4018a"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.huntress.com
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6685c9958f-vhl7w
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 88f6fadd1ac19299-FRA
expires: Thu, 06 Jun 2024 08:24:52 GMT

GET
H2 200 3911692.js Show response
js.hs-analytics.net/analytics/1717661700000/ 69 KB
25 KB 327ms
169ms Script
text/javascript 2606:4700::6811:afc9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1717661700000/3911692.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3911692.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:afc9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fb60a91372499fbe6347fe3e7e4025436de778648109690751ee1fcf1a0d9b10

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
x-amz-version-id: null
content-encoding: gzip
cf-cache-status: MISS
x-amz-request-id: FT1S4GH9RWXVYG4A
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 7ab33d01-f466-4daf-b7b6-b7f257a22025
x-envoy-upstream-service-time: 25
x-amz-id-2: of+SS+Ky99Pu8LFLSTNg/wxQOqwNB9iZNJ1QcxT5uxzeR9IopYiFkTE5cVAn1OJLLYao5xUheBaBeLZwRioFTUmu7A2uBm8C
x-evy-trace-listener: listener_https
x-request-id: 7ab33d01-f466-4daf-b7b6-b7f257a22025
x-evy-trace-route-configuration: listener_https/all
last-modified: Thu, 30 May 2024 20:52:12 GMT
server: cloudflare
etag: W/"fab0749dacb154cc880867d4229e89e3"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-78cb6f459b-2r68v
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 88f6fadd1b7c9202-FRA
expires: Thu, 06 Jun 2024 08:24:52 GMT

GET
H2 200 collectedforms.js Show response
js.hscollectedforms.net/ 69 KB
25 KB 315ms
151ms Script
application/javascript 2606:4700::6810:6dfe
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hscollectedforms.net/collectedforms.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3911692.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:6dfe , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

53a3dc763a0bd679523a77f5610e4ab27231fe6763d7089c1c92966daa1663f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Origin: https://www.huntress.com
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.503/bundles/project.js&cfRay=88f6fadd2b672bf8-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"7d377a186677c174f204d466b8fa5fdb"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=600, max-age=300
x-hs-target-asset: collected-forms-embed-js/static-1.503/bundles/project.js
date: Thu, 06 Jun 2024 08:19:52 GMT
x-amz-version-id: WQne3xdBhaNpu67z_dXMAVxQ_qJQQf8W
x-content-type-options: nosniff
cf-cache-status: EXPIRED
via: 1.1 c0b0d7167cc2eb52d8d154aa7fc03a0a.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: 87534ea1-1fdd-4c6d-9585-9543faf228bd
x-cache: Hit from cloudfront
cache-tag: staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 7
x-evy-trace-route-configuration: listener_https/all
x-request-id: 87534ea1-1fdd-4c6d-9585-9543faf228bd
last-modified: Wed, 15 May 2024 14:34:44 UTC
server: cloudflare
access-control-max-age: 3000
x-hs-cache-status: MISS
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-wlmbb
cf-ray: 88f6fadd2b672bf8-FRA
x-amz-cf-id: RkOITLOi0FYvqViDPN74PzmkGQ5TimPN9WPAguWId523Q_YhH2NgTg==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 339 KB
108 KB 124ms
122ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-GCTMBVFESS&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

784a558a18c328609e15a041c0cdb8efdfec2e6f6c9759d40fcc952189db0aee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 110574
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 06 Jun 2024 08:19:52 GMT

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 263 KB
91 KB 129ms
126ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-429191348&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c282418db43d8c7988bebfb20fabf99d5598b033ed5fd45ad9b9460e59baac91

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 92623
x-xss-protection: 0
last-modified: Thu, 06 Jun 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 06 Jun 2024 08:19:52 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 47 KB
17 KB 311ms
86ms Script
application/javascript 2a02:26f0:3500:16::215:148d
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:16::215:148d Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

899d1ec3c095342571d3be2091ec6f984d4cc82390d1f61945c391fa035b00d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 06 May 2024 17:20:18 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=66965
accept-ranges: bytes
content-length: 16683

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 42 KB
13 KB 282ms
88ms Script
application/javascript 2a04:4e42::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 5eee7eef8c43d97d6c92ce9000b3f2424647e58f985c2df5711690c8b95f1495

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Wed, 22 May 2024 17:01:28 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "16b7761205515ddc0668c12c434e8f00"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 12104

GET
H3 200 qevents.js Show response
a.quora.com/ 41 KB
14 KB 167ms
97ms Script
text/plain 162.159.152.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.quora.com/qevents.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 162.159.152.17 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5af5ee0b37b1f0ef31c42932bbf81424e4bb53e95e87a47e058625c1af2245db

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
x-amz-version-id: jrgqQn59BHyNBJEhUqaibHl1Lk06.AzO
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: M04HPBTPY5GDBBF5
age: 6014767
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: Tl+NCrT4/ROq8BOB/jXEFbjekr+B/799PB4hsh4cPaz8GcT19YQzaMe+k+f+IJxKpv7tKCeNqoQ=
last-modified: Thu, 28 Mar 2024 17:33:19 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: md5:87b5ecaafd0e88097cbbb1bbb7695fe9
etag: W/"87b5ecaafd0e88097cbbb1bbb7695fe9"
vary: Accept-Encoding
content-type: text/plain
cache-control: public, max-age=14400
cf-ray: 88f6fade2b51974b-FRA
expires: Thu, 06 Jun 2024 12:19:52 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 197ms
67ms Script
application/javascript 146.75.120.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.120.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
content-encoding: gzip
last-modified: Thu, 04 Apr 2024 00:26:35 GMT
x-amz-server-side-encryption: AES256
etag: "bbbcf811d8437a575d796a4c1e5d4fad+gzip+gzip"
vary: Accept-Encoding,Host
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15412
x-served-by: cache-iad-kcgs7200164-IAD, cache-fra-etou8220146-FRA

GET
H2 200 bat.js Show response
bat.bing.com/ 45 KB
13 KB 300ms
91ms Script
application/javascript 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Thu, 06 Jun 2024 08:19:52 GMT
last-modified: Thu, 29 Feb 2024 19:58:06 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: DEB14F31B7EC44F39B4E5AA1F65BEDA3 Ref B: DUS30EDGE0315 Ref C: 2024-06-06T08:19:52Z
etag: "01b4e9c496bda1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13261

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 219 KB
59 KB 281ms
87ms Script
application/x-javascript 2a03:2880:f084:105:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

83ebe8170b3b5dda2d20a80fe205ec14e1f8cb19ed40cfe73d480087b588e56c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 06 Jun 2024 08:19:52 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57975
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: GOOD; q=0.7, rtt=51, rtx=0, c=12, mss=1297, tbw=2809, tp=-1, tpl=-1, uplat=0, ullat=-1
pragma: public
x-fb-debug: niDA1meNqqqzmbk6uxzmUCLa+/WXHrL50Gk48BNxmpq/1S7YSdpQSKZOAH+lcXoIhuTeZQlbvr85zmL7El0wyw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 1006267.js Show response
tracking.g2crowd.com/attribution_tracking/conversions/ 2 KB
1 KB 340ms
146ms Script
text/javascript 2606:4700:4400::6812:2b1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://tracking.g2crowd.com/attribution_tracking/conversions/1006267.js?p=https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&e=

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2b1f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5365009cca534a115390ff165814f91411ed92aa9722680e2cc00a0266f8ea6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
content-encoding: br
x-permitted-cross-domain-policies: none
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
content-disposition: inline
x-xss-protection: 0
referrer-policy: no-referrer
server: cloudflare
cross-origin-opener-policy: same-origin
x-download-options: noopen
vary: Origin, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
origin-agent-cluster: ?1
cf-ray: 88f6fadf5ff53a5e-FRA

GET
H2 200 e666a54d-ff29-48f9-9baa-2be6ac05412e.js Show response
j.6sc.co/j/ 837 B
837 B 470ms
469ms Script
application/javascript 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/j/e666a54d-ff29-48f9-9baa-2be6ac05412e.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-184.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 82ba33778a6595a59baef6e6964c64d7c3e9888c2bbf74461f1948b295db28e2

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: iBgsOgE4Kr3Z0Ccj2rm1wK8VxmZ_A29h
content-encoding: gzip
date: Thu, 06 Jun 2024 08:19:52 GMT
x-amz-cf-pop: FRA60-P1
x-amz-server-side-encryption: AES256
x-amz-meta-content-type: application/json
content-length: 438
pragma: no-cache
last-modified: Fri, 18 Aug 2023 17:22:32 GMT
server: AmazonS3
etag: "29df5bb770be8e518fe2206581f712a6"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
x-amz-cf-id: DdZxHz3m2cHhaJOT0Gbm333Pv-rAa-591ojqHyeBQBEqCP2hmzzO7g==
expires: Thu, 06 Jun 2024 08:19:52 GMT

GET
H2 200 events.js Show response
tags.srv.stackadapt.com/ 18 KB
7 KB 337ms
158ms Script
text/javascript 54.93.141.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/events.js
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.93.141.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-141-152.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 5ca6a3f3a3aebb8cc04b7028d0338d3aa11a64ed3857001d84601e34f319b184

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: *
date: Thu, 06 Jun 2024 08:19:52 GMT
cache-control: max-age=5
content-encoding: gzip
content-type: text/javascript

GET
H2 200 hotjar-2159185.js Show response
static.hotjar.com/c/ 10 KB
4 KB 318ms
107ms Script
application/javascript 18.66.102.51
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-2159185.js?sv=6

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.102.51 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-102-51.fra56.r.cloudfront.net

Software

Resource Hash

93c12a5272f0be2f59a81896ae5d6888c09a6faff8212805bfe93ca9eaf9e7e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
date: Thu, 06 Jun 2024 08:19:52 GMT
via: 1.1 44b457512f742b4e48fc7f0c87d8ed92.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
etag: W/e99105d90b3b0e273fe08177c7563691
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
cache-control: max-age=60
cross-origin-resource-policy: cross-origin
x-amz-cf-id: tBdTaqCvRVIzPZ6PdJ0ZMTUWH3ZLEDTgd32K0r_F5Vw7qCxYQFbwsg==

GET
H2 200 NeverBounce.js Show response
cdn.neverbounce.com/widget/dist/ 96 KB
29 KB 348ms
63ms Script
application/javascript 18.245.46.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.245.46.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-245-46-63.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c99d11cb4960d6e1918ed55d5bcbb316d38b51098e2efc1201904d7274d3273e

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 05 Jun 2024 22:43:11 GMT
content-encoding: gzip
via: 1.1 ad3a844607df41a7152eab5ebe6e4056.cloudfront.net (CloudFront)
last-modified: Mon, 02 Mar 2020 18:37:33 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P9
age: 34602
etag: W/"c1e06621030dfcba15b88abbcaa546eb"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: RCZKa3RGVd575EeAJk9OscmKixy4wexnudhhQ9zSFimz0RroUIhtbw==

GET
H2 200 tracking.js Show response
trk.techtarget.com/ 3 KB
2 KB 329ms
76ms Script
text/javascript 2606:4700:4400::6812:24c4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.techtarget.com/tracking.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:24c4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:53 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Tue, 13 Dec 2022 15:01:39 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
age: 59392
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1200
cf-ray: 88f6fae098b9911f-FRA
expires: Thu, 06 Jun 2024 08:39:53 GMT

GET
H/1.1 200
OK pixel
q.quora.com/_/ad/83f2d51fb0164c438fbdaa8c29ed2e5e/ 43 B
422 B 574ms
153ms Image
image/gif 52.4.177.222
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.quora.com/_/ad/83f2d51fb0164c438fbdaa8c29ed2e5e/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.4.177.222 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-177-222.compute-1.amazonaws.com

Software

nginx /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 06 Jun 2024 08:19:53 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Server: nginx
Connection: keep-alive
Content-Length: 43
X-Q-Stat: ,0c0e132529c11f9e1dd5aed50a2f251d,10.0.0.178,12940,95.211.199.152,,248685150118,1,1717661993.303,0.002,,.,0,0,0.000,0.000,-,0,0,203,94,47,10,34729,,,,,,-,
Content-Type: image/gif

GET
H3 200 anchor
www.google.com/recaptcha/api2/ Frame 3791 0
0 220ms
100ms Document
text/html 142.250.185.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LchEywUAAAAAAdAXlscEm7Kcb3DJ38pngRCQJsC&co=aHR0cHM6Ly93d3cuaHVudHJlc3MuY29tOjQ0Mw..&hl=nl&v=DH3nyJMamEclyfe-nztbfV8S&size=normal&cb=yb0nmse5bonp

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/DH3nyJMamEclyfe-nztbfV8S/recaptcha__nl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f4.1e100.net

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-U0gO_EjObiWZg9RBfEHfCg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: nl-NL,nl;q=0.9;q=0.9
Referer: https://www.huntress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-U0gO_EjObiWZg9RBfEHfCg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 06 Jun 2024 08:19:52 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 combinedConfigs Show response
cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/ 61 B
1 KB 194ms
191ms Fetch
application/json 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=3911692&currentUrl=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Requested by

Host: js.hubspot.com
URL: https://js.hubspot.com/web-interactives-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

027f9fef93a2d620715de7311a5bf674cb3df18a352d2a0a7266c147c157333f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 6a08de25-d5fc-4855-b1f0-7e59a8a6ac71
content-encoding: br
x-envoy-upstream-service-time: 9
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 6a08de25-d5fc-4855-b1f0-7e59a8a6ac71
server: cloudflare
vary: origin
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.huntress.com
x-evy-trace-virtual-host: all
access-control-max-age: 180
access-control-allow-credentials: true
cache-control: max-age=0, no-cache, no-store
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a6k68%2BQZSTjBYVSnxhtw6cu69BGCktv%2BbpB3ZbLeEPf2FWIa1JXCyX8gTxMpaf8Vl272BKihTVsnMeBpr8I6KMi8cbhMYavgFWEIYgmtWzYorV91qRQD2n1zykSr2kiPucK23zmOpfTm5vQ5hGcNnBCMXMlLrksYbhk%3D"}],"group":"cf-nel","max_age":604800}
x-robots-tag: noindex, follow
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 88f6fade4c9c9f54-FRA
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-9fd6b4b-fnshr

GET
H2 200 json Show response
forms.hscollectedforms.net/collected-forms/v1/config/ 133 B
432 B 222ms
188ms XHR
application/json 2606:4700::6810:6dfe
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=3911692&utk=

Requested by

Host: js.hscollectedforms.net
URL: https://js.hscollectedforms.net/collectedforms.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:6dfe , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

543351d4360e32621e4bb7588aa7b81d1fbc027c580a6246938e3fc8a2dfedcc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Accept: application/json, text/plain, */*
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 6e867595-5fe8-46d9-8f7a-47c14f7395e1
x-envoy-upstream-service-time: 8
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 6e867595-5fe8-46d9-8f7a-47c14f7395e1
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.huntress.com
x-evy-trace-virtual-host: all
cache-control: max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-w988t
access-control-max-age: 180
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 88f6fadecd822bf8-FRA

POST
H2 200 429191348
google.com/pagead/form-data/ 0
0 487ms
50ms Ping
text/html 2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://google.com/pagead/form-data/429191348?gtm=45be4630v9136018371z89171248136za201zb9171248136&gcd=13l3lPl2l1&dma_cps=sypham&dma=1&tag_exp=0&npa=1&frm=0&pscdl=noapi&auid=851299993.1717661992&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B125.0.6422.141%7CChromium%3B125.0.6422.141%7CNot.A%252FBrand%3B24.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&ec_mode=a&em=tv.1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-429191348&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

POST
H2 204 429191348
google.com/ccm/form-data/ 0
177 B 67ms
65ms Ping
text/plain 2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://google.com/ccm/form-data/429191348?gtm=45be4630v9136018371z89171248136za201zb9171248136&gcd=13l3lPl2l1&dma_cps=sypham&dma=1&tag_exp=0&npa=1&frm=0&pscdl=noapi&auid=851299993.1717661992&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B125.0.6422.141%7CChromium%3B125.0.6422.141%7CNot.A%252FBrand%3B24.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&ec_mode=a&em=tv.1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-429191348&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 06 Jun 2024 08:19:53 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.huntress.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
247 B 204ms
59ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-GCTMBVFESS&gtm=45je4630v9122196611z89171248136za200zb9171248136&_p=1717661991697&_gaz=1&gcd=13l3lPl2l1&npa=1&dma_cps=sypham&dma=1&tag_exp=0&cid=697386767.1717661993&ul=nl-nl&sr=1600x1200&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B125.0.6422.141%7CChromium%3B125.0.6422.141%7CNot.A%252FBrand%3B24.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1717661992&sct=1&seg=0&dl=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&dt=Netscaler%20Exploitation%20to%20Social%20Engineering%3A%20Mapping%20Convergence%20of%20Adversary%20Tradecraft%20Across%20Victims&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1814
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-GCTMBVFESS&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 06 Jun 2024 08:19:53 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.huntress.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
256 B 210ms
65ms Ping
text/plain 2a00:1450:400c:c04::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-GCTMBVFESS&cid=697386767.1717661993&gtm=45je4630v9122196611z89171248136za200zb9171248136&aip=1&dma=1&dma_cps=sypham&gcd=13l3lPl2l1&npa=1&frm=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-GCTMBVFESS&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c04::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 06 Jun 2024 08:19:53 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.huntress.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.nl/ads/ 42 B
409 B 262ms
57ms Image
image/gif 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.nl/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-GCTMBVFESS&cid=697386767.1717661993&gtm=45je4630v9122196611z89171248136za200zb9171248136&aip=1&dma=1&dma_cps=sypham&gcd=13l3lPl2l1&npa=1&frm=0&z=1936002285

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 06 Jun 2024 08:19:53 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
838 B 460ms
281ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=3281745&time=1717661992858&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Accept: *
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
content-encoding: gzip
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 90189AAD790740FD9938B161935E3139 Ref B: AMS04EDGE1508 Ref C: 2024-06-06T08:19:53Z
access-control-allow-methods: GET, OPTIONS
x-li-fabric: prod-lor1
access-control-allow-origin: *
x-li-source-fabric: prod-ltx1
content-type: application/json
x-li-proto: http/2
x-restli-protocol-version: 1.0.0
x-cache: CONFIG_NOCACHE
access-control-allow-headers: *
x-li-uuid: AAYaNFjxq5rNzkVk8K4r4w==
x-fs-uuid: 00061a3458f1ab9acdce4564f0ae2be3

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1717661992858&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversa...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1717661992858&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversa...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1717661992858&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-advers...

0
268 B

348ms
233ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1717661992858&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&cookiesTest=true&e_ipv6=AQIDdzChcCF6uAAAAY_sogmmsjs8HpCgwILSHqPpPHEUEQs8TWdWqv1udpztF91Zm6klAYAB57Sn1GItvg
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: nl-NL,nl;q=0.9;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

date: Thu, 06 Jun 2024 08:19:53 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: AD2733E46E9C471D907DAFA66DD8367E Ref B: DUS30EDGE0818 Ref C: 2024-06-06T08:19:53Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYaNFj7HmM4zUifkFZMyw==

Redirect headers

date: Thu, 06 Jun 2024 08:19:53 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: D890C2DE126A403D8673C4E06081843C Ref B: DUS30EDGE0421 Ref C: 2024-06-06T08:19:53Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1717661992858&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&cookiesTest=true&e_ipv6=AQIDdzChcCF6uAAAAY_sogmmsjs8HpCgwILSHqPpPHEUEQs8TWdWqv1udpztF91Zm6klAYAB57Sn1GItvg
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYaNFj1i2/KlqccNQYmAw==

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
703 B 321ms
148ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: *
Referer: https://www.huntress.com/
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:52 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 621BF22D2B4F4D1891CC3DFBC4CA7845 Ref B: DUS30EDGE0421 Ref C: 2024-06-06T08:19:53Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
access-control-allow-origin: https://www.huntress.com
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYaNFjxWYPF1vQOMQVFIA==

GET
H2 200 config Show response
pixel-config.reddit.com/pixels/t2_12z44i/ 3 B
87 B 627ms
430ms XHR
application/json 151.101.65.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel-config.reddit.com/pixels/t2_12z44i/config
Requested by: Host: www.redditstatic.com
URL: https://www.redditstatic.com/ads/pixel.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.140 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:53 GMT
content-encoding: gzip
via: 1.1 varnish
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
content-length: 27

GET
H2 200 t2_12z44i_telemetry Show response
www.redditstatic.com/ads/conversions-config/v1/pixel/config/ 86 B
701 B 254ms
59ms XHR
application/json 2a04:4e42::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/conversions-config/v1/pixel/config/t2_12z44i_telemetry
Requested by: Host: www.redditstatic.com
URL: https://www.redditstatic.com/ads/pixel.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 740bb313221bda5543b6fbe0bce3dd276cc70c4fd9aa0bae9d46b149406becf5

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:53 GMT
content-encoding: gzip
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
server: snooserv
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=300
accept-ranges: bytes
content-length: 98

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
75 B 258ms
110ms Image
image/gif 151.101.129.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1717661992896&id=t2_12z44i&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=74ea63c7-dcdc-4106-807b-8170558c943f&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_8d515a58&dpm=&dpcc=&dprc=
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.140 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:53 GMT
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server: Varnish
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
638 B 226ms
109ms Image
image/gif 151.101.129.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1717661992898&id=t2_12z44i&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=74ea63c7-dcdc-4106-807b-8170558c943f&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_8d515a58&dpm=&dpcc=&dprc=
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.140 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:53 GMT
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server: Varnish
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

GET
H2 200 adsct
t.co/1/i/ 43 B
376 B 360ms
244ms Image
image/gif 93.184.221.165
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=acaeb6ef-3b00-4218-8fef-eb356069f6ee&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=ad86d282-d058-4683-92e0-6dc2b96d4957&tw_document_href=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&tw_iframe_status=0&txn_id=odo68&type=javascript&version=2.3.30

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.221.165 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-response-time: 185
date: Thu, 06 Jun 2024 08:19:52 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: dadd115d8eca9cb1
cache-control: no-cache, no-store, max-age=0
perf: 7402827104
x-connection-hash: 92235d89330dcbb9cac259cc5ab0c8dce3186793372ec401efe773b616bd1a20
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/1/i/ 43 B
726 B 341ms
229ms Image
image/gif 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=acaeb6ef-3b00-4218-8fef-eb356069f6ee&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=ad86d282-d058-4683-92e0-6dc2b96d4957&tw_document_href=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&tw_iframe_status=0&txn_id=odo68&type=javascript&version=2.3.30

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-response-time: 157
date: Thu, 06 Jun 2024 08:19:53 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 3456f327d2128bf7
cache-control: no-cache, no-store, max-age=0
perf: 7402827104
x-connection-hash: e3170d0c3986cc1963aa2c8ea55aa1c0f9cb01f151e9d4e50321c7281158739b
content-length: 43

GET
H3 200 counters.gif
perf-na1.hsforms.com/embed/v3/ 35 B
927 B 206ms
165ms Image
image/gif 104.19.175.188
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.175.188 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 7b3b0a9e-3ab0-42be-a1df-f6c5861854da
x-envoy-upstream-service-time: 2
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 7b3b0a9e-3ab0-42be-a1df-f6c5861854da
last-modified: Thu, 06 Jun 2024 08:19:53 GMT
server: cloudflare
vary: origin, Accept-Encoding
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-9fd6b4b-4lbrq
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
accept-ranges: bytes
x-robots-tag: none
cf-ray: 88f6fae158b0199b-FRA

POST
H2 204 view Show response
js.hs-banner.com/cookie-banner-public/v1/activity/ 0
175 B 168ms
155ms XHR
text/plain 2606:4700:4400::ac40:991b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-banner.com/cookie-banner-public/v1/activity/view

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1717662000000/5d3cypit2iz8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:991b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-platform: "Win32"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 06 Jun 2024 08:19:53 GMT
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 4c167bd7-5c2a-4b93-8531-ddf96b238a2c
x-envoy-upstream-service-time: 15
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 4c167bd7-5c2a-4b93-8531-ddf96b238a2c
server: cloudflare
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
access-control-allow-origin: https://www.huntress.com
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
vary: origin
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-78cb6f459b-qr8zh
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 88f6fae33f0a9043-FRA

OPTIONS
H2 200 view
js.hs-banner.com/cookie-banner-public/v1/activity/ Frame 0
0 523ms
363ms Preflight
application/octet-stream 2606:4700:4400::ac40:991b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/cookie-banner-public/v1/activity/view
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:991b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.huntress.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
access-control-allow-origin: https://www.huntress.com
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
access-control-max-age: 604800
cf-cache-status: DYNAMIC
cf-ray: 88f6fae0dc399043-FRA
content-length: 0
content-type: application/octet-stream
date: Thu, 06 Jun 2024 08:19:53 GMT
server: cloudflare
timing-allow-origin: *
vary: origin
x-envoy-upstream-service-time: 0
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-78cb6f459b-q4rbs
x-evy-trace-virtual-host: all
x-hubspot-correlation-id: 56d2c2c3-e548-4ebe-8fb2-d9b1746707c3
x-request-id: 56d2c2c3-e548-4ebe-8fb2-d9b1746707c3

GET
H2 200 6si.min.js Show response
j.6sc.co/ 66 KB
153 B 83ms
82ms Script
application/javascript 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/j/e666a54d-ff29-48f9-9baa-2be6ac05412e.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dc93c5b3243e66c7b2e27c51b76fa6a11bd7a6d7546c5fa26bbffa001f885305

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 06 Jun 2024 08:19:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 09 May 2024 06:01:25 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "663c66b5-106b3"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 18038
expires: Thu, 06 Jun 2024 08:19:52 GMT

GET
H2 200 187059084.js Show response
bat.bing.com/p/action/ 4 KB
2 KB 135ms
134ms Script
application/javascript 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/187059084.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

cf8edbedfd479fe7cc642e3a1db515dd1103f2d7864f0db5cae6144fbde44ea4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
date: Thu, 06 Jun 2024 08:19:52 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: FF2F366662BB46D8B088F21E37DE0CFB Ref B: DUS30EDGE0315 Ref C: 2024-06-06T08:19:53Z
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
cache-control: private,max-age=60

GET
H2 204 0
bat.bing.com/action/ 0
287 B 115ms
114ms Image
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=187059084&tm=gtm002&Ver=2&mid=f1b890fa-1a72-4c50-802a-b86b6a1dc2fc&sid=8cd85b9023dd11ef925abf2de2bf3593&vid=8cd9385023dd11ef979bff168d551e8b&vids=1&msclkid=N&pi=918639831&lg=nl-NL&sw=1600&sh=1200&sc=24&tl=Netscaler%20Exploitation%20to%20Social%20Engineering%3A%20Mapping%20Convergence%20of%20Adversary%20Tradecraft%20Across%20Victims&p=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&r=&lt=1237&pt=1717661991030,,,,,1,38,38,38,213,93,213,307,319,311,1233,1236,1237,,,&pn=0,0&evt=pageLoad&sv=1&rn=578593

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 06 Jun 2024 08:19:52 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CDD70D3C035949D693C7E875D752DF0E Ref B: DUS30EDGE0315 Ref C: 2024-06-06T08:19:53Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 counters.gif
forms.hsforms.com/embed/v3/ 35 B
850 B 248ms
176ms Image
image/gif 104.19.175.188
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=2

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.175.188 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 159ad87a-b046-4eb7-a106-abe5cc9a8e96
x-envoy-upstream-service-time: 3
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 159ad87a-b046-4eb7-a106-abe5cc9a8e96
server: cloudflare
vary: origin
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-9fd6b4b-nr4kt
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 88f6fae188eb199b-FRA

POST
H2 200 assign
tracking.g2crowd.com/attribution_tracking/conversions/ 0
0 138ms
137ms Ping
text/html 2606:4700:4400::6812:2b1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.g2crowd.com/attribution_tracking/conversions/assign
Requested by: Host: tracking.g2crowd.com
URL: https://tracking.g2crowd.com/attribution_tracking/conversions/1006267.js?p=https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&e=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2b1f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-platform: "Win32"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykl9ziKuW7w75RiMk

Response headers

GET
H2 200 sa.css
tags.srv.stackadapt.com/ 65 B
204 B 164ms
147ms Stylesheet
text/css 54.93.141.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.93.141.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-141-152.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 4f7ec8541306bd83dc40595958c224a79bc306df70f49d10232ea381118ac35d

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: *
date: Thu, 06 Jun 2024 08:19:53 GMT
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 65
content-type: text/css

GET
H2 200 sa.jpeg Show response
tags.srv.stackadapt.com/ 0
2 KB 248ms
148ms Fetch
image/jpeg 54.93.141.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: js.driftt.com
URL: https://js.driftt.com/include/1717662000000/5d3cypit2iz8.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.93.141.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-141-152.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: *
date: Thu, 06 Jun 2024 08:19:53 GMT
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 651
content-type: image/jpeg

GET
H2 200 sa.jpeg Show response
tags.srv.stackadapt.com/ 0
0 250ms
250ms Fetch
image/jpeg 54.93.141.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: js.driftt.com
URL: https://js.driftt.com/include/1717662000000/5d3cypit2iz8.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.93.141.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-141-152.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: *
date: Thu, 06 Jun 2024 08:19:53 GMT
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 651
content-type: image/jpeg

GET
H2 200 rt
tags.srv.stackadapt.com/ 43 B
109 B 160ms
149ms Image
image/gif 54.93.141.152
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.srv.stackadapt.com/rt?sid=7wccJHzJq6FDXhrQQ8GOIs&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&t=Netscaler%20Exploitation%20to%20Social%20Engineering%3A%20Mapping%20Convergence%20of%20Adversary%20Tradecraft%20Across%20Victims&tip=r7uFXgdjtYayyZcAyGJwxgrDgHylYHAJGwOcF1J3ojs
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.93.141.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-141-152.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:53 GMT
content-length: 43
content-type: image/gif

GET
H2 200 / Show response
c.6sc.co/ 7 B
195 B 57ms
48ms XHR
text/html 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: js.driftt.com
URL: https://js.driftt.com/include/1717662000000/5d3cypit2iz8.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-184.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:53 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.huntress.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 27 B
325 B 207ms
58ms XHR
text/html 2a02:26f0:7100::210:172
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: js.driftt.com
URL: https://js.driftt.com/include/1717662000000/5d3cypit2iz8.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:7100::210:172 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: e83014fcae080031cb2f582a2a5ac260211398059d358e1dd4dc6cc09327b00e

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 06 Jun 2024 08:19:53 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.huntress.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2001:1af8:4020:a034:9876::3
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1717661993126_34603374_392862766_20_797_35_77_219";dur=1
content-length: 27
expires: Thu, 06 Jun 2024 08:19:53 GMT

GET
H2 200 modules.349061f2d87d84c4c336.js Show response
script.hotjar.com/ 222 KB
55 KB 138ms
27ms Script
application/javascript 13.32.27.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.349061f2d87d84c4c336.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2159185.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.27.54 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-27-54.fra56.r.cloudfront.net

Software

Resource Hash

5ade1526f1674ac49650f04fa328b8aec7266c24c9a045f5efbb96b6984422c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 05 Jun 2024 11:43:07 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 95adda0bdbd310a1a9e4f54f540543e2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 74206
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 56093
last-modified: Wed, 05 Jun 2024 11:42:10 GMT
etag: "4aa8ac29ac41e30cfd27b0bfd1a19aca"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: 3ptCOnbSHfz6tdL_14tgQhh9ouEqGmFxD6B8OddlA7SufkhWPz8VQA==

GET
H2 200 187059084 Show response
www.clarity.ms/tag/uet/ 816 B
1 KB 416ms
195ms Script
application/x-javascript 2620:1ec:29:1::43
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/uet/187059084
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/p/action/187059084.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:29:1::43 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 33deeceba8a4f12c81e118177e3a68348bd605574c74f2606bd135d00e9b42f3

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: -1
date: Thu, 06 Jun 2024 08:19:53 GMT
x-azure-ref: 20240606T081953Z-r178776d6f85bc72eemvmfsbes000000051g000000009f14
x-cache: CONFIG_NOCACHE
content-type: application/x-javascript
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 816
request-context: appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111

GET
H2 200 403957864408442 Show response
connect.facebook.net/signals/config/ 66 KB
14 KB 273ms
269ms Script
application/x-javascript 2a03:2880:f084:105:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/403957864408442?v=2.9.157&r=stable&domain=www.huntress.com&hme=446fb981c8c3baeb03730fe3cbd404f7f15f64c693f24c7fe75da498bc2c95d8&ex_m=67%2C113%2C100%2C104%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C160%2C163%2C174%2C170%2C171%2C173%2C28%2C94%2C50%2C73%2C172%2C155%2C158%2C167%2C168%2C175%2C122%2C14%2C48%2C180%2C179%2C124%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C101%2C103%2C37%2C102%2C29%2C25%2C156%2C159%2C131%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C98%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C99%2C43%2C75%2C65%2C105%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C106

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

4e619c053717a2281cf687c48ec0dcf804b3da9739a678bae78c08d594ddbafb

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 06 Jun 2024 08:19:53 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: GOOD; q=0.7, rtt=61, rtx=0, c=58, mss=1297, tbw=63535, tp=-1, tpl=-1, uplat=159, ullat=0
pragma: public
x-fb-debug: 2qvFcdlAoRaEJ6+K6cBCdinQ1ImjzYWSFdP7Kf4gUfAczjjchns58+ZnbGZLrLxix3svU8FnDjM8iQURnwMlZg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 gif.gif Show response
ibc-flow.techtarget.com/a/ 43 B
444 B 173ms
171ms XHR
image/gif 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=17715818&r=1717661993147&ref=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&version=2.4
Requested by: Host: js.driftt.com
URL: https://js.driftt.com/include/1717662000000/5d3cypit2iz8.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

ibc_rate_tier: 17715818
sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:53 GMT
via: 1.1 google
x-guploader-uploadid: ABPtcPrnbh8y0sUuZGSbOXuViAI80E98ZtVkFjwprHDbNSYSUWXJZyBGA9tiRBd7ngglyZ57nnI
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
last-modified: Thu, 08 Dec 2022 21:19:29 GMT
server: nginx/1.20.2
etag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
vary: Origin
x-goog-generation: 1670534369365034
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
cache-control: public, max-age=3600
access-control-allow-methods: GET, POST, OPTIONS
x-goog-stored-content-length: 43
accept-ranges: bytes
access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
expires: Thu, 06 Jun 2024 09:19:53 GMT

OPTIONS
H2 200 gif.gif
ibc-flow.techtarget.com/a/ Frame 0
0 220ms
155ms Preflight
text/html 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=17715818&r=1717661993147&ref=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&version=2.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: ibc_rate_tier
Access-Control-Request-Method: GET
Origin: https://www.huntress.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 06 Jun 2024 08:19:53 GMT
expires: Thu, 06 Jun 2024 08:19:53 GMT
server: nginx/1.20.2
vary: Origin
via: 1.1 google
x-guploader-uploadid: ABPtcPqPPuKJv6duGSLPlNJYpcHE18dHQk7iiod3hJ8kncUolTJ8HBXPbR_TOfauYf28IuYH1YU

GET
H2 200 notify Show response
api.neverbounce.com/v4/poe/ 62 B
283 B 445ms
114ms Script
application/javascript 3.223.190.23
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.neverbounce.com/v4/poe/notify?key=public_0e95e4405380cdd75d8aa57fca3692dc&event=form.load&callback=__neverbounce_26649

Requested by

Host: cdn.neverbounce.com
URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.223.190.23 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-223-190-23.compute-1.amazonaws.com

Software

nginx /

Resource Hash

8ed080802dcf762d1e32fabdacb64db4474cb6a1661c97242726d5f334c70de3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:53 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, private
x-ua-compatible: IE=Edge

GET
H2 200 saq_pxl Show response
tags.srv.stackadapt.com/ 138 B
334 B 150ms
149ms XHR
text/plain 54.93.141.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=yZKscIIzalsoNin7qAYxQw&is_js=true&landing_url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&t=Netscaler%20Exploitation%20to%20Social%20Engineering%3A%20Mapping%20Convergence%20of%20Adversary%20Tradecraft%20Across%20Victims&tip=r7uFXgdjtYayyZcAyGJwxgrDgHylYHAJGwOcF1J3ojs&host=https%3A%2F%2Fwww.huntress.com&sa_conv_data_css_value=%270-be10726d-0279-5ad8-787b-b54f97dd8c5b%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd9be10726d02795ad8787bb54f97dd8c5b5fd3c798&sa-user-id-v3=s%253AAQAKICGrL0ju1hwgpHNgU0UU11UO0bPD8hSN_I4svZ4cuX2iEHwYBCCo4oWzBjABOgSTRxQUQgR1kwAU.dYJ95gDzXWuXQgYjOhDJDwWaMimMVNpSURBwPN2JzSc&sa-user-id-v2=s%253AvhBybQJ5Wth4e7VPl92MW1_Tx5g.AUMLrxCPSmqNHKnkLlHmuZ%252B5YYtiZ0PMyOHU6G5C4qM&sa-user-id=s%253A0-be10726d-0279-5ad8-787b-b54f97dd8c5b.FdyWX0hIv5%252FvUGN%252BkrrcV7TGf4v440gDsBCKrgeDKyY
Requested by: Host: js.driftt.com
URL: https://js.driftt.com/include/1717662000000/5d3cypit2iz8.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.93.141.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-141-152.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: fc573eaf0e39d6b2429951f78b744dde5acb4cbee85a9b903aea0210072d9b48

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: https://www.huntress.com
date: Thu, 06 Jun 2024 08:19:53 GMT
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 138
access-control-allow-methods: GET
content-type: text/plain; charset=utf-8

GET
H2 200 saq_pxl Show response
tags.srv.stackadapt.com/ 138 B
334 B 149ms
148ms XHR
text/plain 54.93.141.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=yZKscIIzalsoNin7qAYxQw&is_js=true&landing_url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&t=Netscaler%20Exploitation%20to%20Social%20Engineering%3A%20Mapping%20Convergence%20of%20Adversary%20Tradecraft%20Across%20Victims&tip=r7uFXgdjtYayyZcAyGJwxgrDgHylYHAJGwOcF1J3ojs&host=https%3A%2F%2Fwww.huntress.com&sa_conv_data_css_value=&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd9be10726d02795ad8787bb54f97dd8c5b5fd3c798&sa-user-id-v3=s%253AAQAKICGrL0ju1hwgpHNgU0UU11UO0bPD8hSN_I4svZ4cuX2iEHwYBCCo4oWzBjABOgSTRxQUQgR1kwAU.dYJ95gDzXWuXQgYjOhDJDwWaMimMVNpSURBwPN2JzSc&sa-user-id-v2=s%253AvhBybQJ5Wth4e7VPl92MW1_Tx5g.AUMLrxCPSmqNHKnkLlHmuZ%252B5YYtiZ0PMyOHU6G5C4qM&sa-user-id=s%253A0-be10726d-0279-5ad8-787b-b54f97dd8c5b.FdyWX0hIv5%252FvUGN%252BkrrcV7TGf4v440gDsBCKrgeDKyY
Requested by: Host: js.driftt.com
URL: https://js.driftt.com/include/1717662000000/5d3cypit2iz8.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.93.141.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-141-152.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: fc573eaf0e39d6b2429951f78b744dde5acb4cbee85a9b903aea0210072d9b48

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: https://www.huntress.com
date: Thu, 06 Jun 2024 08:19:53 GMT
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 138
access-control-allow-methods: GET
content-type: text/plain; charset=utf-8

GET
H2 204 2159185 Show response
vc.hotjar.io/sessions/ 0
233 B 214ms
70ms XHR
text/plain 18.66.112.110
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vc.hotjar.io/sessions/2159185?s=0.25&r=0.16138353553484897
Requested by: Host: js.driftt.com
URL: https://js.driftt.com/include/1717662000000/5d3cypit2iz8.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.112.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-112-110.fra56.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: *
date: Thu, 06 Jun 2024 08:19:53 GMT
cache-control: no-store
via: 1.1 7be6cb2d0156b563b6b1c8f2595ddd52.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
x-amz-cf-id: ripN6LEgAH3QraObu9K1yc3bDkdPhBk6AhR8GHGMMYBHpKBujmdjsw==
x-cache: Miss from cloudfront

GET
H2 200 /
www.facebook.com/tr/ 0
270 B 179ms
43ms Image
text/plain 2a03:2880:f177:185:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=403957864408442&ev=PageView&dl=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&rl=&if=false&ts=1717661993445&sw=1600&sh=1200&v=2.9.157&r=stable&ec=0&o=4126&fbp=fb.1.1717661993441.713793260782025377&cs_est=true&ler=empty&cdl=API_unavailable&it=1717661993131&coo=false&rqm=GET

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-fb-connection-quality: GOOD; q=0.7, rtt=56, rtx=0, c=10, mss=1297, tbw=2791, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Thu, 06 Jun 2024 08:19:53 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
4 KB 345ms
210ms Image
image/png 2a03:2880:f177:185:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=403957864408442&ev=PageView&dl=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&rl=&if=false&ts=1717661993445&sw=1600&sh=1200&v=2.9.157&r=stable&ec=0&o=4126&fbp=fb.1.1717661993441.713793260782025377&cs_est=true&ler=empty&cdl=API_unavailable&it=1717661993131&coo=false&rqm=FGET

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

attribution-reporting-register-trigger: {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0x24fb55e3bc01efdc","source_keys":["1","2"]},{"key_piece":"0xf7b735ebe5910a04","source_keys":["1","2"]}],"aggregatable_values":{"1":1}}
content-encoding: zstd
x-content-type-options: nosniff
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
strict-transport-security: max-age=15552000; preload
document-policy: force-load-at-top
date: Thu, 06 Jun 2024 08:19:53 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=49, rtx=0, c=10, mss=1297, tbw=3105, tp=-1, tpl=-1, uplat=173, ullat=0
pragma: no-cache
x-fb-debug: CGE5zJebce2sA5+mQJp3eyy1QBYsmFEHmZMDlh6SBCWRnEUk6WTGEJOiVfUB3RgtpiMztJUWildcMyWnOnZnag==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: image/png
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: private, no-store, no-cache, must-revalidate
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), battery=(self), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
BLOB 200
OK b4e951fb-8f1d-4d1e-ac50-934712d79901
https://www.huntress.com/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://www.huntress.com/b4e951fb-8f1d-4d1e-ac50-934712d79901
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Accept-Language: nl-NL,nl;q=0.9;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

Content-Length: 43
Content-Type: image/gif

GET
H3 200 bframe
www.google.com/recaptcha/api2/ Frame 9846 0
0 56ms
54ms Document
text/html 142.250.185.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=nl&v=DH3nyJMamEclyfe-nztbfV8S&k=6LchEywUAAAAAAdAXlscEm7Kcb3DJ38pngRCQJsC

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/DH3nyJMamEclyfe-nztbfV8S/recaptcha__nl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f4.1e100.net

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ThIsrPiSj9Ven7dXai_-jA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: nl-NL,nl;q=0.9;q=0.9
Referer: https://www.huntress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-ThIsrPiSj9Ven7dXai_-jA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 06 Jun 2024 08:19:53 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 clarity.js Show response
www.clarity.ms/s/0.7.34/ 61 KB
26 KB 77ms
65ms Script
application/javascript 2620:1ec:29:1::43
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/s/0.7.34/clarity.js
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/uet/187059084
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:29:1::43 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: fffc6ed23cfeabaaace717503bfabd907816869c8c5ff38a2127b8284e8c5988

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:53 GMT
content-encoding: br
last-modified: Thu, 23 May 2024 23:20:12 GMT
etag: W/"0x8DC7B7EE5574D78"
vary: Accept-Encoding
x-azure-ref: 20240606T081953Z-r178776d6f85bc72eemvmfsbes000000051g000000009f1c
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
x-ms-request-id: 1acb36b3-701e-0001-33c0-b57107000000
cache-control: public, max-age=86400
x-cache: TCP_HIT
x-ms-version: 2018-03-28
x-fd-int-roxy-purgeid: 51562430

POST
H/1.1 204
No Content collect Show response
u.clarity.ms/ 0
296 B 579ms
351ms XHR
text/plain 4.227.249.197
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://u.clarity.ms/collect
Requested by: Host: js.driftt.com
URL: https://js.driftt.com/include/1717662000000/5d3cypit2iz8.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 4.227.249.197 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Accept: application/x-clarity-gzip
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Access-Control-Allow-Origin: https://www.huntress.com
Date: Thu, 06 Jun 2024 08:19:54 GMT
Access-Control-Allow-Credentials: true
Server: nginx/1.18.0 (Ubuntu)
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:9c7c879b-c51a-427e-9701-218438da5f81

GET
H2 200 getuidj Show response
secure.adnxs.com/ 11 B
703 B 85ms
18ms XHR
application/json 185.89.210.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1717662000000/5d3cypit2iz8.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.244 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 06 Jun 2024 08:19:53 GMT
an-x-request-uuid: 57c8c9ae-6fe1-4961-adcb-b602678180fd
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.huntress.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 95.211.199.152; 95.211.199.152; 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 11
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
195 B 43ms
43ms XHR
text/html 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: js.driftt.com
URL: https://js.driftt.com/include/1717662000000/5d3cypit2iz8.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-184.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:53 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.huntress.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 27 B
326 B 51ms
50ms XHR
text/html 2a02:26f0:7100::210:172
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: js.driftt.com
URL: https://js.driftt.com/include/1717662000000/5d3cypit2iz8.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:7100::210:172 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: e83014fcae080031cb2f582a2a5ac260211398059d358e1dd4dc6cc09327b00e

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 06 Jun 2024 08:19:53 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.huntress.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2001:1af8:4020:a034:9876::3
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1717661993896_34603374_392863676_234_1016_44_0_219";dur=1
content-length: 27
expires: Thu, 06 Jun 2024 08:19:53 GMT

GET
H2 200 blockedDomains.json Show response
hubspotonwebflow.com/assets/js/ 98 KB
23 KB 54ms
54ms Fetch
application/json 76.76.21.164
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://hubspotonwebflow.com/assets/js/blockedDomains.json

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1717662000000/5d3cypit2iz8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.164 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

944352d0198c673b45a699471c970aef85458ea3c58a3ed825b0f0e4f33f999c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:53 GMT
content-encoding: br
strict-transport-security: max-age=63072000
server: Vercel
x-vercel-id: fra1::qpln4-1717661993891-e89b1822cfdf
age: 1683302
x-matched-path: /assets/js/blockedDomains.json
etag: W/"04708d47dd194d37b8231a65de7a66f1"
x-vercel-cache: HIT
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
content-disposition: inline; filename="blockedDomains.json"

GET
H2 200 blockList Show response
hubspotonwebflow.com/api/forms/ 47 B
320 B 175ms
172ms Fetch
application/json 76.76.21.164
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://hubspotonwebflow.com/api/forms/blockList?id=c32ae9e7-4a4b-4436-a6e4-0de41bd8df62

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1717662000000/5d3cypit2iz8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.164 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

b9b4f19dee3d4910ab6fb4ea6e8a3126cfd5386c0bec674b65461a5192dba995

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:53 GMT
content-encoding: br
strict-transport-security: max-age=63072000
server: Vercel
x-vercel-id: fra1::iad1::jqs8p-1717661993897-6a719d35fbca
age: 0
x-matched-path: /api/forms/blockList
x-vercel-cache: MISS
vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: *
x-vercel-execution-region: iad1
cache-control: public, max-age=0, must-revalidate
access-control-allow-headers: Content-Type, Authorization

GET
H3 200 zi-tag.js Show response
js.zi-scripts.com/ 9 KB
3 KB 109ms
53ms Script
application/javascript 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/zi-tag.js
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c3ea3a972768896d2a84d6eb36d3f5919478ad9c091477c22a5362eb6d53aee4

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:53 GMT
x-amz-version-id: 4TVPkf0eH3kVl0Vjj3KPZI_FUiecs6et
via: 1.1 5519a8cb450b567e8b7111ae986a9b4c.cloudfront.net (CloudFront)
cf-cache-status: DYNAMIC
content-encoding: gzip
x-amz-cf-pop: FRA56-P4
age: 18322
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 15 May 2024 06:37:27 GMT
server: cloudflare
etag: W/"5c7228fc2640a4dfce48217428980fe3"
vary: Accept-Encoding
content-type: application/javascript
cf-ray: 88f6fae62ff0199b-FRA
x-amz-cf-id: 6os9Dqhy3PzKUd92p5LzCfPR8u02fb61SXUuO_xe-4WI5g1bq2K3Jg==

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
1 KB 256ms
181ms Image
image/gif 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=nl-nl&bfp=2750542378&v=1.1&a=3911692&rcu=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&pu=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&t=Netscaler+Exploitation+to+Social+Engineering%3A+Mapping+Convergence+of+Adversary+Tradecraft+Across+Victims&cts=1717661993888&vi=afd5b7cb9cbdc1b0a9db10f16a8491ec&nc=true&ce=false&pt=1&cc=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 5ac8a6de-3a02-468d-8653-ade7d9115f0f
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 7
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 5ac8a6de-3a02-468d-8653-ade7d9115f0f
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FAyYWekJqFr9pSwmc%2BjJAiq5%2FaBvP3cvA7EAiIKdWTMcnoIlEneAkOO0E3oA8Bx1rTA0sCBwcTdflzEAbxKdxwh3Je1mrq3SZDIOXwXsmzj9iL16DTW4VMJYu6zICxyKOIaxBhLn7fs0sf%2FmGZ2u"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-76d96f8b5d-hch7x
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 88f6fae65c2218b7-FRA
x-robots-tag: none

GET
H2

200

c.gif
c.clarity.ms/
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=6110F06BCE824BD2926104F49CB1C23F&RedC=c.clarity.ms&MXFR=1EEB616FA2236A0B03BD75F9A6236449
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=6110F06BCE824BD2926104F49CB1C23F&MUID=381F7233DA70667A2D1566A5DBB067CB

42 B
442 B

39ms
39ms

Image
image/gif

68.219.88.97
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=6110F06BCE824BD2926104F49CB1C23F&MUID=381F7233DA70667A2D1566A5DBB067CB
Protocol: H2
Server: 68.219.88.97 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language: nl-NL,nl;q=0.9;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 06 Jun 2024 08:19:53 GMT
last-modified: Fri, 01 Mar 2024 22:54:48 GMT
server: Microsoft-IIS/10.0
etag: "3e26b762b6cda1:0"
x-powered-by: ASP.NET
content-type: image/gif
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-length: 42

Redirect headers

pragma: no-cache
date: Thu, 06 Jun 2024 08:19:53 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C6EF59170CD24A93A2548D579B76E480 Ref B: DUS30EDGE0315 Ref C: 2024-06-06T08:19:54Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=6110F06BCE824BD2926104F49CB1C23F&MUID=381F7233DA70667A2D1566A5DBB067CB
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

GET
H3 200 66030a0ceace49bce51c36de_favicon-32x32.png
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/ 1 KB
2 KB 44ms
42ms Other
image/png 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/66030a0ceace49bce51c36de_favicon-32x32.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c12f11d824a0e7cb513ff4574c1664ac5c3949efc35896edeb0612fe45f1c00b

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:53 GMT
x-amz-version-id: zgVWaHGriVUpkEY2ghAZ8_qygV1PEHYb
cf-cache-status: HIT
x-amz-request-id: 8E3NV4BECD7BWXED
age: 570299
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 1294
x-amz-id-2: /YipIOFvY4/jM7gNj41XdfmfPfY4g1xlpG0A+Z0a36RLgnxiMPhr6qia2PZTBzCopb0QHHdCjW4=
last-modified: Tue, 26 Mar 2024 17:46:53 GMT
server: cloudflare
etag: "966e794cd99e0b0b48cd4df13cdc04a5"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 88f6fae5ed473671-FRA
expires: Fri, 06 Jun 2025 08:19:53 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
260 B 149ms
137ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=a87a3edc53b5a86d1795d11887b5aa39&svisitor=null&visitor=835e2a1b-9b19-4af5-8409-92e54cfe243d&session=996826c5-e4f2-4663-882a-4698b4fb1dfb&event=ipv6&q=%7B%22address%22%3A%222001%3A1af8%3A4020%3Aa034%3A9876%3A%3A3%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20following%20is%20an%20analysis%20by%20the%20Huntress%20team%20of%20several%20recent%20intrusions%20connected%20to%20the%20Netscaler%20exploitation.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Netscaler%20Exploitation%20to%20Social%20Engineering%3A%20Mapping%20Convergence%20of%20Adversary%20Tradecraft%20Across%20Victims%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&pageViewId=adf3204e-5c30-4bbf-8799-189e5cc3fcbc&webTagId=e666a54d-ff29-48f9-9baa-2be6ac05412e&v=1.1.20

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 06 Jun 2024 08:19:54 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 06 Jun 2024 08:19:54 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
259 B 136ms
136ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=a87a3edc53b5a86d1795d11887b5aa39&svisitor=null&visitor=835e2a1b-9b19-4af5-8409-92e54cfe243d&session=996826c5-e4f2-4663-882a-4698b4fb1dfb&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2006%20Jun%202024%2008%3A19%3A52%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20following%20is%20an%20analysis%20by%20the%20Huntress%20team%20of%20several%20recent%20intrusions%20connected%20to%20the%20Netscaler%20exploitation.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Netscaler%20Exploitation%20to%20Social%20Engineering%3A%20Mapping%20Convergence%20of%20Adversary%20Tradecraft%20Across%20Victims%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&pageViewId=adf3204e-5c30-4bbf-8799-189e5cc3fcbc&an_uid=0&webTagId=e666a54d-ff29-48f9-9baa-2be6ac05412e&v=1.1.20

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 06 Jun 2024 08:19:54 GMT
x-content-type-options: nosniff
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 06 Jun 2024 08:19:54 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
259 B 137ms
137ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=a87a3edc53b5a86d1795d11887b5aa39&svisitor=null&visitor=835e2a1b-9b19-4af5-8409-92e54cfe243d&session=996826c5-e4f2-4663-882a-4698b4fb1dfb&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22a87a3edc53b5a86d1795d11887b5aa39%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2006%20Jun%202024%2008%3A19%3A52%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2006%20Jun%202024%2008%3A19%3A52%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22c081b6bcc07a45b013b81ff3441b82387640805c%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2006%20Jun%202024%2008%3A19%3A52%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2006%20Jun%202024%2008%3A19%3A52%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2006%20Jun%202024%2008%3A19%3A52%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2006%20Jun%202024%2008%3A19%3A52%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setWhiteListFields%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2006%20Jun%202024%2008%3A19%3A52%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2006%20Jun%202024%2008%3A19%3A52%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%228769192b-20ba-4df2-8d62-2740a805c3e8%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2006%20Jun%202024%2008%3A19%3A52%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2006%20Jun%202024%2008%3A19%3A52%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCompanyDetailsExpiration%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2006%20Jun%202024%2008%3A19%3A52%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableMapCookieCapture%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2006%20Jun%202024%2008%3A19%3A52%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2006%20Jun%202024%2008%3A19%3A52%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20following%20is%20an%20analysis%20by%20the%20Huntress%20team%20of%20several%20recent%20intrusions%20connected%20to%20the%20Netscaler%20exploitation.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Netscaler%20Exploitation%20to%20Social%20Engineering%3A%20Mapping%20Convergence%20of%20Adversary%20Tradecraft%20Across%20Victims%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&pageViewId=adf3204e-5c30-4bbf-8799-189e5cc3fcbc&an_uid=0&webTagId=e666a54d-ff29-48f9-9baa-2be6ac05412e&v=1.1.20

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 06 Jun 2024 08:19:54 GMT
x-content-type-options: nosniff
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 06 Jun 2024 08:19:54 GMT

GET
H3 200 getSubscriptions Show response
js.zi-scripts.com/unified/v1/master/ 150 B
520 B 490ms
489ms Fetch
application/json 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Requested by: Host: js.driftt.com
URL: https://js.driftt.com/include/1717662000000/5d3cypit2iz8.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 37c87a24c06d71561ed95e47c6e33adc720228b275fe69cc257bf7503f49daa0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-platform: "Win32"
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
Authorization: Bearer 5880e3e5891679926699
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://www.huntress.com/
visited_url: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims

Response headers

date: Thu, 06 Jun 2024 08:19:54 GMT
via: 1.1 a823be133adad65df6d3bf471a742792.cloudfront.net (CloudFront)
content-encoding: gzip
cf-cache-status: DYNAMIC
x-amz-cf-pop: FRA56-P4
x-powered-by: Express
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400
apigw-requestid: Y76etj6QPHcESNA=
server: cloudflare
etag: W/"96-0SFOBgBWcIHFtTuYYPHLwetp5o4"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cf-ray: 88f6fae81fccbb8f-FRA
x-amz-cf-id: gJ45g90g4zx2h3WljpjghMZ2D4iNo1jun6zZbFtrWbqQ3oqyoVHsqg==

OPTIONS
H3 204 getSubscriptions
js.zi-scripts.com/unified/v1/master/ Frame 0
0 254ms
213ms Preflight 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,visited_url
Access-Control-Request-Method: GET
Origin: https://www.huntress.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *
access-control-max-age: 0
alt-svc: h3=":443"; ma=86400
apigw-requestid: Y76eog8tPHcESJQ=
cf-cache-status: DYNAMIC
cf-ray: 88f6fae6cd24bb8f-FRA
date: Thu, 06 Jun 2024 08:19:54 GMT
server: cloudflare
vary: Access-Control-Request-Headers
via: 1.1 a823be133adad65df6d3bf471a742792.cloudfront.net (CloudFront)
x-amz-cf-id: iDQX3YnLRQ3dpWlsmAudAEE2XIYYj5bm-V3UNFVNng5of-laZMC53g==
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
x-powered-by: Express

GET
H3 200 / Show response
ws.zoominfo.com/pixel/62f67a71a4cf97008ef6d460/ 3 KB
2 KB 387ms
356ms Fetch
text/javascript 104.16.117.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/62f67a71a4cf97008ef6d460/?iszitag=true

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1717662000000/5d3cypit2iz8.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

78a521ef52cb89366ed937ea508c5afe769810343eb010c635e22f2348cb2692

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Content-Type: text/javascript
visited-url: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
Referer: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims
_vtok: OTUuMjExLjE5OS4xNTI=
_zitok: ec993a17d9621f0a6bf61717661994
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 08:19:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 google
server: cloudflare
x-powered-by: Express
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: https://www.huntress.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
alt-svc: h3=":443"; ma=86400
cf-ray: 88f6faed1b511b9f-FRA

OPTIONS
H3 200 /
ws.zoominfo.com/pixel/62f67a71a4cf97008ef6d460/ Frame 0
0 272ms
226ms Preflight
text/html 104.16.117.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/62f67a71a4cf97008ef6d460/?iszitag=true

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: _vtok,_zitok,content-type,visited-url
Access-Control-Request-Method: GET
Origin: https://www.huntress.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
access-control-allow-origin: https://www.huntress.com
allow: GET,HEAD
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 88f6faeb8c0e5d7b-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 06 Jun 2024 08:19:54 GMT
server: cloudflare
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

POST
H/1.1 204
No Content collect Show response
u.clarity.ms/ 0
296 B 109ms
108ms XHR
text/plain 4.227.249.197
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://u.clarity.ms/collect
Requested by: Host: js.driftt.com
URL: https://js.driftt.com/include/1717662000000/5d3cypit2iz8.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 4.227.249.197 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Accept: application/x-clarity-gzip
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Access-Control-Allow-Origin: https://www.huntress.com
Date: Thu, 06 Jun 2024 08:19:54 GMT
Access-Control-Allow-Credentials: true
Server: nginx/1.18.0 (Ubuntu)
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:9c7c879b-c51a-427e-9701-218438da5f81

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
259 B 139ms
139ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=a87a3edc53b5a86d1795d11887b5aa39&svisitor=null&visitor=835e2a1b-9b19-4af5-8409-92e54cfe243d&session=996826c5-e4f2-4663-882a-4698b4fb1dfb&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2006%20Jun%202024%2008%3A19%3A54%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2006%20Jun%202024%2008%3A19%3A52%20GMT%22%2C%22timeSpent%22%3A%222620%22%2C%22totalTimeSpent%22%3A%222620%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20following%20is%20an%20analysis%20by%20the%20Huntress%20team%20of%20several%20recent%20intrusions%20connected%20to%20the%20Netscaler%20exploitation.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Netscaler%20Exploitation%20to%20Social%20Engineering%3A%20Mapping%20Convergence%20of%20Adversary%20Tradecraft%20Across%20Victims%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&pageViewId=adf3204e-5c30-4bbf-8799-189e5cc3fcbc&an_uid=0&webTagId=e666a54d-ff29-48f9-9baa-2be6ac05412e&v=1.1.20

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 06 Jun 2024 08:19:54 GMT
x-content-type-options: nosniff
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 06 Jun 2024 08:19:54 GMT

GET
BLOB 200
OK 0b2dc6bd-466f-4db7-9a4f-bb13fd0a2a67 Show response
https://www.huntress.com/ 3 KB
0 Script
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.huntress.com/0b2dc6bd-466f-4db7-9a4f-bb13fd0a2a67
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 78a521ef52cb89366ed937ea508c5afe769810343eb010c635e22f2348cb2692

Request headers

Accept-Language: nl-NL,nl;q=0.9;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

Content-Length: 2956
Content-Type: text/javascript

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
260 B 122ms
121ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=a87a3edc53b5a86d1795d11887b5aa39&svisitor=null&visitor=835e2a1b-9b19-4af5-8409-92e54cfe243d&session=996826c5-e4f2-4663-882a-4698b4fb1dfb&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2006%20Jun%202024%2008%3A19%3A55%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2006%20Jun%202024%2008%3A19%3A54%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223621%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20following%20is%20an%20analysis%20by%20the%20Huntress%20team%20of%20several%20recent%20intrusions%20connected%20to%20the%20Netscaler%20exploitation.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Netscaler%20Exploitation%20to%20Social%20Engineering%3A%20Mapping%20Convergence%20of%20Adversary%20Tradecraft%20Across%20Victims%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&pageViewId=adf3204e-5c30-4bbf-8799-189e5cc3fcbc&an_uid=0&webTagId=e666a54d-ff29-48f9-9baa-2be6ac05412e&v=1.1.20

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 06 Jun 2024 08:19:55 GMT
x-content-type-options: nosniff
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 06 Jun 2024 08:19:55 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
260 B 117ms
116ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=a87a3edc53b5a86d1795d11887b5aa39&svisitor=null&visitor=835e2a1b-9b19-4af5-8409-92e54cfe243d&session=996826c5-e4f2-4663-882a-4698b4fb1dfb&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2006%20Jun%202024%2008%3A19%3A56%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2006%20Jun%202024%2008%3A19%3A55%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%224621%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20following%20is%20an%20analysis%20by%20the%20Huntress%20team%20of%20several%20recent%20intrusions%20connected%20to%20the%20Netscaler%20exploitation.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Netscaler%20Exploitation%20to%20Social%20Engineering%3A%20Mapping%20Convergence%20of%20Adversary%20Tradecraft%20Across%20Victims%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&pageViewId=adf3204e-5c30-4bbf-8799-189e5cc3fcbc&an_uid=0&webTagId=e666a54d-ff29-48f9-9baa-2be6ac05412e&v=1.1.20

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 06 Jun 2024 08:19:56 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 06 Jun 2024 08:19:56 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
260 B 139ms
138ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=a87a3edc53b5a86d1795d11887b5aa39&svisitor=null&visitor=835e2a1b-9b19-4af5-8409-92e54cfe243d&session=996826c5-e4f2-4663-882a-4698b4fb1dfb&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2006%20Jun%202024%2008%3A19%3A57%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2006%20Jun%202024%2008%3A19%3A56%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225622%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20following%20is%20an%20analysis%20by%20the%20Huntress%20team%20of%20several%20recent%20intrusions%20connected%20to%20the%20Netscaler%20exploitation.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Netscaler%20Exploitation%20to%20Social%20Engineering%3A%20Mapping%20Convergence%20of%20Adversary%20Tradecraft%20Across%20Victims%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fnetscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims&pageViewId=adf3204e-5c30-4bbf-8799-189e5cc3fcbc&an_uid=0&webTagId=e666a54d-ff29-48f9-9baa-2be6ac05412e&v=1.1.20

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.huntress.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 06 Jun 2024 08:19:57 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 06 Jun 2024 08:19:57 GMT

Verdicts & Comments Add Verdict or Comment

131 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

52 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.huntress.com/	1970-01-20 23:17:17	Name: _gcl_au Value: 1.1.851299993.1717661992
.huntress.com/	1970-01-20 21:07:43	Name: _sp_ses.1564 Value: *
.huntress.com/	1970-01-21 06:43:41	Name: _sp_id.1564 Value: ad812760-95b0-4382-b0bd-d22f727e7e40.1717661993.1.1717661993.1717661993.9f69a3ef-de77-47bc-bc69-cfd70e4ed7d0
.huntress.com/	1970-01-21 06:43:41	Name: _ga_GCTMBVFESS Value: GS1.1.1717661992.1.0.1717661992.60.0.0
.huntress.com/	1970-01-21 06:43:41	Name: _ga Value: GA1.1.697386767.1717661993
.huntress.com/	1970-01-20 23:17:17	Name: _rdt_uuid Value: 1717661992893.74ea63c7-dcdc-4106-807b-8170558c943f
.huntress.com/	1970-01-20 21:09:08	Name: _uetsid Value: 8cd85b9023dd11ef925abf2de2bf3593
.huntress.com/	1970-01-21 06:29:17	Name: _uetvid Value: 8cd9385023dd11ef979bff168d551e8b
.g2crowd.com/	1970-01-20 21:07:43	Name: __cf_bm Value: DbdOJgU7E_UriUjUWDbF7w9L1axj0343AYcpIZGFPNc-1717661992-1.0.1.1-snbBEzKtgOdOFWNeHca12pLcF7awHguOX_euqChrwaMN0Tmibg2KIsAjLJlavaALBakWCKYHVhru558s1eucIw
tags.srv.stackadapt.com/	1970-01-21 05:53:17	Name: sa-user-id Value: s%3A0-be10726d-0279-5ad8-787b-b54f97dd8c5b.FdyWX0hIv5%2FvUGN%2BkrrcV7TGf4v440gDsBCKrgeDKyY
.srv.stackadapt.com/	1970-01-21 05:53:17	Name: sa-user-id Value: s%3A0-be10726d-0279-5ad8-787b-b54f97dd8c5b.FdyWX0hIv5%2FvUGN%2BkrrcV7TGf4v440gDsBCKrgeDKyY
tags.srv.stackadapt.com/	1970-01-21 05:53:17	Name: sa-user-id-v2 Value: s%3AvhBybQJ5Wth4e7VPl92MW1_Tx5g.AUMLrxCPSmqNHKnkLlHmuZ%2B5YYtiZ0PMyOHU6G5C4qM
.srv.stackadapt.com/	1970-01-21 05:53:17	Name: sa-user-id-v2 Value: s%3AvhBybQJ5Wth4e7VPl92MW1_Tx5g.AUMLrxCPSmqNHKnkLlHmuZ%2B5YYtiZ0PMyOHU6G5C4qM
tags.srv.stackadapt.com/	1970-01-21 05:53:17	Name: sa-user-id-v3 Value: s%3AAQAKICGrL0ju1hwgpHNgU0UU11UO0bPD8hSN_I4svZ4cuX2iEHwYBCCo4oWzBjABOgSTRxQUQgR1kwAU.dYJ95gDzXWuXQgYjOhDJDwWaMimMVNpSURBwPN2JzSc
.srv.stackadapt.com/	1970-01-21 05:53:17	Name: sa-user-id-v3 Value: s%3AAQAKICGrL0ju1hwgpHNgU0UU11UO0bPD8hSN_I4svZ4cuX2iEHwYBCCo4oWzBjABOgSTRxQUQgR1kwAU.dYJ95gDzXWuXQgYjOhDJDwWaMimMVNpSURBwPN2JzSc
www.huntress.com/	1970-01-21 05:53:17	Name: sa-user-id Value: s%253A0-be10726d-0279-5ad8-787b-b54f97dd8c5b.FdyWX0hIv5%252FvUGN%252BkrrcV7TGf4v440gDsBCKrgeDKyY
www.huntress.com/	1970-01-21 05:53:17	Name: sa-user-id-v2 Value: s%253AvhBybQJ5Wth4e7VPl92MW1_Tx5g.AUMLrxCPSmqNHKnkLlHmuZ%252B5YYtiZ0PMyOHU6G5C4qM
www.huntress.com/	1970-01-21 05:53:17	Name: sa-user-id-v3 Value: s%253AAQAKICGrL0ju1hwgpHNgU0UU11UO0bPD8hSN_I4svZ4cuX2iEHwYBCCo4oWzBjABOgSTRxQUQgR1kwAU.dYJ95gDzXWuXQgYjOhDJDwWaMimMVNpSURBwPN2JzSc
.bing.com/	1970-01-21 06:29:17	Name: MUID Value: 381F7233DA70667A2D1566A5DBB067CB
.techtarget.com/	1970-01-20 21:07:43	Name: __cf_bm Value: YrDQajSwg13jsMphdiclFVV2PGAPsxARRpVeOiUksC4-1717661993-1.0.1.1-HCiIh8_dzpGwaT7Kh1i8oEXpW5ru4NnzYHtGuAV_wSJLqE1uq2wdc02GKw.mQ.cGUhcOv8zDrpZCksrMQoKjfQ
.linkedin.com/	1970-01-20 23:17:17	Name: li_sugr Value: 26a2f55e-8c57-46bc-8c84-0c57d228d265
.linkedin.com/	1970-01-21 05:53:17	Name: bcookie Value: "v=2&9db26fdb-ccc9-4855-8c23-ab2daed63584"
.linkedin.com/	1970-01-20 21:09:08	Name: lidc Value: "b=OGST03:s=O:r=O:a=O:p=O:g=3251:u=1:x=1:i=1717661993:t=1717748393:v=2:sig=AQG5OSDNhkVBonY1BxqIq6uz1oRRDUWI"
.hsforms.com/	1970-01-20 21:07:43	Name: __cf_bm Value: 1Cs0ktXVGtmkv2qf2MYWroIn4G2A.NxNyz0FQpAncK4-1717661993-1.0.1.1-lXvTi.1dIBVGpUhELJu4cBeGleJVwDeBTzHTPyUnPFAIG3k2qNVFaGyPQuWDaWmeJEPL2A_uLhV6DAMl6jZKXQ
.hsforms.com/	1969-12-31 23:59:59	Name: _cfuvid Value: h9Wuxt5tIpvjBlT8CgGwf0P.6OWg5MPE7HlqGI0B310-1717661993323-0.0.1.1-604800000
.huntress.com/	1970-01-21 05:53:17	Name: _hjSessionUser_2159185 Value: eyJpZCI6IjA0YjdhZjYxLTdkOTItNTk1Yi1hY2EzLTcxMTU4OTM1NGRiZCIsImNyZWF0ZWQiOjE3MTc2NjE5OTM0MDUsImV4aXN0aW5nIjp0cnVlfQ==
.huntress.com/	1970-01-20 21:07:43	Name: _hjSession_2159185 Value: eyJpZCI6ImIzYWFkOWEyLWY4MGItNGYyNy05ZDBiLWY1MTUxOTg5YzRjMSIsImMiOjE3MTc2NjE5OTM0MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=
.twitter.com/	1970-01-21 06:43:41	Name: guest_id_marketing Value: v1%3A171766199328829157
.twitter.com/	1970-01-21 06:43:41	Name: guest_id_ads Value: v1%3A171766199328829157
.twitter.com/	1970-01-21 06:43:41	Name: personalization_id Value: "v1_QCp2USHUytXsjSrKKmMO9A=="
.twitter.com/	1970-01-21 06:43:41	Name: guest_id Value: v1%3A171766199328829157
.t.co/	1970-01-21 06:43:41	Name: muc_ads Value: a9cde542-66c9-433c-99d9-e0c08ec49bdd
.huntress.com/	1970-01-20 23:17:17	Name: _fbp Value: fb.1.1717661993441.713793260782025377
.linkedin.com/	1970-01-21 01:26:53	Name: li_gc Value: MTswOzE3MTc2NjE5OTM7MjswMjF3W0+6tZzTmGqVvyP97Bnh+1f7DdUjG5JbAED/Eeblpw==
www.clarity.ms/	1970-01-21 05:53:17	Name: CLID Value: 7ef3f43566ac4a278eb9a9c68c53dc68.20240606.20250606
.huntress.com/	1970-01-21 05:53:17	Name: _clck Value: 15mbfdw%7C2%7Cfme%7C0%7C1618
www.huntress.com/	1970-01-21 06:43:41	Name: _gd_visitor Value: 835e2a1b-9b19-4af5-8409-92e54cfe243d
www.huntress.com/	1970-01-20 21:07:56	Name: _gd_session Value: 996826c5-e4f2-4663-882a-4698b4fb1dfb
.adnxs.com/	1970-01-21 06:43:41	Name: receive-cookie-deprecation Value: 1
www.huntress.com/	1970-01-20 21:17:46	Name: _an_uid Value: 0
.c.bing.com/	1970-01-20 21:17:46	Name: MR Value: 0
.c.bing.com/	1970-01-21 06:29:17	Name: SRM_B Value: 381F7233DA70667A2D1566A5DBB067CB
.c.clarity.ms/	1969-12-31 23:59:59	Name: SM Value: C
.clarity.ms/	1970-01-21 06:29:17	Name: MUID Value: 381F7233DA70667A2D1566A5DBB067CB
.c.clarity.ms/	1970-01-20 21:17:46	Name: MR Value: 0
.c.clarity.ms/	1970-01-20 21:07:42	Name: ANONCHK Value: 0
.hubspot.com/	1970-01-20 21:07:43	Name: __cf_bm Value: _Nr6UhCLwYBu95rxSRQvjPlxerORp6grRwwQQfPGDVY-1717661994-1.0.1.1-0yZNHZdcgvMn7mWJCpXkTEA_Kk5fDvW7y9pp64Bzju8XbRBh3H6TOCZVXMc_WK8m.Zjppf7jf5Dr.VKRt14YzA
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: HWzK4Zu9Fb88JQOf5pGmHdWLq4zPOPimbXNshOZJg44-1717661994127-0.0.1.1-604800000
.huntress.com/	1970-01-20 21:09:08	Name: _clsk Value: 7ux0sm%7C1717661994454%7C1%7C1%7Cu.clarity.ms%2Fcollect
.www.huntress.com/	1970-01-21 05:53:17	Name: _zitok Value: ec993a17d9621f0a6bf61717661994
.zoominfo.com/	1970-01-20 21:07:43	Name: __cf_bm Value: CF.Og_Wukty_tzuUXOd8NB8GZxQeiLmi5bUR4W4Pyb4-1717661995-1.0.1.1-ZRosWJka9aRZNsbsSXIG99Q8cfZJLEUqS7qwicjgsLp7L.rglBmSd4NU0QZnakpVn.T8pmvg1Pg7w45TKdmVyw
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: 2RhiQjGaKSQcZypmFF76aYhEpHTLYGGSZtqrGNeKQa0-1717661995390-0.0.1.1-604800000

79 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.quora.com
alb.reddit.com
analytics.twitter.com
api.neverbounce.com
assets.website-files.com
b.6sc.co
bat.bing.com
c.6sc.co
c.bing.com
c.clarity.ms
cdn.jsdelivr.net
cdn.neverbounce.com
cdn.prod.website-files.com
client-registry.mutinycdn.com
connect.facebook.net
cta-service-cms2.hubspot.com
d3e54v103j8qbb.cloudfront.net
forms.hscollectedforms.net
forms.hsforms.com
google.com
hubspotonwebflow.com
huntresscdn.com
ibc-flow.techtarget.com
ipv6.6sc.co
j.6sc.co
js.driftt.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsadspixel.net
js.hscollectedforms.net
js.hsleadflows.net
js.hubspot.com
js.na.chilipiper.com
js.zi-scripts.com
perf-na1.hsforms.com
pixel-config.reddit.com
px.ads.linkedin.com
px4.ads.linkedin.com
q.quora.com
region1.analytics.google.com
script.hotjar.com
secure.adnxs.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
t.co
tags.srv.stackadapt.com
tools.refokus.com
track.hubspot.com
tracking.g2crowd.com
trk.techtarget.com
u.clarity.ms
vc.hotjar.io
ws.zoominfo.com
www.clarity.ms
www.facebook.com
www.google.com
www.google.nl
www.googletagmanager.com
www.gstatic.com
www.huntress.com
www.redditstatic.com
104.16.117.43
104.19.175.188
104.244.42.195
13.107.42.14
13.32.27.54
142.250.185.132
146.75.120.157
151.101.129.140
151.101.129.229
151.101.65.140
151.101.65.91
162.159.152.17
172.64.150.44
172.64.153.29
18.244.20.40
18.245.46.63
18.245.86.14
18.66.102.51
18.66.112.110
185.89.210.244
2.17.100.184
2001:4860:4802:34::36
2600:9000:235a:f000:11:3b84:d200:93a1
2606:4700:20::681a:1ad
2606:4700:4400::6812:24c4
2606:4700:4400::6812:2b1f
2606:4700:4400::ac40:991b
2606:4700::6810:6dfe
2606:4700::6810:7674
2606:4700::6810:89d1
2606:4700::6811:80ac
2606:4700::6811:afc9
2606:4700::6812:8b11
2620:1ec:21::14
2620:1ec:29:1::43
2620:1ec:c11::237
2a00:1450:4001:810::2008
2a00:1450:4001:813::2003
2a00:1450:4001:82f::200e
2a00:1450:4001:831::2003
2a00:1450:400c:c04::9d
2a02:26f0:3500:16::215:148d
2a02:26f0:7100::210:172
2a03:2880:f084:105:face:b00c:0:3
2a03:2880:f177:185:face:b00c:0:25de
2a04:4e42:200::485
2a04:4e42::396
3.223.190.23
34.111.208.231
34.111.224.162
4.227.249.197
52.17.119.105
52.4.177.222
54.93.141.152
68.219.88.97
76.76.21.164
76.76.21.61
93.184.221.165
0020be3f1555293342637940e02d32e0f0c3b1951f6a274c00a6e3afe91610d1
027f9fef93a2d620715de7311a5bf674cb3df18a352d2a0a7266c147c157333f
02c65a6d1cdc752f31b0be2157d9c6f65e72c7f3e781eea941bd848caf8a332e
0a7e62074b4311ed600655962e3217c9f2c33bd454457523a1d0fe36dfbb2207
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0c7178cc6ca34fb18e30f070a5e7a1c287b2d7ccfcba2cfdf06e0f46eda55740
10ef3ba5308697292067120aee8cea7f3341a9a5e691475bc4a29805a5194939
1402811141d6cf6956918acd3398468bd385081a50b90a5d251fe7a3312c0801
19680a27e88da4a3713af26571b4849096e75d617f2845574af7fd15746256bb
1bfde0b481cfb834c5ed8d6c6eb9597692c2df5d2f0be5352b50d4dca3749541
2af4c240d46b3e99eea9ccbfd9c0c1c856c710a5ed3692f455767a96224171b2
2bc7927791354f14b1cea4f8560731a590146eb2743d72146228fea0449599af
2c699eb55ae3fe61b3d783c8936ab1eb949c596a5c89118f703e328ede2b8308
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2f0faa86c85189cabbfc56460c57a61d8480ac15c7868dd0363c6c035730d1af
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
33deeceba8a4f12c81e118177e3a68348bd605574c74f2606bd135d00e9b42f3
350cf9ff67297ce9f79b1a35fb7205326d21f149ab404f81ec875968f0b7d083
36b097a74149a547cc7fe1da7b5a9cacf6c36d2f91872f11874479e1d4fafee2
37c87a24c06d71561ed95e47c6e33adc720228b275fe69cc257bf7503f49daa0
3e74699ee2810c89e5df5bd0d0506256c46f1e73108f40dc993b49cc210203db
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
442375f1dd6362e4a3e889f3f11e7d14aa686899a36f112ae73986a80475681b
47d1036cdfb7fa765e45f0f3d193baadcd53005e95a2f9bf7b531ebfbf41ea2f
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df
4e619c053717a2281cf687c48ec0dcf804b3da9739a678bae78c08d594ddbafb
4f7ec8541306bd83dc40595958c224a79bc306df70f49d10232ea381118ac35d
53748d29b45a93b53aeaf58adb6c2754f7b2260cd419d67204ad5c37a3ee0ef6
53a3dc763a0bd679523a77f5610e4ab27231fe6763d7089c1c92966daa1663f7
543351d4360e32621e4bb7588aa7b81d1fbc027c580a6246938e3fc8a2dfedcc
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
553797b86e5516ebb3b4a6ffc794d7d9eca1fc1f3ca8ab0703e5eff9934e29c8
5ade1526f1674ac49650f04fa328b8aec7266c24c9a045f5efbb96b6984422c0
5af5ee0b37b1f0ef31c42932bbf81424e4bb53e95e87a47e058625c1af2245db
5ca6a3f3a3aebb8cc04b7028d0338d3aa11a64ed3857001d84601e34f319b184
5eee7eef8c43d97d6c92ce9000b3f2424647e58f985c2df5711690c8b95f1495
640d525f0c6d09a6cdc4c6f6b0d44c4d2d92ce5e35ae1a945ccac5da67071f9d
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6ee38878cd3f57c918114ecd1a74bc75e5165f45fd1e9503056e8dc2e542288f
6f3642cd8faa981a6b7f71cb0bd88a222ed7c92510100761c38f4bfd689853f2
71425f588c17edb9905c3ed73aee0404b58772b91c8154fe53d3157f58f0b2e2
740bb313221bda5543b6fbe0bce3dd276cc70c4fd9aa0bae9d46b149406becf5
784a558a18c328609e15a041c0cdb8efdfec2e6f6c9759d40fcc952189db0aee
78a521ef52cb89366ed937ea508c5afe769810343eb010c635e22f2348cb2692
7a293bb67e4fa8bd050bd5d553e254f66004a254eb5f5a7b56608a22fe72af81
7f62ee80b8c824f30ad6c278146632d25b7e159e0a9cd91a356068eb9340061c
80224a6fb2c440d16519651d4f75ad89a263c0bba1abe4cce0c99e14fff30e1c
81bb134d1bbd3e31e1ddac9449ef1c509b7061a14e15554d625569cb38af44d4
823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721
82ba33778a6595a59baef6e6964c64d7c3e9888c2bbf74461f1948b295db28e2
83ebe8170b3b5dda2d20a80fe205ec14e1f8cb19ed40cfe73d480087b588e56c
8638fe41461414860127cd8d9a0672e3aae30ae76bc69e5398c3a0bd630bd98b
889e4055351e629718cc9647a7f696cb4fb1e246bcf29bd25e2f8ce5105c27b5
899d1ec3c095342571d3be2091ec6f984d4cc82390d1f61945c391fa035b00d9
89aa43cb2db8717165e898b18806ad757585f8815f9f514bb0afbd3c390def95
8ea3b372815e369458fc9043141a09847d93b9b6531a526d3cb3e3b9901bb872
8ed080802dcf762d1e32fabdacb64db4474cb6a1661c97242726d5f334c70de3
8f0f089b8d2746c56340171bba62f027d4d2dc0f520588d9480432693381e14a
93a2fd82dd3a13a9e9ce0583f3bde1b6e88da6ebce30fa8c87cee4d9d927e4d2
93c12a5272f0be2f59a81896ae5d6888c09a6faff8212805bfe93ca9eaf9e7e4
944352d0198c673b45a699471c970aef85458ea3c58a3ed825b0f0e4f33f999c
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9fd098017af2261bad16d71f16eb849642460d7ac0d7f0651e9a086a245c853c
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1e79865576e220b93dfe34d011286a8335ee8ac4eb6450300fb45a4f15a600e
a4aba4543a40b2e2d78e4006eb941a3a18cf95dc81041ad362321a3995bcc898
a5365009cca534a115390ff165814f91411ed92aa9722680e2cc00a0266f8ea6
a577cc713533d7a1edbc5186c3f7b8788bbf317a857111150778d6a617220cec
a5b09c5d507da92ea94a3f319e31f6196954b0ea63f9890388a37e8facdae2a7
a80b4664433645c7f13050b4a6e670df38a428e546c579ff003439c5bf45dfdb
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
aa7cce711c78daac41c6eb65fdabdfea32daf468b2f6d699afce48f3839441ce
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ace449f8c185f9f62716fd9998c8f4d09f6849ead77ec8c3849aa69f4c8c1d36
ad1a0bf17b8433241806ec0b3cb9c17be616ea295df90068ab3e646de802e111
b9b4f19dee3d4910ab6fb4ea6e8a3126cfd5386c0bec674b65461a5192dba995
baeb614251f7dbe98452c10ab2d3b7178259cb108dba86782e119dfa404eaf40
c12f11d824a0e7cb513ff4574c1664ac5c3949efc35896edeb0612fe45f1c00b
c282418db43d8c7988bebfb20fabf99d5598b033ed5fd45ad9b9460e59baac91
c3ea3a972768896d2a84d6eb36d3f5919478ad9c091477c22a5362eb6d53aee4
c99531b584c2990420c6cf8f267e27bca20375cf89d4afdcaa5b3afb7a9f35d2
c99d11cb4960d6e1918ed55d5bcbb316d38b51098e2efc1201904d7274d3273e
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cf8edbedfd479fe7cc642e3a1db515dd1103f2d7864f0db5cae6144fbde44ea4
d967ffcdff803d61e47cc2c176d0b5a86c9c5ba820aeabc27c6341b434aa11ba
dab9d3dbee663364025cd763f3dbb199e33f5dcf5b978f5c8699aa6368aed589
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dc93c5b3243e66c7b2e27c51b76fa6a11bd7a6d7546c5fa26bbffa001f885305
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd26d9d88899d0587c9377964b7d1ab478a318b0fdbee7b9d6a084e4aa6425f7
dd479f154c8d4604ca2fba1ef0cb7cae4988a550fd4f6fb3bed41e5055f54e9f
de1e399b07289f3b0a8d35142e363e128124a1185770e214e25e58030dad48e5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e83014fcae080031cb2f582a2a5ac260211398059d358e1dd4dc6cc09327b00e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f143cdd47f943dca511fec190f6f8dc72123af1a03b0acc0b85006d3827469db
f2314da0b26cc727445f74c19d54f2f75944ea1a610497231ba6a5d9e541acf0
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fb60a91372499fbe6347fe3e7e4025436de778648109690751ee1fcf1a0d9b10
fc573eaf0e39d6b2429951f78b744dde5acb4cbee85a9b903aea0210072d9b48
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fffc6ed23cfeabaaace717503bfabd907816869c8c5ff38a2127b8284e8c5988

www.huntress.com Open in urlscan Pro 52.17.119.105 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

138 Requests

97 %HTTPS

45 %IPv6

45 Domains

64 Subdomains

59 IPs

6 Countries

3848 kBTransfer

8274 kBSize

52 Cookies

22 Outgoing links

Page URL History

Redirected requests

138 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.huntress.com Open in urlscan Pro
52.17.119.105 Public Scan

Screenshot
Live screenshot

Full Image

138
Requests

97 %
HTTPS

45 %
IPv6

45
Domains

64
Subdomains

59
IPs

6
Countries

3848 kB
Transfer

8274 kB
Size

52
Cookies

138 HTTP transactions
0 data transactions