www.huntress.com Open in urlscan Pro
63.35.51.142 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Submission: On February 27 via api (February 27th 2024, 11:38:28 pm UTC) from IL — Scanned from IL

Summary HTTP 230 Redirects Links 27 Behaviour Indicators

Summary

This website contacted 69 IPs in 4 countries across 53 domains to perform 230 HTTP transactions. The main IP is 63.35.51.142, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is www.huntress.com. The Cisco Umbrella rank of the primary domain is 187834.
TLS certificate: Issued by R3 on December 28th 2023. Valid for: 3 months.

This is the only time www.huntress.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	63.35.51.142 63.35.51.142	16509 (AMAZON-02) (AMAZON-02)
20	13.225.78.111 13.225.78.111	16509 (AMAZON-02) (AMAZON-02)
6	216.58.206.36 216.58.206.36	15169 (GOOGLE) (GOOGLE)
14	2.17.100.184 2.17.100.184	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	34.111.224.162 34.111.224.162	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
6	104.16.88.20 104.16.88.20	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	140.82.121.3 140.82.121.3	36459 (GITHUB) (GITHUB)
1	52.222.232.144 52.222.232.144	16509 (AMAZON-02) (AMAZON-02)
1	104.16.190.89 104.16.190.89	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	76.76.21.98 76.76.21.98	16509 (AMAZON-02) (AMAZON-02)
4	76.76.21.22 76.76.21.22	16509 (AMAZON-02) (AMAZON-02)
8	142.250.185.131 142.250.185.131	15169 (GOOGLE) (GOOGLE)
3	142.250.186.104 142.250.186.104	15169 (GOOGLE) (GOOGLE)
1	18.245.86.87 18.245.86.87	16509 (AMAZON-02) (AMAZON-02)
15	142.250.184.238 142.250.184.238	15169 (GOOGLE) (GOOGLE)
1	185.199.109.154 185.199.109.154	54113 (FASTLY) (FASTLY)
8	13.33.187.119 13.33.187.119	16509 (AMAZON-02) (AMAZON-02)
1	172.67.68.218 172.67.68.218	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	184.24.77.28 184.24.77.28	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	162.159.152.17 162.159.152.17	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	199.232.188.157 199.232.188.157	54113 (FASTLY) (FASTLY)
1 4	204.79.197.200 204.79.197.200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	157.240.253.1 157.240.253.1	32934 (FACEBOOK) (FACEBOOK)
1	172.64.144.225 172.64.144.225	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	52.28.87.155 52.28.87.155	16509 (AMAZON-02) (AMAZON-02)
1	18.66.97.37 18.66.97.37	16509 (AMAZON-02) (AMAZON-02)
1	18.245.46.48 18.245.46.48	16509 (AMAZON-02) (AMAZON-02)
1	104.18.36.196 104.18.36.196	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	18.66.97.14 18.66.97.14	16509 (AMAZON-02) (AMAZON-02)
2	151.101.65.140 151.101.65.140	54113 (FASTLY) (FASTLY)
1	52.4.62.73 52.4.62.73	14618 (AMAZON-AES) (AMAZON-AES)
1	104.18.125.12 104.18.125.12	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.16.80.186 104.16.80.186	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.17.230.163 104.17.230.163	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.17.89.154 104.17.89.154	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	104.19.155.83 104.19.155.83	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	172.64.153.27 172.64.153.27	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	142.250.185.174 142.250.185.174	15169 (GOOGLE) (GOOGLE)
1	142.250.185.142 142.250.185.142	15169 (GOOGLE) (GOOGLE)
1	74.125.71.156 74.125.71.156	15169 (GOOGLE) (GOOGLE)
1	142.250.186.67 142.250.186.67	15169 (GOOGLE) (GOOGLE)
2	34.159.227.151 34.159.227.151	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	13.32.27.21 13.32.27.21	16509 (AMAZON-02) (AMAZON-02)
1	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
1	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
2	34.111.208.231 34.111.208.231	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3 5	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	13.107.213.45 13.107.213.45	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	34.202.4.253 34.202.4.253	14618 (AMAZON-AES) (AMAZON-AES)
2	54.68.63.216 54.68.63.216	16509 (AMAZON-02) (AMAZON-02)
1	34.217.7.238 34.217.7.238	16509 (AMAZON-02) (AMAZON-02)
1	157.240.253.35 157.240.253.35	32934 (FACEBOOK) (FACEBOOK)
1	151.101.129.140 151.101.129.140	54113 (FASTLY) (FASTLY)
3	142.250.185.227 142.250.185.227	15169 (GOOGLE) (GOOGLE)
1 2	172.217.16.194 172.217.16.194	15169 (GOOGLE) (GOOGLE)
1	142.250.186.38 142.250.186.38	15169 (GOOGLE) (GOOGLE)
4	216.58.206.42 216.58.206.42	15169 (GOOGLE) (GOOGLE)
1	142.250.185.246 142.250.185.246	15169 (GOOGLE) (GOOGLE)
1	172.217.18.1 172.217.18.1	15169 (GOOGLE) (GOOGLE)
1	104.17.207.249 104.17.207.249	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.18.160.125 104.18.160.125	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	20.122.63.128 20.122.63.128	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	37.252.172.123 37.252.172.123	29990 (ASN-APPNEX) (ASN-APPNEX)
39	18.66.147.59 18.66.147.59	16509 (AMAZON-02) (AMAZON-02)
3	172.64.150.44 172.64.150.44	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	68.219.88.97 68.219.88.97	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	104.16.137.15 104.16.137.15	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	54.147.21.139 54.147.21.139	14618 (AMAZON-AES) (AMAZON-AES)
230	69

1 63.35.51.142 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-63-35-51-142.eu-west-1.compute.amazonaws.com

www.huntress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 13.225.78.111 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-111.fra2.r.cloudfront.net

assets-global.website-files.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 216.58.206.36 (United States)

ASN15169 (GOOGLE, US)
PTR: mil07s07-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2.17.100.184 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-17-100-184.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.111.224.162 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 162.224.111.34.bc.googleusercontent.com

js.na.chilipiper.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.16.88.20 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 140.82.121.3 (Frankfurt am Main, Germany)

ASN36459 (GITHUB, US)
PTR: lb-140-82-121-3-fra.github.com

gist.github.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.232.144 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-232-144.fra56.r.cloudfront.net

d3e54v103j8qbb.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.190.89 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 76.76.21.98 (Walnut, United States)

ASN16509 (AMAZON-02, US)

tools.refokus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 76.76.21.22 (Walnut, United States)

ASN16509 (AMAZON-02, US)

hubspotonwebflow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 142.250.185.131 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f3.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.104 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.245.86.87 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-86-87.fra60.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 142.250.184.238 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f14.1e100.net

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.199.109.154 (United States)

ASN54113 (FASTLY, US)
PTR: cdn-185-199-109-154.github.com

github.githubassets.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 13.33.187.119 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-187-119.fra60.r.cloudfront.net

assets.website-files.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.68.218 (United States)

ASN13335 (CLOUDFLARENET, US)

huntresscdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 184.24.77.28 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a184-24-77-28.deploy.static.akamaitechnologies.com

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.159.152.17 (None, )

ASN13335 (CLOUDFLARENET, US)

a.quora.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.188.157 (Munich, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 204.79.197.200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
PTR: a-0001.a-msedge.net

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.253.1 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-fra5.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.64.144.225 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

tracking.g2crowd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 52.28.87.155 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-28-87-155.eu-central-1.compute.amazonaws.com

tags.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.97.37 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-97-37.fra56.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.245.46.48 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-46-48.fra56.r.cloudfront.net

cdn.neverbounce.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.36.196 (None, )

ASN13335 (CLOUDFLARENET, US)

trk.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.66.97.14 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-97-14.fra56.r.cloudfront.net

cdn.metadata.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.65.140 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.4.62.73 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-4-62-73.compute-1.amazonaws.com

q.quora.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.125.12 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.80.186 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.230.163 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.17.89.154 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.19.155.83 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cta-service-cms2.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.64.153.27 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.174 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f14.1e100.net

google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.142 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f14.1e100.net

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.125.71.156 (United States)

ASN15169 (GOOGLE, US)
PTR: wn-in-f156.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.67 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f3.1e100.net

www.google.co.il	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.159.227.151 (Frankfurt am Main, Germany)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 151.227.159.34.bc.googleusercontent.com

webhooks.fivetran.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.21 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-21.fra56.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.208.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.208.111.34.bc.googleusercontent.com

ibc-flow.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 13.107.42.14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.107.213.45 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.202.4.253 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-202-4-253.compute-1.amazonaws.com

api.neverbounce.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.68.63.216 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-68-63-216.us-west-2.compute.amazonaws.com

api-gw.metadata.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.217.7.238 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-217-7-238.us-west-2.compute.amazonaws.com

a.usbrowserspeed.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 157.240.253.35 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-02-fra5.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.129.140 (United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.185.227 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.16.194 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s65-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.38 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f6.1e100.net

static.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 216.58.206.42 (United States)

ASN15169 (GOOGLE, US)
PTR: mil07s07-in-f10.1e100.net

jnn-pa.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.246 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f22.1e100.net

i.ytimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.18.1 (United States)

ASN15169 (GOOGLE, US)
PTR: fra02s19-in-f1.1e100.net

yt3.ggpht.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.207.249 (None, )

ASN13335 (CLOUDFLARENET, US)

perf-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.160.125 (None, )

ASN13335 (CLOUDFLARENET, US)

forms.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 20.122.63.128 (Boydton, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

p.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.252.172.123 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

39 18.66.147.59 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-147-59.fra60.r.cloudfront.net

rc-widget-frame.js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.64.150.44 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

js.zi-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.219.88.97 (Dublin, Ireland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.16.137.15 (None, )

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 54.147.21.139 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-147-21-139.compute-1.amazonaws.com

bootstrap.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
customer.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
metrics.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
event.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
40	driftt.com js.driftt.com — Cisco Umbrella Rank: 6164 rc-widget-frame.js.driftt.com — Cisco Umbrella Rank: 100804	464 KB
28	website-files.com assets-global.website-files.com — Cisco Umbrella Rank: 5876 assets.website-files.com — Cisco Umbrella Rank: 11200	1 MB
15	youtube.com www.youtube.com — Cisco Umbrella Rank: 69	1 MB
14	6sc.co j.6sc.co — Cisco Umbrella Rank: 5326 c.6sc.co — Cisco Umbrella Rank: 8195 ipv6.6sc.co — Cisco Umbrella Rank: 5498 b.6sc.co — Cisco Umbrella Rank: 3594	41 KB
11	gstatic.com www.gstatic.com fonts.gstatic.com	708 KB
9	google.com www.google.com — Cisco Umbrella Rank: 2 google.com — Cisco Umbrella Rank: 1 analytics.google.com — Cisco Umbrella Rank: 159	59 KB
8	github.com gist.github.com — Cisco Umbrella Rank: 44781	47 KB
7	clarity.ms 1 redirects www.clarity.ms — Cisco Umbrella Rank: 775 p.clarity.ms — Cisco Umbrella Rank: 7649 c.clarity.ms — Cisco Umbrella Rank: 1350	28 KB
6	drift.com bootstrap.api.drift.com — Cisco Umbrella Rank: 6891 customer.api.drift.com — Cisco Umbrella Rank: 7456 metrics.api.drift.com — Cisco Umbrella Rank: 6789 event.api.drift.com Failed	5 KB
6	stackadapt.com tags.srv.stackadapt.com — Cisco Umbrella Rank: 2864	11 KB
6	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 306	66 KB
5	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 350 www.linkedin.com — Cisco Umbrella Rank: 615	3 KB
4	googleapis.com jnn-pa.googleapis.com — Cisco Umbrella Rank: 228	40 KB
4	doubleclick.net 1 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 85 googleads.g.doubleclick.net — Cisco Umbrella Rank: 35 static.doubleclick.net — Cisco Umbrella Rank: 258	1 KB
4	metadata.io cdn.metadata.io — Cisco Umbrella Rank: 8499 api-gw.metadata.io — Cisco Umbrella Rank: 21337	4 KB
4	bing.com 1 redirects bat.bing.com — Cisco Umbrella Rank: 368 c.bing.com — Cisco Umbrella Rank: 249	16 KB
4	hubspotonwebflow.com hubspotonwebflow.com — Cisco Umbrella Rank: 33793	26 KB
3	zi-scripts.com js.zi-scripts.com — Cisco Umbrella Rank: 8055	3 KB
3	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2200	17 KB
3	hubspot.com js.hubspot.com — Cisco Umbrella Rank: 4496 cta-service-cms2.hubspot.com — Cisco Umbrella Rank: 4414 track.hubspot.com — Cisco Umbrella Rank: 2378	27 KB
3	techtarget.com trk.techtarget.com — Cisco Umbrella Rank: 23841 ibc-flow.techtarget.com — Cisco Umbrella Rank: 21782	2 KB
3	neverbounce.com cdn.neverbounce.com — Cisco Umbrella Rank: 64652 api.neverbounce.com — Cisco Umbrella Rank: 127868	30 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 40	281 KB
2	zoominfo.com ws.zoominfo.com — Cisco Umbrella Rank: 4417	2 KB
2	hsforms.com perf-na1.hsforms.com — Cisco Umbrella Rank: 4828 forms.hsforms.com — Cisco Umbrella Rank: 4280	2 KB
2	fivetran.com webhooks.fivetran.com — Cisco Umbrella Rank: 39391	325 B
2	hscollectedforms.net js.hscollectedforms.net — Cisco Umbrella Rank: 4526 forms.hscollectedforms.net — Cisco Umbrella Rank: 4639	26 KB
2	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1234	10 KB
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 710 script.hotjar.com — Cisco Umbrella Rank: 961	60 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 176	71 KB
2	quora.com a.quora.com — Cisco Umbrella Rank: 5310 q.quora.com — Cisco Umbrella Rank: 3881	15 KB
2	licdn.com snap.licdn.com — Cisco Umbrella Rank: 805	17 KB
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 502	701 B
1	ggpht.com yt3.ggpht.com — Cisco Umbrella Rank: 235	3 KB
1	ytimg.com i.ytimg.com — Cisco Umbrella Rank: 91	69 KB
1	reddit.com alb.reddit.com — Cisco Umbrella Rank: 1399	637 B
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 102	185 B
1	usbrowserspeed.com a.usbrowserspeed.com — Cisco Umbrella Rank: 2967
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 802	725 B
1	t.co t.co — Cisco Umbrella Rank: 660	377 B
1	google.co.il www.google.co.il — Cisco Umbrella Rank: 16594	408 B
1	hsadspixel.net js.hsadspixel.net — Cisco Umbrella Rank: 3178	4 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2187	22 KB
1	hsleadflows.net js.hsleadflows.net — Cisco Umbrella Rank: 5007	88 KB
1	g2crowd.com tracking.g2crowd.com — Cisco Umbrella Rank: 8103	2 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 783	15 KB
1	huntresscdn.com huntresscdn.com — Cisco Umbrella Rank: 6265	112 KB
1	githubassets.com github.githubassets.com — Cisco Umbrella Rank: 8462	11 KB
1	refokus.com tools.refokus.com — Cisco Umbrella Rank: 37604	1 KB
1	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 2453	1 KB
1	cloudfront.net d3e54v103j8qbb.cloudfront.net	31 KB
1	chilipiper.com js.na.chilipiper.com — Cisco Umbrella Rank: 194802	25 KB
1	huntress.com www.huntress.com — Cisco Umbrella Rank: 187834	30 KB
230	53

	Domain	Requested by
39	rc-widget-frame.js.driftt.com	js.driftt.com rc-widget-frame.js.driftt.com
20	assets-global.website-files.com	www.huntress.com
15	www.youtube.com	www.huntress.com www.youtube.com www.googletagmanager.com
8	assets.website-files.com	assets-global.website-files.com
8	www.gstatic.com	www.google.com www.gstatic.com www.youtube.com
8	gist.github.com	www.huntress.com
6	b.6sc.co
6	tags.srv.stackadapt.com	www.huntress.com tags.srv.stackadapt.com
6	cdn.jsdelivr.net	www.huntress.com
6	www.google.com	www.huntress.com www.gstatic.com www.google.com www.youtube.com
4	jnn-pa.googleapis.com	www.youtube.com
4	px.ads.linkedin.com	2 redirects www.huntress.com snap.licdn.com
4	hubspotonwebflow.com	www.huntress.com hubspotonwebflow.com
4	j.6sc.co	www.huntress.com j.6sc.co www.googletagmanager.com
3	js.zi-scripts.com	www.huntress.com js.zi-scripts.com
3	p.clarity.ms	www.clarity.ms
3	fonts.gstatic.com	www.google.com www.youtube.com
3	js.hs-banner.com	js.hs-scripts.com js.hs-banner.com
3	bat.bing.com	www.googletagmanager.com bat.bing.com www.huntress.com
3	www.googletagmanager.com	www.huntress.com www.googletagmanager.com
2	customer.api.drift.com	rc-widget-frame.js.driftt.com
2	bootstrap.api.drift.com	rc-widget-frame.js.driftt.com
2	ws.zoominfo.com	js.zi-scripts.com
2	c.clarity.ms	1 redirects
2	googleads.g.doubleclick.net	1 redirects www.youtube.com
2	ipv6.6sc.co	j.6sc.co
2	c.6sc.co	j.6sc.co
2	api-gw.metadata.io	cdn.metadata.io
2	api.neverbounce.com	cdn.neverbounce.com
2	www.clarity.ms	bat.bing.com www.clarity.ms
2	ibc-flow.techtarget.com	trk.techtarget.com
2	webhooks.fivetran.com	huntresscdn.com
2	google.com	www.googletagmanager.com
2	www.redditstatic.com	www.huntress.com www.redditstatic.com
2	cdn.metadata.io	www.huntress.com
2	connect.facebook.net	www.huntress.com connect.facebook.net
2	snap.licdn.com	www.googletagmanager.com snap.licdn.com
1	event.api.drift.com	rc-widget-frame.js.driftt.com
1	metrics.api.drift.com	rc-widget-frame.js.driftt.com
1	c.bing.com	1 redirects
1	track.hubspot.com
1	secure.adnxs.com	j.6sc.co
1	forms.hsforms.com	www.huntress.com
1	perf-na1.hsforms.com	www.huntress.com
1	yt3.ggpht.com	www.youtube.com
1	i.ytimg.com	www.youtube.com
1	static.doubleclick.net	www.youtube.com
1	cta-service-cms2.hubspot.com	js.hubspot.com
1	forms.hscollectedforms.net	js.hscollectedforms.net
1	alb.reddit.com	www.huntress.com
1	www.facebook.com	www.huntress.com
1	a.usbrowserspeed.com	cdn.metadata.io
1	www.linkedin.com	1 redirects
1	analytics.twitter.com	www.huntress.com
1	t.co	www.huntress.com
1	script.hotjar.com	static.hotjar.com
1	www.google.co.il	www.huntress.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	analytics.google.com	www.googletagmanager.com
1	js.hubspot.com	js.hs-scripts.com
1	js.hscollectedforms.net	js.hs-scripts.com
1	js.hsadspixel.net	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	js.hsleadflows.net	js.hs-scripts.com
1	q.quora.com	www.huntress.com
1	trk.techtarget.com	www.huntress.com
1	cdn.neverbounce.com	www.googletagmanager.com
1	static.hotjar.com	www.huntress.com
1	tracking.g2crowd.com	www.huntress.com
1	static.ads-twitter.com	www.googletagmanager.com
1	a.quora.com	www.googletagmanager.com
1	huntresscdn.com	www.huntress.com
1	github.githubassets.com	gist.github.com
1	js.driftt.com	www.huntress.com
1	tools.refokus.com	www.huntress.com
1	js.hs-scripts.com	www.huntress.com
1	d3e54v103j8qbb.cloudfront.net	www.huntress.com
1	js.na.chilipiper.com	www.huntress.com
1	www.huntress.com
230	79

This site contains links to these domains. Also see Links.

Domain
huntress.io
support.huntress.io
assets-global.website-files.com
www.facebook.com
twitter.com
www.linkedin.com
www.reddit.com
www.connectwise.com
gist.github.com
github.com
learn.microsoft.com

Subject Issuer	Validity	Valid
www.huntress.com R3	`2023-12-28` - `2024-03-27`	3 months	crt.sh
*.website-files.com Amazon RSA 2048 M03	`2023-09-11` - `2024-10-08`	a year	crt.sh
www.google.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
6sc.co R3	`2024-01-29` - `2024-04-28`	3 months	crt.sh
chilipiper.com GoGetSSL RSA DV CA	`2024-02-05` - `2025-03-07`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-02` - `2024-05-01`	a year	crt.sh
*.github.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-02-16` - `2024-03-15`	a year	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2023-10-10` - `2024-09-19`	a year	crt.sh
tools.refokus.com R3	`2024-02-20` - `2024-05-20`	3 months	crt.sh
*.hubspotonwebflow.com R3	`2024-01-14` - `2024-04-13`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
drift.com Amazon RSA 2048 M02	`2023-08-15` - `2024-09-11`	a year	crt.sh
*.google.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.githubassets.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-28` - `2024-09-27`	a year	crt.sh
huntresscdn.com Cloudflare Inc ECC CA-3	`2023-05-10` - `2024-05-09`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
quora.com R3	`2024-01-07` - `2024-04-06`	3 months	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-21` - `2024-07-19`	a year	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 02	`2024-01-21` - `2024-06-27`	5 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-12-07` - `2024-03-06`	3 months	crt.sh
*.srv.stackadapt.com Amazon RSA 2048 M02	`2023-09-09` - `2024-10-07`	a year	crt.sh
*.hotjar.com Amazon ECDSA 256 M03	`2024-02-07` - `2025-03-08`	a year	crt.sh
neverbounce.com Amazon RSA 2048 M03	`2024-01-29` - `2025-02-25`	a year	crt.sh
*.metadata.io DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-29` - `2025-01-28`	a year	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-08` - `2024-07-06`	6 months	crt.sh
*.quora.com R3	`2023-12-17` - `2024-03-16`	3 months	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2024-01-06` - `2024-12-31`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.google.co.il GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
webhooks.fivetran.com R3	`2024-01-28` - `2024-04-27`	3 months	crt.sh
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-07` - `2025-01-06`	a year	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-31` - `2024-10-29`	a year	crt.sh
ibc-flow.techtarget.com GTS CA 1D4	`2024-01-13` - `2024-04-12`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-01-30` - `2024-07-30`	6 months	crt.sh
www.clarity.ms DigiCert TLS RSA SHA256 2020 CA1	`2023-12-07` - `2024-12-07`	a year	crt.sh
a.usbrowserspeed.com Amazon RSA 2048 M02	`2024-01-01` - `2025-01-29`	a year	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2024-01-15` - `2024-07-13`	6 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
edgestatic.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.googleusercontent.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
a.clarity.ms Microsoft Azure TLS Issuing CA 01	`2024-01-14` - `2024-06-27`	5 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2023-02-13` - `2024-03-15`	a year	crt.sh
*.drift.com Amazon RSA 2048 M01	`2023-07-03` - `2024-07-31`	a year	crt.sh
zi-scripts.com GTS CA 1P5	`2024-01-30` - `2024-04-29`	3 months	crt.sh
zoominfo.com E1	`2024-02-20` - `2024-05-20`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Frame ID: 137D9BE2AA554238C006F81F9F3E5CA1
Requests: 141 HTTP requests in this frame

Frame: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY&enablejsapi=1&origin=https%3A%2F%2Fwww.huntress.com
Frame ID: 552A40F064CD87CDA5E43FA0EBCDC110
Requests: 25 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LchEywUAAAAAAdAXlscEm7Kcb3DJ38pngRCQJsC&co=aHR0cHM6Ly93d3cuaHVudHJlc3MuY29tOjQ0Mw..&hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=normal&cb=h2nkydj1k8y7
Frame ID: 8E35EE815F7CEDF6BEB101CD1931F44D
Requests: 9 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6LchEywUAAAAAAdAXlscEm7Kcb3DJ38pngRCQJsC
Frame ID: E6DC968438DA6EDADB32507009BFD4EE
Requests: 3 HTTP requests in this frame

Frame: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Frame ID: FE57EA2C60AD635B9313B6C0D18BF3C9
Requests: 45 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Understanding the ConnectWise ScreenConnect CVE-2024-1709 & CVE-2024-1708 | Huntress Blog

Detected technologies

Ruby on Rails (Web Frameworks) Expand

Overall confidence: 75%
Detected patterns

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Slick (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

(?:/([\d.]+))?/slick(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

230
Requests

97 %
HTTPS

0 %
IPv6

53
Domains

79
Subdomains

69
IPs

4
Countries

5269 kB
Transfer

16988 kB
Size

62
Cookies

27 Outgoing links

These are links going to different origins than the main page.

URL: https://huntress.io/
Title: Partner Login

Search URL Search Domain Scan URL

URL: https://support.huntress.io/hc/en-us
Title: Support Documentation

Search URL Search Domain Scan URL

URL: https://assets-global.website-files.com/6579dd0b5f9a54376d296939/6598317ed13aaee7ad5b2b9b_CascadeTechnologies-CaseStudy.pdf

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Search URL Search Domain Scan URL

URL: https://twitter.com/share?url=https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Search URL Search Domain Scan URL

URL: http://www.reddit.com/submit?url=https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Search URL Search Domain Scan URL

URL: https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
Title: security advisory

Search URL Search Domain Scan URL

URL: https://gist.github.com/JohnHammond/fac42eefb1bb137d1d8b5707d67d6964/raw/b5a20fc9f6755de41955d529f85f39d11e77fb6d/gistfile1.txt
Title: view raw

Search URL Search Domain Scan URL

URL: https://gist.github.com/JohnHammond/fac42eefb1bb137d1d8b5707d67d6964#file-gistfile1-txt
Title: gistfile1.txt

Search URL Search Domain Scan URL

URL: https://github.com/
Title: GitHub

Search URL Search Domain Scan URL

URL: https://gist.github.com/JohnHammond/a1bf6c78769ea253e43326ca23d3c2b8/raw/2f12bda8ae4e324be4451ed2c04d3a23b52b4c62/SetupWizard.aspx.diff
Title: view raw

Search URL Search Domain Scan URL

URL: https://gist.github.com/JohnHammond/a1bf6c78769ea253e43326ca23d3c2b8#file-setupwizard-aspx-diff
Title: SetupWizard.aspx.diff

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/dotnet/api/system.web.httprequest.path?view=netframework-4.8.1
Title: MSDN documentation

Search URL Search Domain Scan URL

URL: https://gist.github.com/JohnHammond/ca3824104f47498768a5ccee49af95b3/raw/9e7333b7945ca8b5b5298c80cf72e04bef4ed69d/ScreenConnect.Core.dll.cs.diff
Title: view raw

Search URL Search Domain Scan URL

URL: https://gist.github.com/JohnHammond/ca3824104f47498768a5ccee49af95b3#file-screenconnect-core-dll-cs-diff
Title: ScreenConnect.Core.dll.cs.diff

Search URL Search Domain Scan URL

URL: https://gist.github.com/JohnHammond/16b19436045484ccf2aad539f31271ea/raw/9fee111c21c06f99b0896cdb5d8be1d36455265b/ScreenConnect.Server.dll.cs.diff
Title: view raw

Search URL Search Domain Scan URL

URL: https://gist.github.com/JohnHammond/16b19436045484ccf2aad539f31271ea#file-screenconnect-server-dll-cs-diff
Title: ScreenConnect.Server.dll.cs.diff

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
Title: Windows Event ID 4663

Search URL Search Domain Scan URL

URL: https://gist.github.com/JohnHammond/65cee24bc949be53e6744a84e78b7239/raw/50a4cb25e8d25b94b79a79f4bcaa807274ed506a/SetupWizard_sigma_rule.yml
Title: view raw

Search URL Search Domain Scan URL

URL: https://gist.github.com/JohnHammond/65cee24bc949be53e6744a84e78b7239#file-setupwizard_sigma_rule-yml
Title: SetupWizard_sigma_rule.yml

Search URL Search Domain Scan URL

URL: https://gist.github.com/JohnHammond/4bffa96fe54aa6c1cb35509e9d7ad0b1/raw/20ed93cac337bbb9cb085161e8bc36ed02d2b669/ScreenConnect_modification_sigma_rule.yml
Title: view raw

Search URL Search Domain Scan URL

URL: https://gist.github.com/JohnHammond/4bffa96fe54aa6c1cb35509e9d7ad0b1#file-screenconnect_modification_sigma_rule-yml
Title: ScreenConnect_modification_sigma_rule.yml

Search URL Search Domain Scan URL

URL: https://gist.github.com/JohnHammond/e07caff1b2d4526b7fabbecd63784258/raw/bebf1b7546a1b785990563fd424e076cccdc1360/SetupWizard_IIS_log.yara
Title: view raw

Search URL Search Domain Scan URL

URL: https://gist.github.com/JohnHammond/e07caff1b2d4526b7fabbecd63784258#file-setupwizard_iis_log-yara
Title: SetupWizard_IIS_log.yara

Search URL Search Domain Scan URL

URL: https://gist.github.com/JohnHammond/d6b7b067b300770636a585e1b42eddc7/raw/5c08f7ed85d99e1a20206500c353c681e29ffcbd/App_Extensions_sigma_rule.yml
Title: view raw

Search URL Search Domain Scan URL

URL: https://gist.github.com/JohnHammond/d6b7b067b300770636a585e1b42eddc7#file-app_extensions_sigma_rule-yml
Title: App_Extensions_sigma_rule.yml

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 112

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1709077100792&li_adsId=fefa79cb-efbe-4c2f-9db5-7409e0e7a5fb&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1709077100792&li_adsId=fefa79cb-efbe-4c2f-9db5-7409e0e7a5fb&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3281745%26time%3D1709077100792%26li_adsId%3Dfefa79cb-efbe-4c2f-9db5-7409e0e7a5fb%26url%3Dhttps%253A%252F%252Fwww.huntress.com%252Fblog%252Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1709077100792&li_adsId=fefa79cb-efbe-4c2f-9db5-7409e0e7a5fb&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass&cookiesTest=true&liSync=true

Request Chain 136

https://googleads.g.doubleclick.net/pagead/id HTTP 302
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

Request Chain 169

https://c.clarity.ms/c.gif HTTP 302
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=B383D687DAAE40348FAA08D31EE76F1F&RedC=c.clarity.ms&MXFR=1D426B4DAF3363AC0F3F7F7FAB336D43 HTTP 302
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=B383D687DAAE40348FAA08D31EE76F1F&MUID=1DC059F4C13F6EC3391F4DC6C0426FE0

230 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Show response
www.huntress.com/blog/ 109 KB
30 KB 610ms
195ms Document
text/html 63.35.51.142
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

63.35.51.142 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-63-35-51-142.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ed4da8d59696a378f7440bbbd1485c2ecf592dd09fbe8a03b01803a251ef1e03

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: he-IL,he;q=0.9

Response headers

accept-ranges: bytes
age: 6662
content-encoding: gzip
content-length: 29978
content-security-policy: frame-ancestors 'self'
content-type: text/html
date: Tue, 27 Feb 2024 23:38:18 GMT
referrer-policy: origin
vary: Accept-Encoding,x-wf-forwarded-proto
x-cache: MISS, HIT
x-cache-hits: 0, 1
x-cluster-name: eu-west-1-prod-hosting-red
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-lambda-id: 7b268b94-ccf9-4d4f-bdbc-acd54ee6d7e7
x-served-by: cache-iad-kcgs7200177-IAD, cache-dub4324-DUB
x-timer: S1709077099.768006,VS0,VE1
x-xss-protection: 1; mode=block

GET
H2 200 huntress-new.65f97142b.min.css
assets-global.website-files.com/6579dd0b5f9a54376d296915/css/ 318 KB
54 KB 382ms
133ms Stylesheet
text/css 13.225.78.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets-global.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.65f97142b.min.css
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-111.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cd8fd067e7bf84283f653e98980f7cc7c344f4a4777a2cdf5aa888e52678d487

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 21:49:00 GMT
content-encoding: gzip
via: 1.1 182ef5a8d12abb5df1553676864737b0.cloudfront.net (CloudFront)
x-amz-version-id: DP2IFnXwzkyp9wu.ZkTeL37eHySjb8ak
age: 6560
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 54347
last-modified: Tue, 27 Feb 2024 21:48:59 GMT
server: AmazonS3
etag: "85f2730dee7afb3398009ded7a80634f"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: iH7UyjExq6XI0tgsEVPjAuUbg4PHbv9wIH0fQktbIvBKgswu-HrIaQ==

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 1 KB
1 KB 369ms
124ms Script
text/javascript 216.58.206.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.36 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil07s07-in-f4.1e100.net

Software

GSE /

Resource Hash

b5c7dca4d4d058fb9d5be514d932f42554649242edfaa890898b5eb4c09b7c90

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Tue, 27 Feb 2024 23:38:19 GMT

GET
H2 200 8769192b-20ba-4df2-8d62-2740a805c3e8.js Show response
j.6sc.co/j/ 1002 B
911 B 769ms
515ms Script
application/javascript 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/j/8769192b-20ba-4df2-8d62-2740a805c3e8.js
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-184.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 215162d385055d4248ce3810f5294fb0e1a857b2b18997d00805ca98f480fc79

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-amz-version-id: UrRvP5epIIYMFKpHnUIiG3eAjq1aSOQ0
content-encoding: gzip
date: Tue, 27 Feb 2024 23:38:19 GMT
x-amz-cf-pop: FRA60-P1
x-amz-server-side-encryption: AES256
x-amz-meta-content-type: application/json
content-length: 511
pragma: no-cache
last-modified: Mon, 04 Dec 2023 23:24:23 GMT
server: AmazonS3
etag: "c6115ff14d497b0e4a2d9c497d7ad5d9"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
x-amz-cf-id: yj9X6OG9Eyio8eDZ4797lLpehV6U3z8ufAwPYEsB3PrATmu8sNvkrQ==
expires: Tue, 27 Feb 2024 23:38:19 GMT

GET
H2 200 marketing.js Show response
js.na.chilipiper.com/ 73 KB
25 KB 409ms
216ms Script
application/javascript 34.111.224.162
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://js.na.chilipiper.com/marketing.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.111.224.162 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

162.224.111.34.bc.googleusercontent.com

Software

Resource Hash

02c65a6d1cdc752f31b0be2157d9c6f65e72c7f3e781eea941bd848caf8a332e

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: data: wss://.chilipiper.com wss://.chilipiper.io wss://.chilipiper.cool wss://.chilipiper.team https://.chilipiper.com https://.chilipiper.io https://.chilipiper.cool https://.chilipiper.team https://www.google-analytics.com https://www.googletagmanager.com https://static2.sharepointonline.com https://ajax.aspnetcdn.com https://appsforoffice.microsoft.com https://.rollout.io https://.facebook.com https://.marketo.com https://.mixpanel.com https://.hubspot.com https://.pardot.com https://.getdrip.com https://.google.com https://.googleapis.com https://.hsforms.net https://.clearbit.com https://www.youtube.com https://s3.amazonaws.com https://sentry.io https://cdn.ravenjs.com https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://twemoji.maxcdn.com https://.cloudfront.net https://intercom-sheets.com https://static.intercomassets.com https://js.intercomcdn.com https://cdn.segment.com https://api.segment.io https://maxcdn.bootstrapcdn.com https://.intercom.io https://.mutinycdn.com https://.mutinyhq.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io https://.bugsnag.com https://zoom.us https://.gotomeeting.com https://.rollout.io https://.codox.io https://cdn.tiny.cloud https://js.stripe.com https://.zdassets.com https://.zendesk.com https://.zopim.com wss://chilipiper.zendesk.com wss://.zopim.com https://.googleusercontent.com https://.facebook.net https://.doubleclick.net https://.licdn.com https://.googleadservices.com https://.digitaloceanspaces.com https://.ingest.sentry.io https://canny.io/sdk.js https://changelog-widget.canny.io https://edge.fullstory.com https://rs.fullstory.com https://.lr-in-prod.com https://polyfill.io https://.planhat.com https://.sprig.com https://com-chilipiper-prod1.mini.snplow.net https://com-chilipiper-prod1.collector.snplow.net https://fast.chameleon.io https://js.chargify.com https://selfservice.maxio.com https://hooks.slack.com 'unsafe-inline'; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://fonts.gstatic.com https://fonts.googleapis.com https://js.intercomcdn.com; img-src data: blob: 'unsafe-inline';
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Security-Policy	default-src 'self' blob: data: wss://.chilipiper.com wss://.chilipiper.io wss://.chilipiper.cool wss://.chilipiper.team https://.chilipiper.com https://.chilipiper.io https://.chilipiper.cool https://.chilipiper.team https://www.google-analytics.com https://www.googletagmanager.com https://static2.sharepointonline.com https://ajax.aspnetcdn.com https://appsforoffice.microsoft.com https://.rollout.io https://.facebook.com https://.marketo.com https://.mixpanel.com https://.hubspot.com https://.pardot.com https://.getdrip.com https://.google.com https://.googleapis.com https://.hsforms.net https://.clearbit.com https://www.youtube.com https://s3.amazonaws.com https://sentry.io https://cdn.ravenjs.com https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://twemoji.maxcdn.com https://.cloudfront.net https://intercom-sheets.com https://static.intercomassets.com https://js.intercomcdn.com https://cdn.segment.com https://api.segment.io https://maxcdn.bootstrapcdn.com https://.intercom.io https://.mutinycdn.com https://.mutinyhq.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io https://.bugsnag.com https://zoom.us https://.gotomeeting.com https://.rollout.io https://.codox.io https://cdn.tiny.cloud https://js.stripe.com https://.zdassets.com https://.zendesk.com https://.zopim.com wss://chilipiper.zendesk.com wss://.zopim.com https://.googleusercontent.com https://.facebook.net https://.doubleclick.net https://.licdn.com https://.googleadservices.com https://.digitaloceanspaces.com https://.ingest.sentry.io https://canny.io/sdk.js https://changelog-widget.canny.io https://edge.fullstory.com https://rs.fullstory.com https://.lr-in-prod.com https://polyfill.io https://.planhat.com https://.sprig.com https://com-chilipiper-prod1.mini.snplow.net https://com-chilipiper-prod1.collector.snplow.net https://fast.chameleon.io https://js.chargify.com https://selfservice.maxio.com https://hooks.slack.com 'unsafe-inline'; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://fonts.gstatic.com https://fonts.googleapis.com https://js.intercomcdn.com; img-src data: blob: 'unsafe-inline';
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:19 GMT
content-encoding: gzip
via: 1.1 google
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
age: 1
content-security-policy: default-src 'self' blob: data: wss://*.chilipiper.com wss://*.chilipiper.io wss://*.chilipiper.cool wss://*.chilipiper.team https://*.chilipiper.com https://*.chilipiper.io https://*.chilipiper.cool https://*.chilipiper.team https://www.google-analytics.com https://www.googletagmanager.com https://static2.sharepointonline.com https://ajax.aspnetcdn.com https://appsforoffice.microsoft.com https://*.rollout.io https://*.facebook.com https://*.marketo.com https://*.mixpanel.com https://*.hubspot.com https://*.pardot.com https://*.getdrip.com https://*.google.com https://*.googleapis.com https://*.hsforms.net https://*.clearbit.com https://www.youtube.com https://s3.amazonaws.com https://sentry.io https://cdn.ravenjs.com https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://twemoji.maxcdn.com https://*.cloudfront.net https://intercom-sheets.com https://static.intercomassets.com https://js.intercomcdn.com https://cdn.segment.com https://api.segment.io https://maxcdn.bootstrapcdn.com https://*.intercom.io https://*.mutinycdn.com https://*.mutinyhq.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io https://*.bugsnag.com https://zoom.us https://*.gotomeeting.com https://*.rollout.io https://*.codox.io https://cdn.tiny.cloud https://js.stripe.com https://*.zdassets.com https://*.zendesk.com https://*.zopim.com wss://chilipiper.zendesk.com wss://*.zopim.com https://*.googleusercontent.com https://*.facebook.net https://*.doubleclick.net https://*.licdn.com https://*.googleadservices.com https://*.digitaloceanspaces.com https://*.ingest.sentry.io https://canny.io/sdk.js https://changelog-widget.canny.io https://edge.fullstory.com https://rs.fullstory.com https://*.lr-in-prod.com https://polyfill.io https://*.planhat.com https://*.sprig.com https://com-chilipiper-prod1.mini.snplow.net https://com-chilipiper-prod1.collector.snplow.net https://fast.chameleon.io https://js.chargify.com https://selfservice.maxio.com https://hooks.slack.com 'unsafe-inline'; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://fonts.gstatic.com https://fonts.googleapis.com https://js.intercomcdn.com; img-src * data: blob: 'unsafe-inline';
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22403
x-xss-protection: 1; mode=block
referrer-policy: origin-when-cross-origin
last-modified: Mon, 19 Feb 2024 02:04:51 GMT
etag: W/"65d2b743-122e0"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=0, s-maxage=60, must-revalidate
x-cache-hit: revalidated
x-content-security-policy: default-src 'self' blob: data: wss://*.chilipiper.com wss://*.chilipiper.io wss://*.chilipiper.cool wss://*.chilipiper.team https://*.chilipiper.com https://*.chilipiper.io https://*.chilipiper.cool https://*.chilipiper.team https://www.google-analytics.com https://www.googletagmanager.com https://static2.sharepointonline.com https://ajax.aspnetcdn.com https://appsforoffice.microsoft.com https://*.rollout.io https://*.facebook.com https://*.marketo.com https://*.mixpanel.com https://*.hubspot.com https://*.pardot.com https://*.getdrip.com https://*.google.com https://*.googleapis.com https://*.hsforms.net https://*.clearbit.com https://www.youtube.com https://s3.amazonaws.com https://sentry.io https://cdn.ravenjs.com https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://twemoji.maxcdn.com https://*.cloudfront.net https://intercom-sheets.com https://static.intercomassets.com https://js.intercomcdn.com https://cdn.segment.com https://api.segment.io https://maxcdn.bootstrapcdn.com https://*.intercom.io https://*.mutinycdn.com https://*.mutinyhq.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io https://*.bugsnag.com https://zoom.us https://*.gotomeeting.com https://*.rollout.io https://*.codox.io https://cdn.tiny.cloud https://js.stripe.com https://*.zdassets.com https://*.zendesk.com https://*.zopim.com wss://chilipiper.zendesk.com wss://*.zopim.com https://*.googleusercontent.com https://*.facebook.net https://*.doubleclick.net https://*.licdn.com https://*.googleadservices.com https://*.digitaloceanspaces.com https://*.ingest.sentry.io https://canny.io/sdk.js https://changelog-widget.canny.io https://edge.fullstory.com https://rs.fullstory.com https://*.lr-in-prod.com https://polyfill.io https://*.planhat.com https://*.sprig.com https://com-chilipiper-prod1.mini.snplow.net https://com-chilipiper-prod1.collector.snplow.net https://fast.chameleon.io https://js.chargify.com https://selfservice.maxio.com https://hooks.slack.com 'unsafe-inline'; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://fonts.gstatic.com https://fonts.googleapis.com https://js.intercomcdn.com; img-src * data: blob: 'unsafe-inline';

GET
H2 200 slick.css
cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/ 2 KB
1 KB 204ms
67ms Stylesheet
text/css 104.16.88.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/slick.css

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.88.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

de1e399b07289f3b0a8d35142e363e128124a1185770e214e25e58030dad48e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 8721359
x-jsd-version: 1.8.1
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-etou8220022-FRA, cache-mrs10545-MRS
x-jsd-version-type: version
server: cloudflare
etag: W/"6f0-qUoFmzF4tK3sCeMoGs4oGaMAlaQ"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lo%2FOCEcXtG3%2FQ8JQAeBtOG%2F4y%2F5YC4xV%2F3NhCXCSVJS07CU7e33JD30DlCntaAss4N%2FDN6lPAOFqR20E3XZNsNeHShZv9shvS5qkSyIDbkcB8R%2FWjdRfghHIFvNy0l2bHhc%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 85c442bd2c60e3ed-TLV

GET
H2 200 swiper-bundle.min.css
cdn.jsdelivr.net/npm/swiper@11/ 18 KB
5 KB 210ms
73ms Stylesheet
text/css 104.16.88.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/swiper@11/swiper-bundle.min.css

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.88.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3db9c167e90b10ff974e1efce11fc76330279b2e282df0a6c0a42e56bbf4f68b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 12459
x-jsd-version: 11.0.7
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230090-FRA, cache-lga21930-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"4804-9Ox7ybXgq1M3GrSkOOhjQhvgt6s"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GxbUHmWx034iTtF27jVL1VOUkFZC5Kpu3%2FiL2XCfL3rWtIjlttNMdkoBBSimgKdS17%2BFqJ83Uh11at5nYK1gNRUtzZWbP1HRaMX29QhkIzv%2BsbgSPqpoSS4DaTRBtZgLK1I%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 85c442bd2c66e3ed-TLV

GET
H2 200 richtext.js Show response
cdn.jsdelivr.net/npm/@finsweet/attributes-richtext@1/ 8 KB
4 KB 74ms
72ms Script
application/javascript 104.16.88.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@finsweet/attributes-richtext@1/richtext.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.88.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2c699eb55ae3fe61b3d783c8936ab1eb949c596a5c89118f703e328ede2b8308

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 5005
x-jsd-version: 1.10.2
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-etou8220054-FRA, cache-mrs10563-MRS
x-jsd-version-type: version
server: cloudflare
etag: W/"2147-I41v+oq443LPQB6aPqMil27q9QY"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PfIdkcrMzXRAPUgVQ4LDKzg27GH4zBFmHDfxx72EMx3InRhn543jh0fLuSb3Zckb8TLg1E3exwzopQxNzWJxFY%2Bg0KXLgA%2FnJNLQkcb2IWdaN%2FEilBlcqSgBd6ldQZ%2Bak3s%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 85c442c12b02e3ed-TLV

GET
H2 200 fac42eefb1bb137d1d8b5707d67d6964.js Show response
gist.github.com/JohnHammond/ 13 KB
6 KB 485ms
244ms Script
text/javascript 140.82.121.3
GITHUB

General

Check archive.org

Show headers Download Go to

Full URL

https://gist.github.com/JohnHammond/fac42eefb1bb137d1d8b5707d67d6964.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

140.82.121.3 Frankfurt am Main, Germany, ASN36459 (GITHUB, US),

Reverse DNS

lb-140-82-121-3-fra.github.com

Software

GitHub.com /

Resource Hash

2a33dce92d031e437387a6e75f9c8b44785fe76324b5f4e6daf179e9427d0a0b

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com api.githubcopilot.com objects-origin.githubusercontent.com .actions.githubusercontent.com wss://.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:19 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-content-type-options: nosniff
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com api.githubcopilot.com objects-origin.githubusercontent.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
content-length: 1904
x-xss-protection: 0
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
server: GitHub.com
x-github-request-id: 6446:31395D:17B237B:1814146:65DE726B
etag: W/"2a33dce92d031e437387a6e75f9c8b44"
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
x-frame-options: deny
content-type: text/javascript; charset=utf-8
cache-control: max-age=0, private, must-revalidate
accept-ranges: bytes

GET
H2 200 a1bf6c78769ea253e43326ca23d3c2b8.js Show response
gist.github.com/JohnHammond/ 7 KB
6 KB 493ms
265ms Script
text/javascript 140.82.121.3
GITHUB

General

Check archive.org

Show headers Download Go to

Full URL

https://gist.github.com/JohnHammond/a1bf6c78769ea253e43326ca23d3c2b8.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

140.82.121.3 Frankfurt am Main, Germany, ASN36459 (GITHUB, US),

Reverse DNS

lb-140-82-121-3-fra.github.com

Software

GitHub.com /

Resource Hash

67b21e62c1980c312509a7fd0475ffe52ee546a1014f4506ec113fab10a1f09e

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com api.githubcopilot.com objects-origin.githubusercontent.com .actions.githubusercontent.com wss://.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:19 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-content-type-options: nosniff
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com api.githubcopilot.com objects-origin.githubusercontent.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
content-length: 1649
x-xss-protection: 0
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
server: GitHub.com
x-github-request-id: 6446:31395D:17B237C:1814147:65DE726B
etag: W/"67b21e62c1980c312509a7fd0475ffe5"
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
x-frame-options: deny
content-type: text/javascript; charset=utf-8
cache-control: max-age=0, private, must-revalidate
accept-ranges: bytes

GET
H2 200 65d558784370931755195cac_VOF-6GVi8aXEkUnXg6QMpJKg-y8tK8X8wOzr8vpiZr_zsnrQ1-UW6sUxmPiI-pnhlH9p0AaCEsGVqrqIPEEjzdtn1RgshZH8XoaYV118B5SJaZlF4D_KSNMJszRFzGhxjQnjBtSdwnhn786MYYrs8PI.png
assets-global.website-files.com/6579dd0b5f9a54376d296939/ 431 KB
432 KB 462ms
229ms Image
image/png 13.225.78.111
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6579dd0b5f9a54376d296939/65d558784370931755195cac_VOF-6GVi8aXEkUnXg6QMpJKg-y8tK8X8wOzr8vpiZr_zsnrQ1-UW6sUxmPiI-pnhlH9p0AaCEsGVqrqIPEEjzdtn1RgshZH8XoaYV118B5SJaZlF4D_KSNMJszRFzGhxjQnjBtSdwnhn786MYYrs8PI.png
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-111.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f6de8eff2f2f46b4d3e24716caa22af17db498dfbbc0ae5e984d7ea8b098f7d8

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-amz-version-id: v71bzVi68kUfwlP2si3pxThQxfSbrhOh
date: Tue, 27 Feb 2024 06:30:18 GMT
via: 1.1 182ef5a8d12abb5df1553676864737b0.cloudfront.net (CloudFront)
age: 75992
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 441368
last-modified: Wed, 21 Feb 2024 01:57:13 GMT
server: AmazonS3
etag: "8cf7ad894b14452a1f39733cbcb60e63"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: K3iSu99KtLO1H2ecToeWkNciQv-U5lJhr8NESNIubJPhM2wZGpnkCg==

GET
H2 200 65d5587895aab08ada261523_5o-p55Z5UH6spdxDIaiuiwTL9pVNZXaiwYCUp_mSsxn5z2xDpK5Gw_o-o3ftPbQ7VWbSHYopNTqSimVy3lDSLfLGwHVzAfoGW9N1HJWh2dZFb5cpxoqI6tiihUgtb81vYtMTJUT6-f3byU3q8g8krbU.png
assets-global.website-files.com/6579dd0b5f9a54376d296939/ 51 KB
51 KB 616ms
383ms Image
image/png 13.225.78.111
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6579dd0b5f9a54376d296939/65d5587895aab08ada261523_5o-p55Z5UH6spdxDIaiuiwTL9pVNZXaiwYCUp_mSsxn5z2xDpK5Gw_o-o3ftPbQ7VWbSHYopNTqSimVy3lDSLfLGwHVzAfoGW9N1HJWh2dZFb5cpxoqI6tiihUgtb81vYtMTJUT6-f3byU3q8g8krbU.png
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-111.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4e938e5b4fe364bd2d00ec08067f98aa54b1398df28287257b8434012ff20033

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-amz-version-id: 6jQ5D_RGwWcrzEAPJSWxDsiDOzmQIgzE
date: Tue, 27 Feb 2024 06:44:46 GMT
via: 1.1 182ef5a8d12abb5df1553676864737b0.cloudfront.net (CloudFront)
age: 61001
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 51779
last-modified: Wed, 21 Feb 2024 01:57:13 GMT
server: AmazonS3
etag: "b3334d2b33ad117de65ee35d5c959a07"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: jq6aJXoM9eAcMVDm9OwpzccI8sITJ2uMDKFWmVxBdpnmS44NAJIDMQ==

GET
H2 200 65d55879cb2af12170f04f97_Es0JkQJKuG-5DjiEiOOfDGEQKAHS8dBwPDRCXqlN72QDQ733637nICPRUkYkJ6TA3JyCaZFTEw5a6dezq4jWGGXwyhFfOG4mpm40MNYMWR7rH-OXO8tepHjgTJbWCQUwRWt0TQ79MJbSTcioXS5mWkQ.png
assets-global.website-files.com/6579dd0b5f9a54376d296939/ 257 KB
258 KB 114ms
112ms Image
image/png 13.225.78.111
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6579dd0b5f9a54376d296939/65d55879cb2af12170f04f97_Es0JkQJKuG-5DjiEiOOfDGEQKAHS8dBwPDRCXqlN72QDQ733637nICPRUkYkJ6TA3JyCaZFTEw5a6dezq4jWGGXwyhFfOG4mpm40MNYMWR7rH-OXO8tepHjgTJbWCQUwRWt0TQ79MJbSTcioXS5mWkQ.png
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-111.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 67786077050307fcffb9795d3f5fd2a2e5d3956e692181609fee98693604d321

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-amz-version-id: mm_tv6ya.xbyiKsK3wBuhJlKMytTlvWx
date: Tue, 27 Feb 2024 06:30:18 GMT
via: 1.1 182ef5a8d12abb5df1553676864737b0.cloudfront.net (CloudFront)
age: 65012
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 262979
last-modified: Wed, 21 Feb 2024 01:57:15 GMT
server: AmazonS3
etag: "fe66f6692ba22e7b01168f78fdbe06ca"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: Ay68Lsc7b8YSPVeRnElEprqzfG_mTxZVZyAwFBe1GL4X5-fJ3_b33Q==

GET
H2 200 65d5587816961aa1bccf46e7_bCQT10Rn49nJ0hfB4GAkkb3XEvxwdyo-gxNYZzVtE5K9v1nQmjWbCW6OHPdS9wTnTRGJ0KpH_LH0d1YY_Ignr_zFKfRs9BqM1SpJfeox48WDpKIdDgOhJ6d_n947AQK1p4PqR0fxL7-LawYoIVNYcys.png
assets-global.website-files.com/6579dd0b5f9a54376d296939/ 129 KB
129 KB 115ms
114ms Image
image/png 13.225.78.111
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6579dd0b5f9a54376d296939/65d5587816961aa1bccf46e7_bCQT10Rn49nJ0hfB4GAkkb3XEvxwdyo-gxNYZzVtE5K9v1nQmjWbCW6OHPdS9wTnTRGJ0KpH_LH0d1YY_Ignr_zFKfRs9BqM1SpJfeox48WDpKIdDgOhJ6d_n947AQK1p4PqR0fxL7-LawYoIVNYcys.png
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-111.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b9662a50703853ca2a318262d930668b8ae42333c6b413a424d0296212c40865

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-amz-version-id: HLK6RtJwr1ieEvG8Jkdr7dxZo2M8q5xZ
date: Tue, 27 Feb 2024 05:16:55 GMT
via: 1.1 182ef5a8d12abb5df1553676864737b0.cloudfront.net (CloudFront)
age: 69171
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 131679
last-modified: Wed, 21 Feb 2024 01:57:13 GMT
server: AmazonS3
etag: "0924c3aca52f1ea982d08401916c51af"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: rZbDru4GhukTyBkyjDnRwDe7hpOL1YUxHGkcETOXDUGVGqaIikMumw==

GET
H2 200 ca3824104f47498768a5ccee49af95b3.js Show response
gist.github.com/JohnHammond/ 7 KB
5 KB 243ms
243ms Script
text/javascript 140.82.121.3
GITHUB

General

Check archive.org

Show headers Download Go to

Full URL

https://gist.github.com/JohnHammond/ca3824104f47498768a5ccee49af95b3.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

140.82.121.3 Frankfurt am Main, Germany, ASN36459 (GITHUB, US),

Reverse DNS

lb-140-82-121-3-fra.github.com

Software

GitHub.com /

Resource Hash

e0360227c48e1c8334b6adb5cdd071c93d5324b6b2860b82f261e69c6c93d561

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com api.githubcopilot.com objects-origin.githubusercontent.com .actions.githubusercontent.com wss://.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:19 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-content-type-options: nosniff
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com api.githubcopilot.com objects-origin.githubusercontent.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
content-length: 1590
x-xss-protection: 0
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
server: GitHub.com
x-github-request-id: 6446:31395D:17B24DD:18142A9:65DE726B
etag: W/"e0360227c48e1c8334b6adb5cdd071c9"
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
x-frame-options: deny
content-type: text/javascript; charset=utf-8
cache-control: max-age=0, private, must-revalidate
accept-ranges: bytes

GET
H2 200 16b19436045484ccf2aad539f31271ea.js Show response
gist.github.com/JohnHammond/ 6 KB
5 KB 283ms
278ms Script
text/javascript 140.82.121.3
GITHUB

General

Check archive.org

Show headers Download Go to

Full URL

https://gist.github.com/JohnHammond/16b19436045484ccf2aad539f31271ea.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

140.82.121.3 Frankfurt am Main, Germany, ASN36459 (GITHUB, US),

Reverse DNS

lb-140-82-121-3-fra.github.com

Software

GitHub.com /

Resource Hash

ebde95e07992c2e57ae18f8badfad62c3263a6baeda6c9bb05cfe642f69ef459

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com api.githubcopilot.com objects-origin.githubusercontent.com .actions.githubusercontent.com wss://.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:19 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-content-type-options: nosniff
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com api.githubcopilot.com objects-origin.githubusercontent.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
content-length: 1525
x-xss-protection: 0
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
server: GitHub.com
x-github-request-id: 6446:31395D:17B24E7:18142B5:65DE726B
etag: W/"ebde95e07992c2e57ae18f8badfad62c"
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
x-frame-options: deny
content-type: text/javascript; charset=utf-8
cache-control: max-age=0, private, must-revalidate
accept-ranges: bytes

GET
H2 200 65d55878e0bce79d5469d328_3UiSOzyngYMkZ2TqaT488ZZgGjEPTdpHFOHkPvUScU7z6Jt6uD9hGkaoWVJ8fI1IIO0FNuU_UaNbwPZ6Um9h1WGtQhkSWMxcosQz0KFHj3JgrbVAQ7sIzu8kQ-DuLMcQIS-Cj1aTMKfDCygOuW_R_rk.png
assets-global.website-files.com/6579dd0b5f9a54376d296939/ 126 KB
126 KB 117ms
112ms Image
image/png 13.225.78.111
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6579dd0b5f9a54376d296939/65d55878e0bce79d5469d328_3UiSOzyngYMkZ2TqaT488ZZgGjEPTdpHFOHkPvUScU7z6Jt6uD9hGkaoWVJ8fI1IIO0FNuU_UaNbwPZ6Um9h1WGtQhkSWMxcosQz0KFHj3JgrbVAQ7sIzu8kQ-DuLMcQIS-Cj1aTMKfDCygOuW_R_rk.png
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-111.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a447d3663b55765c353cd2d4067634356183f5589b5af36e703e452926669f0e

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-amz-version-id: 76ZcbiQupQpThW9hu3TeyeQensofWkN9
date: Tue, 27 Feb 2024 05:16:55 GMT
via: 1.1 182ef5a8d12abb5df1553676864737b0.cloudfront.net (CloudFront)
age: 69171
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 128530
last-modified: Wed, 21 Feb 2024 01:57:13 GMT
server: AmazonS3
etag: "9f1e03c5de811d7a19dba9af2be6fab3"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: Gr1FZ6hm3zYVcLZFOiepdNLhnqc32VNcYscIH6-QVfg8wq3qsfBhCA==

GET
H2 200 65cee24bc949be53e6744a84e78b7239.js Show response
gist.github.com/JohnHammond/ 12 KB
6 KB 289ms
284ms Script
text/javascript 140.82.121.3
GITHUB

General

Check archive.org

Show headers Download Go to

Full URL

https://gist.github.com/JohnHammond/65cee24bc949be53e6744a84e78b7239.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

140.82.121.3 Frankfurt am Main, Germany, ASN36459 (GITHUB, US),

Reverse DNS

lb-140-82-121-3-fra.github.com

Software

GitHub.com /

Resource Hash

9bcad26a447cbeb43523bd54477bc26548e4932086610e251d302f57af1ab93c

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com api.githubcopilot.com objects-origin.githubusercontent.com .actions.githubusercontent.com wss://.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:19 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-content-type-options: nosniff
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com api.githubcopilot.com objects-origin.githubusercontent.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
content-length: 2169
x-xss-protection: 0
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
server: GitHub.com
x-github-request-id: 6446:31395D:17B24E7:18142B6:65DE726B
etag: W/"9bcad26a447cbeb43523bd54477bc265"
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
x-frame-options: deny
content-type: text/javascript; charset=utf-8
cache-control: max-age=0, private, must-revalidate
accept-ranges: bytes

GET
H2 200 4bffa96fe54aa6c1cb35509e9d7ad0b1.js Show response
gist.github.com/JohnHammond/ 16 KB
6 KB 242ms
237ms Script
text/javascript 140.82.121.3
GITHUB

General

Check archive.org

Show headers Download Go to

Full URL

https://gist.github.com/JohnHammond/4bffa96fe54aa6c1cb35509e9d7ad0b1.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

140.82.121.3 Frankfurt am Main, Germany, ASN36459 (GITHUB, US),

Reverse DNS

lb-140-82-121-3-fra.github.com

Software

GitHub.com /

Resource Hash

7a0a3edf7292523aa8dd079542a633cbd45eb882d6aebb4cacfe4b97f9601e97

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com api.githubcopilot.com objects-origin.githubusercontent.com .actions.githubusercontent.com wss://.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:19 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-content-type-options: nosniff
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com api.githubcopilot.com objects-origin.githubusercontent.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
content-length: 2536
x-xss-protection: 0
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
server: GitHub.com
x-github-request-id: 6446:31395D:17B24E7:18142B7:65DE726B
etag: W/"7a0a3edf7292523aa8dd079542a633cb"
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
x-frame-options: deny
content-type: text/javascript; charset=utf-8
cache-control: max-age=0, private, must-revalidate
accept-ranges: bytes

GET
H2 200 e07caff1b2d4526b7fabbecd63784258.js Show response
gist.github.com/JohnHammond/ 10 KB
6 KB 254ms
249ms Script
text/javascript 140.82.121.3
GITHUB

General

Check archive.org

Show headers Download Go to

Full URL

https://gist.github.com/JohnHammond/e07caff1b2d4526b7fabbecd63784258.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

140.82.121.3 Frankfurt am Main, Germany, ASN36459 (GITHUB, US),

Reverse DNS

lb-140-82-121-3-fra.github.com

Software

GitHub.com /

Resource Hash

389070ccfb044fe066247777f8f7d7177d7f1add5ac4d84a63e376a010a1f556

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com api.githubcopilot.com objects-origin.githubusercontent.com .actions.githubusercontent.com wss://.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:19 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-content-type-options: nosniff
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com api.githubcopilot.com objects-origin.githubusercontent.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
content-length: 1979
x-xss-protection: 0
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
server: GitHub.com
x-github-request-id: 6446:31395D:17B24E7:18142B8:65DE726B
etag: W/"389070ccfb044fe066247777f8f7d717"
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
x-frame-options: deny
content-type: text/javascript; charset=utf-8
cache-control: max-age=0, private, must-revalidate
accept-ranges: bytes

GET
H2 200 d6b7b067b300770636a585e1b42eddc7.js Show response
gist.github.com/JohnHammond/ 17 KB
6 KB 261ms
257ms Script
text/javascript 140.82.121.3
GITHUB

General

Check archive.org

Show headers Download Go to

Full URL

https://gist.github.com/JohnHammond/d6b7b067b300770636a585e1b42eddc7.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

140.82.121.3 Frankfurt am Main, Germany, ASN36459 (GITHUB, US),

Reverse DNS

lb-140-82-121-3-fra.github.com

Software

GitHub.com /

Resource Hash

77eda3beb67865c89e220f909e24c8624f05e107c82649a2165c8ba116e99f12

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com api.githubcopilot.com objects-origin.githubusercontent.com .actions.githubusercontent.com wss://.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:19 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-content-type-options: nosniff
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com api.githubcopilot.com objects-origin.githubusercontent.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
content-length: 2611
x-xss-protection: 0
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
server: GitHub.com
x-github-request-id: 6446:31395D:17B24E7:18142B9:65DE726B
etag: W/"77eda3beb67865c89e220f909e24c862"
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
x-frame-options: deny
content-type: text/javascript; charset=utf-8
cache-control: max-age=0, private, must-revalidate
accept-ranges: bytes

GET
H2 200 jquery-3.5.1.min.dc5e7f18c8.js Show response
d3e54v103j8qbb.cloudfront.net/js/ 87 KB
31 KB 362ms
132ms Script
application/javascript 52.222.232.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=6579dd0b5f9a54376d296915
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.232.144 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-232-144.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer: https://www.huntress.com/
Origin: https://www.huntress.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 05:57:06 GMT
content-encoding: gzip
via: 1.1 10f3c0984ab3eaba3e5720ed830a77b6.cloudfront.net (CloudFront)
age: 63674
x-amz-cf-pop: FRA56-P4
x-cache: Hit from cloudfront
last-modified: Mon, 20 Jul 2020 17:53:02 GMT
server: AmazonS3
etag: W/"dc5e7f18c8d36ac1d3d4753a87c98d0a"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
vary: Accept-Encoding
x-amz-cf-id: ZF5tj1Che6KGuery2dRYrYn5DEC_XWNPk1U5BcRsaJ2p1dO9MNSOPQ==

GET
H2 200 huntress-new.ddd87a2b9.js Show response
assets-global.website-files.com/6579dd0b5f9a54376d296915/js/ 1 MB
204 KB 125ms
121ms Script
text/javascript 13.225.78.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets-global.website-files.com/6579dd0b5f9a54376d296915/js/huntress-new.ddd87a2b9.js
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-111.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0f596cb38dc72ae999b1a7d5dcd3cb1b1b2c99dc27486943e52f08d32c8dfb18

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-amz-version-id: VquucxmSLTnKkRQIdRs5Zm0qBxCEqFqT
content-encoding: gzip
via: 1.1 182ef5a8d12abb5df1553676864737b0.cloudfront.net (CloudFront)
date: Tue, 27 Feb 2024 04:08:52 GMT
age: 70292
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 208414
last-modified: Sat, 24 Feb 2024 21:27:58 GMT
server: AmazonS3
etag: "3b848ebb12ef682b9042de28c95a5a46"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: viZRqRHCKfhmj9AfEnIxyoO89lFE7hvv8xG-wMzPEFXHdHrlERL8sg==

GET
H2 200 3911692.js Show response
js.hs-scripts.com/ 3 KB
1 KB 538ms
407ms Script
application/javascript 104.16.190.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/3911692.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.190.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

33b900fc8ec76da783f8a7aa7bc711f70f8f09704d13126c7e0454064b162f71

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:20 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 5f81d291-6a59-4e11-97e3-7d1b72925633
x-envoy-upstream-service-time: 4
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 5f81d291-6a59-4e11-97e3-7d1b72925633
last-modified: Tue, 27 Feb 2024 22:52:00 GMT
server: cloudflare
x-trace: 2BEC377601C6E056EAC04B05EF080CC16E69E27A96000000000000000000
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://www.huntress.com
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-59d6fb747d-74cm7
access-control-allow-credentials: true
cache-control: public, max-age=90
cf-ray: 85c442c1fd37e3c7-TLV
expires: Tue, 27 Feb 2024 23:39:50 GMT

GET
H2 200 swiper-bundle.min.js Show response
cdn.jsdelivr.net/npm/swiper@11/ 145 KB
42 KB 96ms
94ms Script
application/javascript 104.16.88.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/swiper@11/swiper-bundle.min.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.88.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aa8b379f14b0d120d8c9a72effcf7c718ba150d23e37420eaa441c628e42d1ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 11424
x-jsd-version: 11.0.6
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-etou8220075-FRA, cache-lga21926-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"245c4-1IpMOwjrIUviy3373dAv2gdmak0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NL50axrCf%2FTGGBQzAsID2wOqzA%2BK71uUe8C4S94qS8NQ8LjllUmmLFT2XNAbuKCCaw%2BuBc6v4jcPc4%2F8uGw%2F9hR0xUCL%2BnjPoD188mzNZ35idhSOv1V5IuO1WclDL89ocyM%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 85c442c12b04e3ed-TLV

GET
H2 200 slick.min.js Show response
cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/ 42 KB
11 KB 80ms
78ms Script
application/javascript 104.16.88.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/slick.min.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.88.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c7178cc6ca34fb18e30f070a5e7a1c287b2d7ccfcba2cfdf06e0f46eda55740

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 2192587
x-jsd-version: 1.8.1
content-encoding: br
x-cache: MISS, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230096-FRA, cache-lga21934-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"a76f-O0GzvJVmhQFaNHoiOOcdsp36Dbs"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9slT50iK4r0vzzuh3RHfH1FrzCpZ3%2B6YmWuFRL4qebkHPO5G9wPUpcPZ6ysZ4VnD8l2wJgJ3kZh7CObRKWaVzW6DxS3KWt4W3qc7Law85d8iiY9V2RBwJLTEL%2Fjk5jEX68c%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 85c442c12b05e3ed-TLV

GET
H2 200 bundle.v1.0.0.js Show response
tools.refokus.com/rich-text-enhancer/ 2 KB
1 KB 365ms
119ms Script
application/javascript 76.76.21.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tools.refokus.com/rich-text-enhancer/bundle.v1.0.0.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.98 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

a577cc713533d7a1edbc5186c3f7b8788bbf317a857111150778d6a617220cec

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:19 GMT
content-encoding: br
strict-transport-security: max-age=63072000
server: Vercel
x-vercel-id: fra1::6tp92-1709077099975-e1b0b024e214
age: 2893116
etag: W/"bfd9ff53d0c1baa43dbb0f44751f23e9"
x-vercel-cache: HIT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
content-disposition: inline; filename="bundle.v1.0.0.js"

GET
H2 200 medium-zoom.min.js Show response
cdn.jsdelivr.net/npm/medium-zoom@1.0.3/dist/ 9 KB
3 KB 71ms
67ms Script
application/javascript 104.16.88.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/medium-zoom@1.0.3/dist/medium-zoom.min.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.88.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

89aa43cb2db8717165e898b18806ad757585f8815f9f514bb0afbd3c390def95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1700945
x-jsd-version: 1.0.3
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-etou8220020-FRA, cache-lga21964-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"2408-5ck9kUxd8AglB+1wj1aqAh/vLDs"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BtWtKx%2BQ3jHZC15gPJXZhag%2BudWHeuY8Ix3te2epDIDDBPF4bCZBCh2YEmoOYa5I6vEA9q3%2B32rKD3a70gfJbd32%2FhAKCZKXsrDFQu88dS4MN7EzG4HyTnn4l2ysZ6mknkg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 85c442c12b00e3ed-TLV

GET
H2 200 form-123.js Show response
hubspotonwebflow.com/assets/js/ 12 KB
2 KB 397ms
156ms Script
application/javascript 76.76.21.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://hubspotonwebflow.com/assets/js/form-123.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.22 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

8323a2d9c9e1f89ab87c4463fccb464202b4990a9a7b235f7e056b0689b135f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://www.huntress.com/
Origin: https://www.huntress.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:20 GMT
content-encoding: br
strict-transport-security: max-age=63072000
server: Vercel
x-vercel-id: fra1::rrbzr-1709077099971-472658da12d1
age: 205
x-matched-path: /assets/js/form-123.js
etag: W/"45a5b8fce72454a16ad1f1ebaf6d1feb"
x-vercel-cache: HIT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
content-disposition: inline; filename="form-123.js"

GET
H2 200 6579dd0b5f9a54376d296915%2F6470f5217e03b0faa8a404de%2F658a9a0642f212b4ef59b0b2%2Fhs_trackcode_3911692-1.0.6.js Show response
assets-global.website-files.com/ 144 B
626 B 137ms
135ms Script
application/javascript 13.225.78.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets-global.website-files.com/6579dd0b5f9a54376d296915%2F6470f5217e03b0faa8a404de%2F658a9a0642f212b4ef59b0b2%2Fhs_trackcode_3911692-1.0.6.js
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-111.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6ee38878cd3f57c918114ecd1a74bc75e5165f45fd1e9503056e8dc2e542288f

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-amz-version-id: fKVYVp7VLozdKwo7Gp68VwPn_1qCAcOV
content-encoding: gzip
via: 1.1 182ef5a8d12abb5df1553676864737b0.cloudfront.net (CloudFront)
date: Tue, 27 Feb 2024 23:38:19 GMT
age: 78357
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 131
last-modified: Tue, 26 Dec 2023 09:16:55 GMT
server: AmazonS3
etag: "94d95acc94c6624c39cb9873e3da3787"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: xhFuF-WK4xnzyOphTn7lvcQBji4aJQMePvzdEQ1Lxbz6e8MYW0GAjw==

GET
H2 200 recaptcha__iw.js Show response
www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/ 518 KB
199 KB 364ms
114ms Script
text/javascript 142.250.185.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__iw.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f3.1e100.net

Software

sffe /

Resource Hash

e5724b80dd7456460f12db0a8870676b40184fa7076eb751afb23be11164719c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.huntress.com/
Origin: https://www.huntress.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 09:02:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52520
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 203025
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 05:01:55 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 26 Feb 2025 09:02:59 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 311 KB
100 KB 366ms
133ms Script
application/javascript 142.250.186.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

f87a1bbd0c50fc599544d3ccfad1c7bb1509f7b7eaa2d814dd700f6427fc6ac1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:19 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 101604
x-xss-protection: 0
last-modified: Tue, 27 Feb 2024 22:15:49 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 27 Feb 2024 23:38:19 GMT

GET
H2 200 6si.min.js Show response
j.6sc.co/ 64 KB
18 KB 137ms
136ms Script
application/javascript 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/j/8769192b-20ba-4df2-8d62-2740a805c3e8.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

8c1781ec4483c6fb3bd9ad005d312800eaf24e232c12976624bff84f8ab908b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Feb 2024 23:38:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 22 Feb 2024 19:00:41 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "65d799d9-101dd"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 17693
expires: Tue, 27 Feb 2024 23:38:19 GMT

GET
H2 200 5d3cypit2iz8.js Show response
js.driftt.com/include/1709077200000/ 212 KB
60 KB 727ms
468ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1709077200000/5d3cypit2iz8.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

93a2fd82dd3a13a9e9ce0583f3bde1b6e88da6ebce30fa8c87cee4d9d927e4d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-amz-version-id: fwT06mdOrTHjuLmyd8.idzR8VPd5.dxi
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
via: 1.1 a1e98dc0131f4ff4734e5d850f937268.cloudfront.net (CloudFront), 1.1 a2ce61e5ddc66736c9e2bfb6581fa2da.cloudfront.net (CloudFront)
date: Tue, 27 Feb 2024 23:38:20 GMT
content-encoding: gzip
x-amz-cf-pop: IAD66-C1, FRA60-P6
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 50
last-modified: Mon, 21 Aug 2023 14:57:31 GMT
server: istio-envoy
etag: W/"576cdc1c0941a520c47b54aef3b463f7"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=10
access-control-allow-credentials: true,true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: wjFsvkfT2hGTXpUkWjUlS5l0mJcWLQOHBWqm0sgqlCgiopk9GMHOfg==

GET
H2 200 AWGoGO5jnvY Show response
www.youtube.com/embed/ Frame 552A 93 KB
41 KB 433ms
168ms Document
text/html 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f14.1e100.net

Software

ESF /

Resource Hash

8a8567e7607dddbc5a4dbcefcd92aeb2e19a8fe8bee4b0a566e9dce691677329

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.huntress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: he-IL,he;q=0.9

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: br
content-type: text/html; charset=utf-8
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
cross-origin-resource-policy: cross-origin
date: Tue, 27 Feb 2024 23:38:20 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
origin-trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=iw for more info."
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma: no-cache
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 gist-embed-5bb00a1034b4.css
github.githubassets.com/assets/ 51 KB
11 KB 294ms
96ms Stylesheet
text/css 185.199.109.154
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://github.githubassets.com/assets/gist-embed-5bb00a1034b4.css

Requested by

Host: gist.github.com
URL: https://gist.github.com/JohnHammond/fac42eefb1bb137d1d8b5707d67d6964.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.109.154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-109-154.github.com

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

3a9886679dab1ea5d82978ea93e590cd27fb5902bb664d9c8f55ecf2256b6d5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-fastly-request-id: 0079a1bf905c8cd320d2f37e4e840a1d53c8162c
date: Tue, 27 Feb 2024 23:38:19 GMT
content-encoding: br
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=31536000
age: 608679
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
content-length: 10558
x-served-by: cache-iad-kjyo7100030-IAD, cache-mrs1050103-MRS
last-modified: Tue, 20 Feb 2024 19:01:11 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8DC32464DB126E7
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
accept-ranges: bytes
x-cache-hits: 59, 1

GET
H2 200 655efb41f4bb20e00c9cfe91_Group%2039892.svg
assets-global.website-files.com/655d92689c415e9fefcf2368/ 673 B
1 KB 133ms
133ms Image
image/svg+xml 13.225.78.111
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/655d92689c415e9fefcf2368/655efb41f4bb20e00c9cfe91_Group%2039892.svg
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-111.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fca96e23cbef68956d5776a0e13de71ab3e0d82c192d143bc93a063776ee81ad

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 09:25:47 GMT
x-amz-version-id: 2SPzchtrPJOOCpA0jo4V.YS2Osqybov7
via: 1.1 182ef5a8d12abb5df1553676864737b0.cloudfront.net (CloudFront)
age: 4716753
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 673
last-modified: Thu, 23 Nov 2023 07:12:03 GMT
server: AmazonS3
etag: "48aeeba05bcceb164d7432689b3bb357"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: U-3B0zwylkqWitKwLjCYcaaeMPmWwZa5wZgk1CIZwnf4273H-JxvzA==

GET
H2 200 6579dd0b5f9a54376d296969_visuelt-regular-webfont.woff2
assets.website-files.com/6579dd0b5f9a54376d296915/ 20 KB
21 KB 526ms
278ms Font
application/octet-stream 13.33.187.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296969_visuelt-regular-webfont.woff2
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.65f97142b.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.119 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-187-119.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 00d08ce080678db0c54af3944723e28b27e8bdc24146f813477b5b58fe65376c

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://www.huntress.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 12:03:52 GMT
x-amz-version-id: 4frLyUq9eYNLo7inr9AWHf_d33ZSkDwJ
via: 1.1 c8faaa7d637dd73af72e1355a476ffc2.cloudfront.net (CloudFront)
age: 5225668
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 20916
last-modified: Wed, 13 Dec 2023 16:34:20 GMT
server: AmazonS3
etag: "833d58f5538bb02b9d3e362ca829ece7"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: qbcaQFqwITK9VS3awe5_2BsS3wHWcBHSUp88X-25WHtcrcMxqDXzxQ==

GET
H2 200 6579dd0b5f9a54376d296925_hknova-regular-webfont.woff2
assets.website-files.com/6579dd0b5f9a54376d296915/ 17 KB
18 KB 459ms
211ms Font
application/octet-stream 13.33.187.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296925_hknova-regular-webfont.woff2
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.65f97142b.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.119 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-187-119.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 71425f588c17edb9905c3ed73aee0404b58772b91c8154fe53d3157f58f0b2e2

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://www.huntress.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 20:23:09 GMT
x-amz-version-id: At.YFBHJO4EQclecPPM23aBnfk3j2h1H
via: 1.1 c8faaa7d637dd73af72e1355a476ffc2.cloudfront.net (CloudFront)
age: 5282111
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 17728
last-modified: Wed, 13 Dec 2023 16:34:20 GMT
server: AmazonS3
etag: "fd0185054945b2abe907dc7e524389c9"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: FHfhKoE_80vE3cZQmgyMUoQOovsyBrSOBrGrp9VzOuOlvnrTrwqGGQ==

GET
H2 200 6579dd0b5f9a54376d29691d_hknova-bold-webfont.woff2
assets.website-files.com/6579dd0b5f9a54376d296915/ 18 KB
18 KB 430ms
183ms Font
application/octet-stream 13.33.187.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d29691d_hknova-bold-webfont.woff2
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.65f97142b.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.119 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-187-119.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a4aba4543a40b2e2d78e4006eb941a3a18cf95dc81041ad362321a3995bcc898

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://www.huntress.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 20:23:17 GMT
x-amz-version-id: 4JksoGDTlz479HpJYtobtrz0YXSwp3Rx
via: 1.1 c8faaa7d637dd73af72e1355a476ffc2.cloudfront.net (CloudFront)
age: 5282103
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 18204
last-modified: Wed, 13 Dec 2023 16:34:20 GMT
server: AmazonS3
etag: "5aec097021a58170197314c745d296db"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: NYXdH4XYMaCLiIA01PDCD6EwTM9ptQy6JYLiTaoFDXPq_DPBRYF0Pw==

GET
H2 200 6579dd0b5f9a54376d296961_visuelt-bold-webfont.woff2
assets.website-files.com/6579dd0b5f9a54376d296915/ 21 KB
21 KB 380ms
132ms Font
application/octet-stream 13.33.187.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296961_visuelt-bold-webfont.woff2
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.65f97142b.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.119 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-187-119.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 36b097a74149a547cc7fe1da7b5a9cacf6c36d2f91872f11874479e1d4fafee2

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://www.huntress.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 20:23:09 GMT
x-amz-version-id: 6cft5KdwVHtlIu77Lo8AxPLF1V_1aCGv
via: 1.1 c8faaa7d637dd73af72e1355a476ffc2.cloudfront.net (CloudFront)
age: 5282111
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 21280
last-modified: Wed, 13 Dec 2023 16:34:20 GMT
server: AmazonS3
etag: "4be3159e8cb3fb66b8e847dd0bedb2ed"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: Rl0V2F1hqx9LS5lPgezSR-K-Q4JH6WS2ldnEfT1H6FFRXpMmm585gg==

GET
H2 200 6579dd0b5f9a54376d296927_hknova-semibold-webfont.woff2
assets.website-files.com/6579dd0b5f9a54376d296915/ 18 KB
18 KB 477ms
229ms Font
application/octet-stream 13.33.187.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296927_hknova-semibold-webfont.woff2
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.65f97142b.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.119 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-187-119.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ace449f8c185f9f62716fd9998c8f4d09f6849ead77ec8c3849aa69f4c8c1d36

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://www.huntress.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 08:31:44 GMT
x-amz-version-id: SgNlIeK2CMt3IfgkJzcYPm6BQJFO8VdG
via: 1.1 c8faaa7d637dd73af72e1355a476ffc2.cloudfront.net (CloudFront)
age: 1263996
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 18124
last-modified: Wed, 13 Dec 2023 16:34:20 GMT
server: AmazonS3
etag: "b62b51b8a8a1c83c200a484a4149c151"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: 3e92rt2GCQMt4ZOr2z1fzcbA1h7rdwPTheCIySQP5GCWRj4VwbdNbw==

GET
H2 200 6579dd0b5f9a54376d29696f_visuelt-thin-webfont.woff2
assets.website-files.com/6579dd0b5f9a54376d296915/ 20 KB
20 KB 511ms
264ms Font
application/octet-stream 13.33.187.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d29696f_visuelt-thin-webfont.woff2
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.65f97142b.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.119 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-187-119.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b7bd039fcf8ea3ece5223d270ecf6d66277f9cf7ddacb8fd3f20d1702432c3bb

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://www.huntress.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 30 Dec 2023 15:22:36 GMT
x-amz-version-id: 1AmjYc4ysufx24AJ6PfPPYoNyma6Viac
via: 1.1 c8faaa7d637dd73af72e1355a476ffc2.cloudfront.net (CloudFront)
age: 5127344
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 20300
last-modified: Wed, 13 Dec 2023 16:34:20 GMT
server: AmazonS3
etag: "07fd1c3f396e8b19e3076e1167800fb5"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: ifg6ESAcFlT16Fuw14a_P-HGhLASmJYkdUg0Hr6IKrAhqX1QxXa9TQ==

GET
H2 200 6579dd0b5f9a54376d296a6e_DMSans_24pt-Bold.ttf
assets.website-files.com/6579dd0b5f9a54376d296915/ 55 KB
29 KB 490ms
243ms Font
application/x-font-ttf 13.33.187.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a6e_DMSans_24pt-Bold.ttf
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.65f97142b.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.119 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-187-119.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0020be3f1555293342637940e02d32e0f0c3b1951f6a274c00a6e3afe91610d1

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://www.huntress.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 15:55:33 GMT
x-amz-version-id: quM.7z1k_e9xiPUszqLumStS9j4JLmMp
content-encoding: br
via: 1.1 c8faaa7d637dd73af72e1355a476ffc2.cloudfront.net (CloudFront)
age: 5298167
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Wed, 13 Dec 2023 16:34:21 GMT
server: AmazonS3
etag: W/"541d84af93ed55a92a75644198c26ca5"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/x-font-ttf
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
vary: Accept-Encoding
x-amz-cf-id: Kfix8rMb1mskj-EFTe5HvSZp-CVD15xoVfHay5RFC3u7EbZw-LxhzA==

GET
H2 200 6579dd0b5f9a54376d296a33_banner-ellipse%20(1).webp
assets-global.website-files.com/6579dd0b5f9a54376d296915/ 29 KB
30 KB 123ms
119ms Image
image/webp 13.225.78.111
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a33_banner-ellipse%20(1).webp
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-111.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 84d9a8398452005a5d2abc445e3c54aabd86e648ed214d420d7fb323262719b1

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-amz-version-id: Mj8wcNSFVBisltZstt5EJDzhk_eEJ4ri
date: Tue, 27 Feb 2024 03:40:36 GMT
via: 1.1 182ef5a8d12abb5df1553676864737b0.cloudfront.net (CloudFront)
age: 74971
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 29868
last-modified: Thu, 21 Dec 2023 07:39:50 GMT
server: AmazonS3
etag: "239751e75040f8efec0043a5f4cf277a"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: GMP7anfWBaAjwS1mm_nswaLjn25sXpVgaKOgdpofNM7FqtLDRgBcSg==

GET
H2 200 655ddcc107aef728354e9cbf_Huntress-logo.svg
assets-global.website-files.com/655ddcc107aef728354e9c2a/ 16 KB
13 KB 124ms
121ms Image
image/svg+xml 13.225.78.111
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/655ddcc107aef728354e9c2a/655ddcc107aef728354e9cbf_Huntress-logo.svg
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-111.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3e74699ee2810c89e5df5bd0d0506256c46f1e73108f40dc993b49cc210203db

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 15 Jan 2024 08:44:23 GMT
x-amz-version-id: ll9DT5jxvCo6dqqJTOhzWIKk94gBwQHc
content-encoding: br
via: 1.1 182ef5a8d12abb5df1553676864737b0.cloudfront.net (CloudFront)
age: 3768837
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Wed, 22 Nov 2023 10:49:38 GMT
server: AmazonS3
etag: W/"1b58a7f9d25209475f7150623a7b9993"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
x-amz-cf-id: -AmNQc26cWxA0CL12GcywaCK1d1MN-5Tz7VV_53ZONOVrE4ndZ92SA==

GET
H2 200 655d92689c415e9fefcf2400_Hero-grapic-right-02.png
assets-global.website-files.com/655d92689c415e9fefcf2368/ 5 KB
5 KB 125ms
122ms Image
image/png 13.225.78.111
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/655d92689c415e9fefcf2368/655d92689c415e9fefcf2400_Hero-grapic-right-02.png
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-111.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a1e79865576e220b93dfe34d011286a8335ee8ac4eb6450300fb45a4f15a600e

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 30 Dec 2023 05:44:52 GMT
x-amz-version-id: ds4He9jpqLhVudpNkauPNw12aaYIjxRr
via: 1.1 182ef5a8d12abb5df1553676864737b0.cloudfront.net (CloudFront)
age: 5162007
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 5002
last-modified: Wed, 22 Nov 2023 05:32:26 GMT
server: AmazonS3
etag: "d360d7cfb07b3fdc3fbc56204caa4c06"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: cWt6PvQSb7uwP-ffg-d_ScRldY2ZXPJUfPldJppZJY153QMrWV3trg==

GET
H2 200 656079b2a6c055ce7d368e61_Secondary%20Text%20CTA%20Black%20(1).svg
assets-global.website-files.com/655d92689c415e9fefcf2368/ 407 B
864 B 125ms
122ms Image
image/svg+xml 13.225.78.111
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/655d92689c415e9fefcf2368/656079b2a6c055ce7d368e61_Secondary%20Text%20CTA%20Black%20(1).svg
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-111.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ad1a0bf17b8433241806ec0b3cb9c17be616ea295df90068ab3e646de802e111

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Fri, 05 Jan 2024 14:43:06 GMT
x-amz-version-id: 6MUyKzg7.UI2lqy3cc43_aNDTQO42ExF
via: 1.1 182ef5a8d12abb5df1553676864737b0.cloudfront.net (CloudFront)
age: 4611313
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 407
last-modified: Fri, 24 Nov 2023 10:23:48 GMT
server: AmazonS3
etag: "7b97da408ecd186da2775e85d3b5fc35"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: vba1_hJ_FHTU1KHV052LzaTeWjapCjyNAajfn6ygtmBEAlnxb0u0aw==

GET
H2 200 655d92689c415e9fefcf2401_Hero-grapic-right-01.png
assets-global.website-files.com/655d92689c415e9fefcf2368/ 12 KB
12 KB 125ms
123ms Image
image/png 13.225.78.111
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/655d92689c415e9fefcf2368/655d92689c415e9fefcf2401_Hero-grapic-right-01.png
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-111.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e25771659046bed206f576f67ef77c46c7c639fde3b416a20e279703ae25a669

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 30 Dec 2023 05:44:53 GMT
x-amz-version-id: f7iETDkxzcVNvfCyBasX0c7eQWmHAaI6
via: 1.1 182ef5a8d12abb5df1553676864737b0.cloudfront.net (CloudFront)
age: 5162007
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 12224
last-modified: Wed, 22 Nov 2023 05:32:26 GMT
server: AmazonS3
etag: "77f3a2017fcc90138a0d7de5e3a64595"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: CvcJ_ybCom6bvBBt20112iRBLoPxKrxUlSAgMexpe_sbR79wJ0IWkA==

GET
H2 200 6579dd0b5f9a54376d296a87_Blog%20detail%20Banner%20Glitch%20Left%20Bottom.webp
assets-global.website-files.com/6579dd0b5f9a54376d296915/ 7 KB
7 KB 156ms
154ms Image
image/webp 13.225.78.111
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a87_Blog%20detail%20Banner%20Glitch%20Left%20Bottom.webp
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-111.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6f3642cd8faa981a6b7f71cb0bd88a222ed7c92510100761c38f4bfd689853f2

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-amz-version-id: .9LTfep43eO88TqIHc3WnYAIb3vaJe3A
date: Tue, 27 Feb 2024 05:37:50 GMT
via: 1.1 182ef5a8d12abb5df1553676864737b0.cloudfront.net (CloudFront)
age: 77505
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 6778
last-modified: Thu, 21 Dec 2023 07:39:51 GMT
server: AmazonS3
etag: "2deea30793899f56a236f1ba505155ab"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: AkN14yZotP3aLfzBwpOJ3VcqEClEYabUfp25GA6hlPuAMAK1wvG5Iw==

GET
H2 200 6579dd0b5f9a54376d296a89_Landing%20WWW%20Glitch%20Right.webp
assets-global.website-files.com/6579dd0b5f9a54376d296915/ 2 KB
3 KB 154ms
153ms Image
image/webp 13.225.78.111
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a89_Landing%20WWW%20Glitch%20Right.webp
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-111.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c99531b584c2990420c6cf8f267e27bca20375cf89d4afdcaa5b3afb7a9f35d2

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-amz-version-id: 0.i3tZnqpf4mpcjZIZI6k.PdzUSOLecT
date: Tue, 27 Feb 2024 05:37:50 GMT
via: 1.1 182ef5a8d12abb5df1553676864737b0.cloudfront.net (CloudFront)
age: 64873
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 2196
last-modified: Thu, 21 Dec 2023 07:39:51 GMT
server: AmazonS3
etag: "3574559fb267295e5e44a4509e2e6e4f"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: Vos1Tx4AKOGgYlC23PfPCUPeC1cZjGzxXD7WU4PX1HqcbIuK3_lvkw==

GET
H2 200 6579dd0b5f9a54376d296a5b_facebook.svg
assets-global.website-files.com/6579dd0b5f9a54376d296915/ 368 B
825 B 153ms
152ms Image
image/svg+xml 13.225.78.111
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a5b_facebook.svg
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-111.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f2314da0b26cc727445f74c19d54f2f75944ea1a610497231ba6a5d9e541acf0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 18:39:42 GMT
x-amz-version-id: RZplueeOMT9I2ezQMMUJ8cw13HoQeV5p
via: 1.1 182ef5a8d12abb5df1553676864737b0.cloudfront.net (CloudFront)
age: 5288318
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 368
last-modified: Wed, 13 Dec 2023 16:34:21 GMT
server: AmazonS3
etag: "b92a7c9703a268bda64464e9f8c245fd"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: iSJOYYwDJoFjFRNbsQrqh9oU0VacG_8ugeegKl6tHlpxq0KD0660Rg==

GET
H2 200 6579dd0b5f9a54376d296a6f_twitter.svg
assets-global.website-files.com/6579dd0b5f9a54376d296915/ 351 B
808 B 154ms
152ms Image
image/svg+xml 13.225.78.111
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a6f_twitter.svg
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-111.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 553797b86e5516ebb3b4a6ffc794d7d9eca1fc1f3ca8ab0703e5eff9934e29c8

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 19:08:05 GMT
x-amz-version-id: qTS56BoR0gVqfX6mJuOtV4Wu10z6D4RY
via: 1.1 182ef5a8d12abb5df1553676864737b0.cloudfront.net (CloudFront)
age: 5286615
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 351
last-modified: Wed, 13 Dec 2023 16:34:21 GMT
server: AmazonS3
etag: "e0a4b7f37d6875804665234ecff1cb23"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: qpptW67_X231-olI_6Xi7CL1Un5tkngPA5_QAbcCOx2-pmpftZqDdA==

GET
H2 200 6579dd0b5f9a54376d296a70_linkedin.svg
assets-global.website-files.com/6579dd0b5f9a54376d296915/ 675 B
1 KB 154ms
153ms Image
image/svg+xml 13.225.78.111
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a70_linkedin.svg
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-111.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8f0f089b8d2746c56340171bba62f027d4d2dc0f520588d9480432693381e14a

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 30 Dec 2023 14:16:16 GMT
x-amz-version-id: mMxIOUbXDP4hW6NdJCWI58VrmvAg.At1
via: 1.1 182ef5a8d12abb5df1553676864737b0.cloudfront.net (CloudFront)
age: 5131324
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 675
last-modified: Wed, 13 Dec 2023 16:34:21 GMT
server: AmazonS3
etag: "67b0ebebe9b8817edbfa41bdfd2e8c6e"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: sJSmxq0i5Z3KRSiTa-JFSIRaY3t2bbzGAoVFohCpOZMQyYGUOgYZyg==

GET
H2 200 6579dd0b5f9a54376d296a5a_download.svg
assets-global.website-files.com/6579dd0b5f9a54376d296915/ 820 B
1 KB 154ms
153ms Image
image/svg+xml 13.225.78.111
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a5a_download.svg
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-111.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 350cf9ff67297ce9f79b1a35fb7205326d21f149ab404f81ec875968f0b7d083

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 30 Dec 2023 14:16:16 GMT
x-amz-version-id: 5Ss_XSS0A3iWbPuuBVg7J8jICwbGfHO4
via: 1.1 182ef5a8d12abb5df1553676864737b0.cloudfront.net (CloudFront)
age: 5131324
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 820
last-modified: Wed, 13 Dec 2023 16:34:21 GMT
server: AmazonS3
etag: "8d8c0614e1e224001d7c6dec535490b1"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: d1W2DVzfoJ2ZGsvJhFu59XhamJtijohhMIAMITkiAq1DqgupnlfSLg==

GET
H2 200 6579dd0b5f9a54376d29694d_roboto-regular-webfont.woff2
assets.website-files.com/6579dd0b5f9a54376d296915/ 19 KB
19 KB 216ms
216ms Font
application/octet-stream 13.33.187.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d29694d_roboto-regular-webfont.woff2
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.65f97142b.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.119 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-187-119.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7f62ee80b8c824f30ad6c278146632d25b7e159e0a9cd91a356068eb9340061c

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://www.huntress.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 20:23:09 GMT
x-amz-version-id: 1upZc36cdk27x7Arg8l9thaL3L34ome5
via: 1.1 c8faaa7d637dd73af72e1355a476ffc2.cloudfront.net (CloudFront)
age: 5282112
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 19348
last-modified: Wed, 13 Dec 2023 16:34:20 GMT
server: AmazonS3
etag: "a0118c6d18835732ae0eb880babc7598"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: TByStPdHxH3y2SGYhdVCxCt868P8Uyy-rpnipR7-iO6DD8sGhiyPBw==

GET
H2 200 www-player-rtl.css
www.youtube.com/s/player/95cde7ed/ Frame 552A 367 KB
47 KB 113ms
112ms Stylesheet
text/css 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/95cde7ed/www-player-rtl.css

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f14.1e100.net

Software

sffe /

Resource Hash

59435c97638a01eaf751949c97b484bac9ab16f17459f82e4a832b9a79e22910

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 08:55:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52968
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 47657
x-xss-protection: 0
last-modified: Mon, 26 Feb 2024 05:14:55 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 26 Feb 2025 08:55:32 GMT

GET
H2 200 19680a27e88da4a3713af26571b4849096e75d617f2845574af7fd15746256bb.js Show response
huntresscdn.com/ 111 KB
112 KB 212ms
77ms Script
text/plain 172.67.68.218
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://huntresscdn.com/19680a27e88da4a3713af26571b4849096e75d617f2845574af7fd15746256bb.js
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.68.218 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 19680a27e88da4a3713af26571b4849096e75d617f2845574af7fd15746256bb

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:20 GMT
cf-cache-status: HIT
last-modified: Tue, 27 Feb 2024 22:52:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 2779
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n%2FlctWuJnXRgDTNix9fQJpmgUgumihBPji2oIpuS236MzVI441WJOHcCMBO0UqrfrXNg7cC2aPbSd2gOcWu2RRloYnDWCu2ztlaZhWcJAgpWutMh7Wn04Ni9bIZN1k2CCw%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=14400, maxage=14400
accept-ranges: bytes
cf-ray: 85c442c51841e3df-TLV
content-length: 113865

GET
H2 200 embed.js Show response
www.youtube.com/s/player/95cde7ed/player_ias.vflset/iw_IL/ Frame 552A 55 KB
17 KB 170ms
170ms Script
text/javascript 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/95cde7ed/player_ias.vflset/iw_IL/embed.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f14.1e100.net

Software

sffe /

Resource Hash

58e89e283b8f550f453c0fb517da994c3529f6336d6d7bd1593ec0e04d8c102d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 09:01:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52631
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17017
x-xss-protection: 0
last-modified: Mon, 26 Feb 2024 05:14:55 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 26 Feb 2025 09:01:09 GMT

GET
H2 200 www-embed-player.js Show response
www.youtube.com/s/player/95cde7ed/www-embed-player.vflset/ Frame 552A 319 KB
95 KB 112ms
112ms Script
text/javascript 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/95cde7ed/www-embed-player.vflset/www-embed-player.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f14.1e100.net

Software

sffe /

Resource Hash

55014dbf69631ed5825be787f9c494ca876a9504a85a82fd32806bfe724be1c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 21:22:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8150
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 97450
x-xss-protection: 0
last-modified: Mon, 26 Feb 2024 05:14:55 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 26 Feb 2025 21:22:30 GMT

GET
H2 200 base.js
www.youtube.com/s/player/95cde7ed/player_ias.vflset/iw_IL/ Frame 552A 2 MB
0 179ms
179ms Script
text/javascript 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/95cde7ed/player_ias.vflset/iw_IL/base.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f14.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 08:56:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52932
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 798278
x-xss-protection: 0
last-modified: Mon, 26 Feb 2024 05:14:55 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 26 Feb 2025 08:56:08 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 308 KB
98 KB 147ms
147ms Script
application/javascript 142.250.186.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-GCTMBVFESS&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

01d887f604f5f9cf0707707d61b0b6db0f44bb692a6cf15ba8c95f74a1bc138d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:20 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 100456
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 27 Feb 2024 23:38:20 GMT

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 241 KB
84 KB 125ms
124ms Script
application/javascript 142.250.186.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-429191348&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

d902c3e15f49b1b6477b075c2384aab2b01ece853370c61ffeb04662a11cf4db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:20 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85444
x-xss-protection: 0
last-modified: Tue, 27 Feb 2024 22:15:49 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 27 Feb 2024 23:38:20 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 1 KB
855 B 360ms
113ms Script
application/javascript 184.24.77.28
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.24.77.28 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a184-24-77-28.deploy.static.akamaitechnologies.com

Software

Resource Hash

c1ae5b294dafd600a8377432c1cf1f05694e1d82ced9931f8ba71a11d753c2f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 26 Feb 2024 18:10:47 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=58130
accept-ranges: bytes
content-length: 645

GET
H2 200 qevents.js Show response
a.quora.com/ 41 KB
14 KB 205ms
71ms Script
text/plain 162.159.152.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.quora.com/qevents.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.159.152.17 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2a101f313f27c267a744088e44664a87d2ec7dc2a3464bf1319a95094dc76db

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:20 GMT
x-amz-version-id: DENAuZi5jc6G3XAf0_byr8vJzUcVnf.F
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: 5K57PBR2A0025GG8
age: 8889002
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: rvPsThAgQkJShQQ2J7UMgDJ+mUUBMPz6v4o52Qjy3F2U8CcHm7z1WCN2wGkAgqOAkDHbpFzSZ2Y=
last-modified: Tue, 17 Oct 2023 18:57:21 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: md5:5defc3f1c55a0cb9cbca8c06fbabaf65
etag: W/"5defc3f1c55a0cb9cbca8c06fbabaf65"
vary: Accept-Encoding
content-type: text/plain
cache-control: public, max-age=14400
cf-ray: 85c442c5da0be3df-TLV
expires: Wed, 28 Feb 2024 03:38:20 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 357ms
115ms Script
application/javascript 199.232.188.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.188.157 Munich, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:20 GMT
content-encoding: gzip
last-modified: Thu, 27 Oct 2022 18:55:37 GMT
x-amz-server-side-encryption: AES256
etag: "32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary: Accept-Encoding,Host
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15375
x-served-by: cache-iad-kiad7000089-IAD, cache-muc13976-MUC

GET
H2 200 bat.js Show response
bat.bing.com/ 45 KB
13 KB 316ms
127ms Script
application/javascript 204.79.197.200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

204.79.197.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

a-0001.a-msedge.net

Software

Resource Hash

45396b8359112c614d4aab3fcb716deaabc47e477078f675d7bf69f5791c8f53

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Tue, 27 Feb 2024 23:38:20 GMT
last-modified: Thu, 22 Feb 2024 21:00:50 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 02B5F9A4203C48188A0815B460B6728E Ref B: TLV30EDGE0119 Ref C: 2024-02-27T23:38:20Z
etag: "0adee36d265da1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13197

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 214 KB
58 KB 336ms
109ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

0e04153b5f73bfa7866948f2a9870593d69bfde14e77a1a06af5f567096e5a09

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

permissions-policy-report-only: clipboard-read=(), clipboard-write=(), picture-in-picture=();report-to="permissions_policy"
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 27 Feb 2024 23:38:20 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57257
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
pragma: public
x-fb-debug: A0LGNfkv3CE/ChiyOcO43pkybi5DofXk6XejlcJRV/2zMtuSbanLgbhYw8MutTWvNufBdON1DdjhCfGMAAyl6A==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-stack: www
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 1006267.js Show response
tracking.g2crowd.com/attribution_tracking/conversions/ 958 B
2 KB 342ms
212ms Script
text/javascript 172.64.144.225
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://tracking.g2crowd.com/attribution_tracking/conversions/1006267.js?p=https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass&e=

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.144.225 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14c59924cdca7796d9578872e6933998297b41cb0a2951ccaf7de4bd7cf921ff

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' .g2crowd.com .g2.com; connect-src 'self' .g2crowd.com .g2.com; font-src 'self' .g2crowd.com .g2.com; form-action 'self' .g2crowd.com .g2.com; frame-src 'self' .g2crowd.com .g2.com; img-src 'self' .g2crowd.com .g2.com; manifest-src 'self' .g2crowd.com .g2.com; media-src 'self' .g2crowd.com .g2.com; object-src 'self' .g2crowd.com .g2.com; script-src 'self' .g2crowd.com .g2.com; style-src 'self' .g2crowd.com .g2.com; worker-src 'self' .g2crowd.com .g2.com
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:20 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-permitted-cross-domain-policies: none
content-security-policy: default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
x-xss-protection: 1; mode=block
x-request-id: fb608c37-ef23-4028-b4b0-fbd66cc2772c
x-runtime: 0.003253
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"14c59924cdca7796d9578872e6933998"
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Origin
content-type: text/javascript; charset=utf-8
cache-control: max-age=600, public
cf-ray: 85c442c5dacee3ed-TLV

GET
H2 200 e666a54d-ff29-48f9-9baa-2be6ac05412e.js Show response
j.6sc.co/j/ 837 B
837 B 517ms
516ms Script
application/javascript 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/j/e666a54d-ff29-48f9-9baa-2be6ac05412e.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-184.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 82ba33778a6595a59baef6e6964c64d7c3e9888c2bbf74461f1948b295db28e2

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-amz-version-id: iBgsOgE4Kr3Z0Ccj2rm1wK8VxmZ_A29h
content-encoding: gzip
date: Tue, 27 Feb 2024 23:38:20 GMT
x-amz-cf-pop: FRA60-P1
x-amz-server-side-encryption: AES256
x-amz-meta-content-type: application/json
content-length: 438
pragma: no-cache
last-modified: Fri, 18 Aug 2023 17:22:32 GMT
server: AmazonS3
etag: "29df5bb770be8e518fe2206581f712a6"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
x-amz-cf-id: DdZxHz3m2cHhaJOT0Gbm333Pv-rAa-591ojqHyeBQBEqCP2hmzzO7g==
expires: Tue, 27 Feb 2024 23:38:20 GMT

GET
H2 200 events.js Show response
tags.srv.stackadapt.com/ 18 KB
7 KB 449ms
207ms Script
text/javascript 52.28.87.155
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/events.js
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.28.87.155 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-87-155.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 49cd7b7181e7181af04b5848a8eb65c40415c59f999977e7122f928bd3a106b2

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 27 Feb 2024 23:38:20 GMT
cache-control: max-age=5
content-encoding: gzip
content-type: text/javascript

GET
H2 200 hotjar-2159185.js Show response
static.hotjar.com/c/ 9 KB
4 KB 378ms
140ms Script
application/javascript 18.66.97.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-2159185.js?sv=6

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.97.37 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-97-37.fra56.r.cloudfront.net

Software

Resource Hash

574196df2113d3b8463aa9225da93d50b8d2453c16ababa1b6bbbe9b63efe56a

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
date: Tue, 27 Feb 2024 23:38:20 GMT
via: 1.1 84294257ed643a88ee54d2e3f7d7ccea.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
etag: W/f5bcb94ac1a3fd4517e0bab4f016c66b
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
cache-control: max-age=60
cross-origin-resource-policy: cross-origin
x-amz-cf-id: AmFClcnIxHfl8iiyTIdSZv2tO3VLzKfOfkYcvtPDb6TIF_H-GC0JJg==

GET
H2 200 NeverBounce.js Show response
cdn.neverbounce.com/widget/dist/ 96 KB
29 KB 384ms
132ms Script
application/javascript 18.245.46.48
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.245.46.48 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-245-46-48.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c99d11cb4960d6e1918ed55d5bcbb316d38b51098e2efc1201904d7274d3273e

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 19:58:22 GMT
content-encoding: gzip
via: 1.1 b83db9a9904a8f97beb31f810804b6e4.cloudfront.net (CloudFront)
last-modified: Mon, 02 Mar 2020 18:37:33 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P9
age: 13199
etag: W/"c1e06621030dfcba15b88abbcaa546eb"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: UU4Dyp7Ucs4jVBux9AxGUYKgnnj0Vl0w5GkVXZXQKbeUSJpwPxoblw==

GET
H2 200 tracking.js Show response
trk.techtarget.com/ 3 KB
2 KB 221ms
93ms Script
text/javascript 104.18.36.196
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://trk.techtarget.com/tracking.js
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.36.196 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:20 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Tue, 13 Dec 2022 15:01:39 GMT
server: cloudflare
age: 64348
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1200
cf-ray: 85c442c75815e3cf-TLV
expires: Tue, 27 Feb 2024 23:58:20 GMT

GET
H2 200 site-script.js Show response
cdn.metadata.io/ 8 KB
3 KB 373ms
122ms Script
application/javascript 18.66.97.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.metadata.io/site-script.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.97.14 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-97-14.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

28cf2b2374a7fe727fa05e23727151034a93103de21eda97e5b4513a26b83c70

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-amz-version-id: e9wd.JyoULXOHxdC.9vYgxW4MW6htgs8
content-encoding: gzip
via: 1.1 5d5481cfa85227a3fdd5ff0b03093c62.cloudfront.net (CloudFront)
date: Tue, 27 Feb 2024 20:09:39 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-amz-cf-pop: FRA56-P2
age: 12522
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 23 Feb 2024 20:08:14 GMT
server: AmazonS3
etag: W/"e303f06e90dc677f8231784bed11b647"
vary: Accept-Encoding, Origin
x-frame-options: SAMEORIGIN
content-type: application/javascript
x-amz-cf-id: b1sY-TpQeFWCTPLYXp9RR53Sq8PAfd36s2QgSUQKJwwQYkvMG1fLvg==

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 28 KB
9 KB 320ms
108ms Script
application/javascript 151.101.65.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 2939d067bced6e2e3e43c1b10d2b067cb980410c2cc42fd3e867798a4a36c697

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:20 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Thu, 15 Feb 2024 20:38:48 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "9a680c8c475d8bba600d4d87b4fa7ee5"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 8702

GET
H2 200 site-insights.js Show response
cdn.metadata.io/ 3 KB
1 KB 285ms
122ms Script
application/javascript 18.66.97.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.metadata.io/site-insights.js

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.97.14 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-97-14.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

8cede167f8e0eb1a742b600847e11c36e71ca6f8a2392c2474f31387b0cd5f4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-amz-version-id: oLwy90dZVO5VbL0SwmxJ7JP9D8GQ9nog
content-encoding: br
via: 1.1 5d5481cfa85227a3fdd5ff0b03093c62.cloudfront.net (CloudFront)
date: Tue, 27 Feb 2024 09:23:22 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-amz-cf-pop: FRA56-P2
age: 51299
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 05 Feb 2024 15:29:59 GMT
server: AmazonS3
etag: W/"802c81b5c2aebbed9aa94f55cd523a61"
vary: Accept-Encoding, Origin
x-frame-options: SAMEORIGIN
content-type: application/javascript
x-amz-cf-id: ZpZCSmuMBPYzXSCOe13ZusukyouQeIzJi69vgp45S1boSDbwq3pY9Q==

GET
H/1.1 200
OK pixel
q.quora.com/_/ad/83f2d51fb0164c438fbdaa8c29ed2e5e/ 43 B
421 B 763ms
190ms Image
image/gif 52.4.62.73
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.quora.com/_/ad/83f2d51fb0164c438fbdaa8c29ed2e5e/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.4.62.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-62-73.compute-1.amazonaws.com

Software

nginx /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date: Tue, 27 Feb 2024 23:38:21 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Server: nginx
Connection: keep-alive
Content-Length: 43
X-Q-Stat: ,3857a273d54596e1b0e29c59032107a5,10.0.0.5,62480,31.187.78.228,,212242719507,1,1709077101.322,0.001,,.,0,0,0.000,0.000,-,0,0,203,268,134,10,34729,,,,,,-,
Content-Type: image/gif

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 551 KB
88 KB 196ms
67ms Script
application/javascript 104.18.125.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsleadflows.net/leadflows.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3911692.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.125.12 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a0eb564e8b104002217b23d191c384d64d77b30fa37b0f124db645e16096cfd3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.huntress.com/
Origin: https://www.huntress.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

content-encoding: br
x-evy-trace-route-service-name: envoyset-translator
age: 2779
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1313/bundle/main/lead-flows-release.js&cfRay=857ee91d8f944dd0-MRS
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"2a6dc24f5ac6c8a7eefaadde95ff2129"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=86400, max-age=0
x-hs-target-asset: lead-flows-js/static-1.1313/bundle/main/lead-flows-release.js
date: Tue, 27 Feb 2024 23:38:20 GMT
x-amz-version-id: ukHk26vS_rf4a6X6Ik2.9R2qKIwOxT4G
via: 1.1 7375f2360b80ec8c602f04aa2cc7a57c.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: c985020d-a21a-47dc-9a83-b4c81145bf43
x-cache: Hit from cloudfront
cache-tag: staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 5
x-evy-trace-route-configuration: listener_https/all
x-request-id: c985020d-a21a-47dc-9a83-b4c81145bf43
last-modified: Tue, 06 Feb 2024 10:46:39 UTC
server: cloudflare
access-control-max-age: 3000
x-hs-cache-status: MISS
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-748b697-qr57v
cf-ray: 85c442c83990e3cf-TLV
x-amz-cf-id: -ywJrkK11VZdYvmQnLqZF6sjreJAOs0pLUkstUSgG_e0fRlOVYXX-A==

GET
H2 200 3911692.js Show response
js.hs-analytics.net/analytics/1709076900000/ 68 KB
22 KB 385ms
259ms Script
text/javascript 104.16.80.186
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1709076900000/3911692.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3911692.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.80.186 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1e4c2421421b6cf5524e02216937448a77114d75f93468724af367184313ae8e

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:21 GMT
x-amz-version-id: null
content-encoding: br
cf-cache-status: MISS
x-amz-request-id: WE4Y7962WM4DV73B
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 5247bd74-f2b2-428f-a72b-e01f891be366
x-envoy-upstream-service-time: 22
x-amz-id-2: ClZlKxp0a41LgxwjsaM4bLOx4tIcA9LiAO9MUEdKE5Zkf/tDr2ZZ0vylxLF6p77HTEdQsrzJ+ag=
x-evy-trace-listener: listener_https
x-request-id: 5247bd74-f2b2-428f-a72b-e01f891be366
x-evy-trace-route-configuration: listener_https/all
last-modified: Tue, 27 Feb 2024 15:27:40 GMT
server: cloudflare
etag: W/"859dd488198b1c73affae40c02531528"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-8555f56d-pbs6d
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 85c442c85d14e3d7-TLV
expires: Tue, 27 Feb 2024 23:43:20 GMT

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 6 KB
4 KB 199ms
72ms Script
application/javascript 104.17.230.163
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsadspixel.net/fb.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3911692.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.230.163 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cb71e959e48a15247f687beda65881cf3a66e572e7b08ff60631e9071c80a52f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:20 GMT
x-amz-version-id: 5_H3kaL5d1o1Xkf6MGrMjU9p75UFZkJv
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 234949ef-4055-4bcc-b0d7-0a12bb4e8f81
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.533/bundles/pixels-release.js&cfRay=85c17ecdc8355fc4-MRS
x-cache: Hit from cloudfront
cache-tag: staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
content-encoding: br
age: 105
x-envoy-upstream-service-time: 1
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 234949ef-4055-4bcc-b0d7-0a12bb4e8f81
last-modified: Tue, 27 Feb 2024 15:24:45 UTC
server: cloudflare
etag: W/"24edf4ef38ec0ca95cad3d8d3ab13ac8"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-576f9d768-xvt9q
cf-ray: 85c442c8bf5ee3df-TLV
x-amz-cf-id: EEhZaWz3jl6LkYBkhXB6oHM0D6B6zC9WJO_ojgG2BzLeWj7SQum4lA==
x-hs-target-asset: adsscriptloaderstatic/static-1.533/bundles/pixels-release.js

GET
H2 200 collectedforms.js Show response
js.hscollectedforms.net/ 69 KB
25 KB 340ms
214ms Script
application/javascript 104.17.89.154
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hscollectedforms.net/collectedforms.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3911692.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.89.154 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

44dbbb0a1da3d1a2b3f637ba2eff82150de83164b3caf824fc0fc46633588de3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.huntress.com/
Origin: https://www.huntress.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:21 GMT
x-amz-version-id: VTCx5Wpr_CjwKFe_1K6ShUsHQL37oHcJ
via: 1.1 7375f2360b80ec8c602f04aa2cc7a57c.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-amz-cf-pop: IAD12-P3
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: f841533b-318e-409a-8645-1da108a6c2af
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.468/bundles/project.js&cfRay=858e8b07ad51e3db-MRS
x-cache: Hit from cloudfront
cache-tag: staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
content-encoding: br
x-envoy-upstream-service-time: 1
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: f841533b-318e-409a-8645-1da108a6c2af
last-modified: Wed, 21 Feb 2024 09:36:07 UTC
server: cloudflare
etag: W/"0892458d49ed5681928e6be69131caa7"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
x-hs-cache-status: HIT
cache-control: s-maxage=600, max-age=300
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-748b697-ln7lm
cf-ray: 85c442c8b845e3e7-TLV
x-amz-cf-id: 1WlEpyX4VtPtSLQhvjlHyipTzcoBxOMnF9n7KwKJY2a5YKfyoBIpVg==
x-hs-target-asset: collected-forms-embed-js/static-1.468/bundles/project.js

GET
H2 200 web-interactives-embed.js Show response
js.hubspot.com/ 83 KB
25 KB 365ms
239ms Script
application/javascript 104.19.155.83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hubspot.com/web-interactives-embed.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3911692.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.155.83 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ee9f2f620122112ded1f6498ba96d1c797429ab7c07806f689ed5d7142c15973

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.huntress.com/
Origin: https://www.huntress.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

content-encoding: br
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.911/bundles/project.js&cfRay=85975919e884abb9-MRS
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"0e31e7204888ce69b5f5486b7f3c8806"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-hs-target-asset: web-interactives-embed/static-2.911/bundles/project.js
date: Tue, 27 Feb 2024 23:38:21 GMT
x-amz-version-id: 6TFkQJ5lE2FVj1l7Z_pBZDXw00jHreli
via: 1.1 2a3aa853116c0a37d6c7762eca54d208.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: EXPIRED
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: 634620f9-27bd-4268-bbe1-4d51bdd720d8
x-cache: Hit from cloudfront
cache-tag: staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 4
x-evy-trace-route-configuration: listener_https/all
x-request-id: 634620f9-27bd-4268-bbe1-4d51bdd720d8
last-modified: Thu, 22 Feb 2024 11:41:13 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZJY6adeTlrg%2Bm3vIUJkNi6e7eipp%2BT9QQsrW%2F4ya7pgeXLwuEJKWubxtEi36dx2XL05Tuj2LV5KkZJPbBHEON3DfuSIDfN%2F9G3Ou2l2eG5awjYlNgEc74TAbTOV7yJC7"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-748b697-mjwfl
cf-ray: 85c442c8bd3ce3e3-TLV
x-amz-cf-id: TjIEsEIjkutedammsNQyQ1EInKwZ89IpfJkjAcF3C6-0SurVyKSchg==

GET
H2 200 3911692.js Show response
js.hs-banner.com/ 61 KB
17 KB 530ms
404ms Script
text/javascript 172.64.153.27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/3911692.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3911692.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.27 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b3f4331825536e7bfea2547e2bd1b906dfaeb46a4d0ee5c43961f90fdbfbea7

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:21 GMT
x-amz-version-id: qkHXkrATG0VKhsj2st9bJqf9v4vlL2TZ
content-encoding: br
cf-cache-status: REVALIDATED
x-amz-request-id: XWMM64B0308RJQQF
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: ab14d172-3994-431c-915f-2d7c8b57f2dd
x-envoy-upstream-service-time: 46
x-amz-id-2: 8qmEjmfJkoY+dCEbcrlsfwU1MvqSW3mw9YFR6dxBmQMY/HzpU6hivsxmrivd/9nQuWffApRNRrI=
x-evy-trace-listener: listener_https
x-request-id: ab14d172-3994-431c-915f-2d7c8b57f2dd
x-evy-trace-route-configuration: listener_https/all
last-modified: Tue, 06 Feb 2024 15:04:16 GMT
server: cloudflare
etag: W/"02c69287440d36910a3fdd02cbd9c348"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.huntress.com
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-8555f56d-phrfm
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 85c442c9a9cde3e7-TLV
expires: Tue, 27 Feb 2024 23:43:21 GMT

GET
H2 200 anchor Show response
www.google.com/recaptcha/api2/ Frame 8E35 46 KB
29 KB 138ms
137ms Document
text/html 216.58.206.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LchEywUAAAAAAdAXlscEm7Kcb3DJ38pngRCQJsC&co=aHR0cHM6Ly93d3cuaHVudHJlc3MuY29tOjQ0Mw..&hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=normal&cb=h2nkydj1k8y7

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__iw.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.36 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil07s07-in-f4.1e100.net

Software

GSE /

Resource Hash

f882272d89b62b5397ed4085b9d96b3458baceac7a6a776a62718878ec600575

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-cmRmPc-ZZaL76i97-e2giQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.huntress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: he-IL,he;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-cmRmPc-ZZaL76i97-e2giQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 27 Feb 2024 23:38:20 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 AWGoGO5jnvY Show response
www.youtube.com/embed/ Frame 552A 93 KB
40 KB 201ms
200ms Document
text/html 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY&enablejsapi=1&origin=https%3A%2F%2Fwww.huntress.com

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f14.1e100.net

Software

ESF /

Resource Hash

404c2e69414531ea3b2f142c5bc8455cfc59b1c0748277f8fcfa2538306a3f69

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.huntress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: he-IL,he;q=0.9

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: br
content-type: text/html; charset=utf-8
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
cross-origin-resource-policy: cross-origin
date: Tue, 27 Feb 2024 23:38:20 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
origin-trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=iw for more info."
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma: no-cache
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 iframe_api Show response
www.youtube.com/ 993 B
764 B 201ms
199ms Script
text/javascript 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f14.1e100.net

Software

ESF /

Resource Hash

7cc2d877629fff74472a275de25a3c9abcefa24f23bc18756c43081554caf9b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:20 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-encoding: br
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=iw for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
x-frame-options: SAMEORIGIN
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
content-type: text/javascript; charset=utf-8
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: private, max-age=0
origin-trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
expires: Tue, 27 Feb 2024 23:38:20 GMT

POST
H2 200 429191348
google.com/pagead/form-data/ 0
0 403ms
122ms Ping
text/html 142.250.185.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://google.com/pagead/form-data/429191348?gtm=45be42q1v9136018371z89171248136za201&gcd=13l3l3l3l1&dma=0&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=1671912534.1709077100&uamb=0&uaw=0&em=tv.1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-429191348&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.185.174 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s51-in-f14.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

POST
H2 204 429191348
google.com/ccm/form-data/ 0
255 B 356ms
121ms Ping
text/plain 142.250.185.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://google.com/ccm/form-data/429191348?gtm=45be42q1v9136018371z89171248136za201&gcd=13l3l3l3l1&dma=0&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=1671912534.1709077100&uamb=0&uaw=0&em=tv.1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-429191348&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.185.174 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s51-in-f14.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Feb 2024 23:38:21 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.huntress.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 styles__rtl.css
www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/ Frame 8E35 55 KB
24 KB 341ms
116ms Stylesheet
text/css 142.250.185.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__rtl.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LchEywUAAAAAAdAXlscEm7Kcb3DJ38pngRCQJsC&co=aHR0cHM6Ly93d3cuaHVudHJlc3MuY29tOjQ0Mw..&hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=normal&cb=h2nkydj1k8y7

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f3.1e100.net

Software

sffe /

Resource Hash

5f206b060caf20ae38c428c1bad44ccaf68b6345b63f2a7f06428e9747526c06

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Fri, 23 Feb 2024 11:25:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 389582
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24601
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 05:01:55 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 22 Feb 2025 11:25:18 GMT

GET
H3 200 recaptcha__iw.js Show response
www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/ Frame 8E35 518 KB
198 KB 336ms
112ms Script
text/javascript 142.250.185.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__iw.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f3.1e100.net

Software

sffe /

Resource Hash

e5724b80dd7456460f12db0a8870676b40184fa7076eb751afb23be11164719c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 09:02:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52521
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 203025
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 05:01:55 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 26 Feb 2025 09:02:59 GMT

POST
H2 204 collect
analytics.google.com/g/ 0
255 B 614ms
119ms Ping
text/plain 142.250.185.142
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-GCTMBVFESS&gtm=45je42q1v9122196611z89171248136za200&_p=1709077099410&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&cid=867216211.1709077101&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1709077100&sct=1&seg=0&dl=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass&dt=Understanding%20the%20ConnectWise%20ScreenConnect%20CVE-2024-1709%20%26%20CVE-2024-1708%20%7C%20Huntress%20Blog&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=2277
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-GCTMBVFESS&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.185.142 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s50-in-f14.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Feb 2024 23:38:21 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.huntress.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
255 B 602ms
113ms Ping
text/plain 74.125.71.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-GCTMBVFESS&cid=867216211.1709077101&gtm=45je42q1v9122196611z89171248136za200&aip=1&dma=0&gcd=13l3l3l3l1&npa=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-GCTMBVFESS&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.125.71.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wn-in-f156.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Feb 2024 23:38:22 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.huntress.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.co.il/ads/ 42 B
408 B 384ms
122ms Image
image/gif 142.250.186.67
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.il/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-GCTMBVFESS&cid=867216211.1709077101&gtm=45je42q1v9122196611z89171248136za200&aip=1&dma=0&gcd=13l3l3l3l1&npa=0&z=998094425

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Feb 2024 23:38:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 www-player-rtl.css
www.youtube.com/s/player/95cde7ed/ Frame 552A 367 KB
47 KB 117ms
117ms Stylesheet
text/css 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/95cde7ed/www-player-rtl.css

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY&enablejsapi=1&origin=https%3A%2F%2Fwww.huntress.com

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f14.1e100.net

Software

sffe /

Resource Hash

59435c97638a01eaf751949c97b484bac9ab16f17459f82e4a832b9a79e22910

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY&enablejsapi=1&origin=https%3A%2F%2Fwww.huntress.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 08:55:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52968
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 47657
x-xss-protection: 0
last-modified: Mon, 26 Feb 2024 05:14:55 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 26 Feb 2025 08:55:32 GMT

GET
H3 200 embed.js Show response
www.youtube.com/s/player/95cde7ed/player_ias.vflset/iw_IL/ Frame 552A 55 KB
17 KB 278ms
278ms Script
text/javascript 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/95cde7ed/player_ias.vflset/iw_IL/embed.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY&enablejsapi=1&origin=https%3A%2F%2Fwww.huntress.com

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f14.1e100.net

Software

sffe /

Resource Hash

58e89e283b8f550f453c0fb517da994c3529f6336d6d7bd1593ec0e04d8c102d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY&enablejsapi=1&origin=https%3A%2F%2Fwww.huntress.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 09:01:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52631
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17017
x-xss-protection: 0
last-modified: Mon, 26 Feb 2024 05:14:55 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 26 Feb 2025 09:01:09 GMT

GET
H3 200 www-embed-player.js Show response
www.youtube.com/s/player/95cde7ed/www-embed-player.vflset/ Frame 552A 319 KB
95 KB 113ms
112ms Script
text/javascript 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/95cde7ed/www-embed-player.vflset/www-embed-player.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY&enablejsapi=1&origin=https%3A%2F%2Fwww.huntress.com

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f14.1e100.net

Software

sffe /

Resource Hash

55014dbf69631ed5825be787f9c494ca876a9504a85a82fd32806bfe724be1c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY&enablejsapi=1&origin=https%3A%2F%2Fwww.huntress.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 21:22:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8150
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 97450
x-xss-protection: 0
last-modified: Mon, 26 Feb 2024 05:14:55 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 26 Feb 2025 21:22:30 GMT

GET
H3 200 base.js Show response
www.youtube.com/s/player/95cde7ed/player_ias.vflset/iw_IL/ Frame 552A 2 MB
780 KB 306ms
305ms Script
text/javascript 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/95cde7ed/player_ias.vflset/iw_IL/base.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY&enablejsapi=1&origin=https%3A%2F%2Fwww.huntress.com

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f14.1e100.net

Software

sffe /

Resource Hash

66689e1abd7d828b57f6b65035a71f1df855a4e80dc06d43fc0c2ef961fc5b3e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY&enablejsapi=1&origin=https%3A%2F%2Fwww.huntress.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 08:56:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52932
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 798278
x-xss-protection: 0
last-modified: Mon, 26 Feb 2024 05:14:55 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 26 Feb 2025 08:56:08 GMT

OPTIONS
H2 200 tp2
webhooks.fivetran.com/snowplow/ec8653cd-0011-4e95-956d-5d58fd8cd16e/com.snowplowanalytics.snowplow/ Frame 0
0 357ms
116ms Preflight
application/json 34.159.227.151
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://webhooks.fivetran.com/snowplow/ec8653cd-0011-4e95-956d-5d58fd8cd16e/com.snowplowanalytics.snowplow/tp2

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.159.227.151 Frankfurt am Main, Germany, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

151.227.159.34.bc.googleusercontent.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.huntress.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type
access-control-allow-methods: GET, POST, HEAD, OPTIONS
access-control-allow-origin: https://www.huntress.com
content-length: 0
content-type: application/json
date: Tue, 27 Feb 2024 23:38:20 GMT
strict-transport-security: max-age=15724800; includeSubDomains
vary: Origin

POST
H2 200 tp2 Show response
webhooks.fivetran.com/snowplow/ec8653cd-0011-4e95-956d-5d58fd8cd16e/com.snowplowanalytics.snowplow/ 53 B
325 B 487ms
251ms XHR
application/json 34.159.227.151
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://webhooks.fivetran.com/snowplow/ec8653cd-0011-4e95-956d-5d58fd8cd16e/com.snowplowanalytics.snowplow/tp2

Requested by

Host: huntresscdn.com
URL: https://huntresscdn.com/19680a27e88da4a3713af26571b4849096e75d617f2845574af7fd15746256bb.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.159.227.151 Frankfurt am Main, Germany, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

151.227.159.34.bc.googleusercontent.com

Software

Resource Hash

4081a5f270ace3305571b8f393e20c3a50141d103fb6fced35cf64d5182c2cd2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.huntress.com/
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

date: Tue, 27 Feb 2024 23:38:21 GMT
strict-transport-security: max-age=15724800; includeSubDomains
vary: Origin
access-control-allow-methods: GET, POST, HEAD, OPTIONS
content-type: application/json
access-control-allow-origin: https://www.huntress.com
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 53

GET
H3 200 www-widgetapi.js Show response
www.youtube.com/s/player/95cde7ed/www-widgetapi.vflset/ 216 KB
67 KB 689ms
688ms Script
text/javascript 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/95cde7ed/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f14.1e100.net

Software

sffe /

Resource Hash

e788d900c315814a8b4f8e8fff385175b5f9e79f5c0cab923a57b8088c4c9a13

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 20:03:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 12897
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68298
x-xss-protection: 0
last-modified: Mon, 26 Feb 2024 05:14:55 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 26 Feb 2025 20:03:23 GMT

GET
H2 200 187059084.js Show response
bat.bing.com/p/action/ 4 KB
2 KB 169ms
169ms Script
application/javascript 204.79.197.200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/187059084.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

204.79.197.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

a-0001.a-msedge.net

Software

Resource Hash

cf8edbedfd479fe7cc642e3a1db515dd1103f2d7864f0db5cae6144fbde44ea4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
date: Tue, 27 Feb 2024 23:38:20 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9035972CEC3E40888A95ABB4034C1A86 Ref B: TLV30EDGE0119 Ref C: 2024-02-27T23:38:20Z
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
cache-control: private,max-age=60

GET
H2 204 0
bat.bing.com/action/ 0
288 B 126ms
126ms Image
text/plain 204.79.197.200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=187059084&tm=gtm002&Ver=2&mid=206115b1-f2b2-44c8-b318-21e1e69318cb&sid=4a45dff0d5c911eeb157e538913bff34&vid=4a45fc40d5c911eeb9e1b5a134d70e9b&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Understanding%20the%20ConnectWise%20ScreenConnect%20CVE-2024-1709%20%26%20CVE-2024-1708%20%7C%20Huntress%20Blog&p=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass&r=&lt=1980&pt=1709077098283,,,,,0,45,45,45,416,101,416,611,631,613,1969,1972,1980,,,&pn=0,0&evt=pageLoad&sv=1&rn=543811

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

204.79.197.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

a-0001.a-msedge.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 27 Feb 2024 23:38:20 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: BF05E6E1D5C84095991CB1B4D2E65E9A Ref B: TLV30EDGE0119 Ref C: 2024-02-27T23:38:20Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 insight.old.min.js Show response
snap.licdn.com/li.lms-analytics/ 46 KB
16 KB 113ms
113ms Script
application/javascript 184.24.77.28
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.old.min.js

Requested by

Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.24.77.28 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a184-24-77-28.deploy.static.akamaitechnologies.com

Software

Resource Hash

dec888202913f9630b63196880ea2e96210c59df2905e55154fe88432c1b0e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 26 Feb 2024 18:22:15 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=58972
accept-ranges: bytes
content-length: 16524

GET
H2 200 modules.edfa88fa094af2bba7f9.js Show response
script.hotjar.com/ 229 KB
56 KB 393ms
164ms Script
application/javascript 13.32.27.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.edfa88fa094af2bba7f9.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2159185.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.27.21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-27-21.fra56.r.cloudfront.net

Software

Resource Hash

6432f355492e71d3ef3f718ece533e2b6d10d800849a41d4c308e48ef6ba128c

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 14:34:06 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 103eb504d36d97c9f30550032223d996.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 119055
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 56517
last-modified: Mon, 26 Feb 2024 14:33:54 GMT
etag: "14cc2670e7483f3dc272a5a42e445a4b"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: yGMa1Yg3WuLPm66BofJ-WcMmVBvCv-komSEC8Gs6s5XtIQsUcN7SJQ==

GET
H2 200 adsct
t.co/1/i/ 43 B
377 B 473ms
222ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=0fd361d6-0dd2-4d82-9672-60411de0ff49&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=f53b8092-8406-4319-9f51-a300d6869963&tw_document_href=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass&tw_iframe_status=0&txn_id=odo68&type=javascript&version=2.3.29

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-response-time: 103
date: Tue, 27 Feb 2024 23:38:20 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 85d1580f8380cebb
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: cbe8137b5e86e0dadee5ce3cc7551aca6adb451c5ccf789667f848b3caf06aae
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/1/i/ 43 B
725 B 552ms
298ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=0fd361d6-0dd2-4d82-9672-60411de0ff49&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=f53b8092-8406-4319-9f51-a300d6869963&tw_document_href=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass&tw_iframe_status=0&txn_id=odo68&type=javascript&version=2.3.29

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-response-time: 180
date: Tue, 27 Feb 2024 23:38:20 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 72e3b840d4bfd613
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: 74c05bf9a1f0cfbb33eb85ec10027b8860390a45f01ea055fc1258d5d46ca8b2
content-length: 43

GET
H2 200 sa.css
tags.srv.stackadapt.com/ 65 B
203 B 206ms
205ms Stylesheet
text/css 52.28.87.155
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.28.87.155 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-87-155.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 6d3e049fc10e5ccd8c18da785740145dc0d5393bd5c5bbfdb136f52023d07d5a

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 27 Feb 2024 23:38:20 GMT
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 65
content-type: text/css

GET
H2 200 sa.jpeg Show response
tags.srv.stackadapt.com/ 0
2 KB 437ms
208ms Fetch
image/jpeg 52.28.87.155
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.28.87.155 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-87-155.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 27 Feb 2024 23:38:21 GMT
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 651
content-type: image/jpeg

GET
H2 200 sa.jpeg Show response
tags.srv.stackadapt.com/ 0
2 KB 435ms
206ms Fetch
image/jpeg 52.28.87.155
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.28.87.155 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-87-155.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 27 Feb 2024 23:38:21 GMT
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 651
content-type: image/jpeg

GET
H2 200 gif.gif Show response
ibc-flow.techtarget.com/a/ 43 B
447 B 213ms
213ms XHR
image/gif 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=17715818&r=1709077100761&ref=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass&version=2.4
Requested by: Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

ibc_rate_tier: 17715818
Referer: https://www.huntress.com/
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:21 GMT
via: 1.1 google
x-guploader-uploadid: ABPtcPotBDSh2BUPB6XBp3G-YM9DsYv9UhuRyiJa30Yo7bHoTIDsaLVx3iOcGwv20uuPKVhCZQUGmANtNQ
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
last-modified: Thu, 08 Dec 2022 21:19:29 GMT
server: nginx/1.20.2
etag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
vary: Origin
x-goog-generation: 1670534369365034
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
cache-control: public, max-age=3600
access-control-allow-methods: GET, POST, OPTIONS
x-goog-stored-content-length: 43
accept-ranges: bytes
access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
expires: Wed, 28 Feb 2024 00:38:21 GMT

OPTIONS
H2 200 gif.gif
ibc-flow.techtarget.com/a/ Frame 0
0 334ms
206ms Preflight
text/html 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=17715818&r=1709077100761&ref=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass&version=2.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: ibc_rate_tier
Access-Control-Request-Method: GET
Origin: https://www.huntress.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 27 Feb 2024 23:38:20 GMT
expires: Tue, 27 Feb 2024 23:38:20 GMT
server: nginx/1.20.2
vary: Origin
via: 1.1 google
x-guploader-uploadid: ABPtcPo3IloAi9a7mmGLqy7NWssgqcg7uCvV5__ecWymx3qexAIJWyFzCQDoKYdIOLhi-uv97dqAlpoQbw

GET
H2 200 403957864408442 Show response
connect.facebook.net/signals/config/ 62 KB
13 KB 166ms
165ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/403957864408442?v=2.9.147&r=stable&domain=www.huntress.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

5172e93284d4516ea2e8fea2469a9b23556d92360b344cb50985c91db3cdbb12

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

permissions-policy-report-only: clipboard-read=(), clipboard-write=(), picture-in-picture=();report-to="permissions_policy"
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 27 Feb 2024 23:38:20 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
pragma: public
x-fb-debug: oRYmnn+KJFRb37mKb5vzvjjHr40KidT6sfDQmlyrd7BjDSM9c9vcnt/4Q4QOzhf/pdNQOGBQ9AdFqtthm9E3Ow==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-stack: www
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1709077100792&li_adsId=fefa79cb-efbe-4c2f-9db5-7409e0e7a5fb&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-und...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1709077100792&li_adsId=fefa79cb-efbe-4c2f-9db5-7409e0e7a5fb&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-und...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3281745%26time%3D1709077100792%26li_adsId%3Dfefa79cb-efbe-4c2f-9db5-7409e0e7a5fb%...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1709077100792&li_adsId=fefa79cb-efbe-4c2f-9db5-7409e0e7a5fb&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-und...

0
384 B

199ms
198ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1709077100792&li_adsId=fefa79cb-efbe-4c2f-9db5-7409e0e7a5fb&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass&cookiesTest=true&liSync=true
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:21 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 980ACBD4E20D47F7B2DB03A65A94426E Ref B: TLV30EDGE0116 Ref C: 2024-02-27T23:38:21Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYSZYWKgsMVGYIBvbnj1w==

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: frame-ancestors 'self'
x-content-type-options: nosniff
date: Tue, 27 Feb 2024 23:38:21 GMT
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-length: 0
x-li-uuid: AAYSZYWG/nmrkSomfxg3nw==
pragma: no-cache
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 926BACC5D2E9468AAC11CD573264A32C Ref B: TLV30EDGE0116 Ref C: 2024-02-27T23:38:21Z
x-frame-options: sameorigin
x-li-fabric: prod-lva1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1709077100792&li_adsId=fefa79cb-efbe-4c2f-9db5-7409e0e7a5fb&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass&cookiesTest=true&liSync=true
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
343 B 413ms
282ms XHR
text/plain 13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: *
Referer: https://www.huntress.com/
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 27 Feb 2024 23:38:21 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 91ABC5C27C9C430E9FB8080C903DEA74 Ref B: TLV30EDGE0116 Ref C: 2024-02-27T23:38:20Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
access-control-allow-origin: https://www.huntress.com
x-li-source-fabric: prod-ltx1
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYSZYWAadHTq9WIby2hag==

GET
H2 200 187059084 Show response
www.clarity.ms/tag/uet/ 829 B
1 KB 1437ms
194ms Script
application/x-javascript 13.107.213.45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/uet/187059084
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/p/action/187059084.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.213.45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 476391eb30402ffa649859e58b65a4524a75f3988f55777c0b19225db3699da9

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

expires: -1
date: Tue, 27 Feb 2024 23:38:22 GMT
x-azure-ref: 20240227T233822Z-easn74dzxh6epdh4wf64v2kxcg00000001hg0000000028t2
x-cache: CONFIG_NOCACHE
content-type: application/x-javascript
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 829
request-context: appId=cid-v1:2f7711a9-b21e-4abe-a9d6-5b0ce5d18b64

GET
H2 200 6si.min.js Show response
j.6sc.co/ 64 KB
18 KB 138ms
138ms Script
application/javascript 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/j/e666a54d-ff29-48f9-9baa-2be6ac05412e.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

8c1781ec4483c6fb3bd9ad005d312800eaf24e232c12976624bff84f8ab908b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Feb 2024 23:38:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 22 Feb 2024 19:00:41 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "65d799d9-101dd"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 17693
expires: Tue, 27 Feb 2024 23:38:20 GMT

GET
H2 200 notify Show response
api.neverbounce.com/v4/poe/ 63 B
283 B 616ms
212ms Script
application/javascript 34.202.4.253
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.neverbounce.com/v4/poe/notify?key=public_0e95e4405380cdd75d8aa57fca3692dc&event=form.load&callback=__neverbounce_203848

Requested by

Host: cdn.neverbounce.com
URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.202.4.253 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-202-4-253.compute-1.amazonaws.com

Software

nginx /

Resource Hash

7ae55f9afeb001ff5aef3f3754bb6ac0c9dfd9df171130572cbfc04db6e09e33

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:21 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, private
x-ua-compatible: IE=Edge

GET
H2 200 notify Show response
api.neverbounce.com/v4/poe/ 63 B
282 B 598ms
214ms Script
application/javascript 34.202.4.253
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.neverbounce.com/v4/poe/notify?key=public_0e95e4405380cdd75d8aa57fca3692dc&event=form.load&callback=__neverbounce_277024

Requested by

Host: cdn.neverbounce.com
URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.202.4.253 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-202-4-253.compute-1.amazonaws.com

Software

nginx /

Resource Hash

91fc65299ce98830bcd88fa13b9a5bd1880fde358af7c6cebe4b95f20e14cb20

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:21 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, private
x-ua-compatible: IE=Edge

OPTIONS
H2 200 traffic
api-gw.metadata.io/ Frame 0
0 812ms
264ms Preflight
application/json 54.68.63.216
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api-gw.metadata.io/traffic
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.68.63.216 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-68-63-216.us-west-2.compute.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.huntress.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods: OPTIONS,POST
access-control-allow-origin: *
access-control-max-age: 86400
content-length: 0
content-type: application/json
date: Tue, 27 Feb 2024 23:38:21 GMT
x-amz-apigw-id: T0bRLGy3vHcEh9w=
x-amzn-requestid: 35a9de08-2aa1-4647-a3c6-0a4106f88eef

POST
H2 202 traffic
api-gw.metadata.io/ 0
0 268ms
268ms Fetch
application/json 54.68.63.216
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api-gw.metadata.io/traffic
Requested by: Host: cdn.metadata.io
URL: https://cdn.metadata.io/site-insights.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.68.63.216 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-68-63-216.us-west-2.compute.amazonaws.com
Software: /
Resource Hash

Request headers

Referer: https://www.huntress.com/
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 27 Feb 2024 23:38:21 GMT
x-amzn-remapped-content-length: 0
x-amzn-remapped-connection: keep-alive
x-amzn-requestid: cb1cb873-f6be-4310-a60b-b77dd008e3f3
access-control-max-age: 1728000
access-control-allow-methods: OPTIONS,POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
content-length: 0
x-amzn-remapped-date: Tue, 27 Feb 2024 23:38:21 GMT
x-amz-apigw-id: T0bRNHciPHcEtgA=

GET
H2 204 cs
a.usbrowserspeed.com/ 0
0 858ms
294ms Fetch 34.217.7.238
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://a.usbrowserspeed.com/cs?pid=5de38576d91fe7ac65e01de48078379caf9e72e979b06a5762372b0c12e930ef&puid=lt50dmyvqjke10i4qr8
Requested by: Host: cdn.metadata.io
URL: https://cdn.metadata.io/site-insights.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.217.7.238 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-217-7-238.us-west-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:21 GMT
server: awselb/2.0

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 1383ms
117ms Image
text/plain 157.240.253.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=403957864408442&ev=PageView&dl=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass&rl=&if=false&ts=1709077100954&sw=1600&sh=1200&v=2.9.147&r=stable&ec=0&o=4126&fbp=fb.1.1709077100952.73046999&cs_est=true&ler=empty&cdl=API_unavailable&it=1709077100772&coo=false&exp=e1&rqm=GET

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.253.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-fra5.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 27 Feb 2024 23:38:22 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 t2_12z44i_telemetry Show response
www.redditstatic.com/ads/conversions-config/v1/pixel/config/ 86 B
700 B 300ms
110ms XHR
application/json 151.101.65.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/conversions-config/v1/pixel/config/t2_12z44i_telemetry
Requested by: Host: www.redditstatic.com
URL: https://www.redditstatic.com/ads/pixel.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 740bb313221bda5543b6fbe0bce3dd276cc70c4fd9aa0bae9d46b149406becf5

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:21 GMT
content-encoding: gzip
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
server: snooserv
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=300
accept-ranges: bytes
content-length: 98

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 292ms
95ms Image
image/gif 151.101.129.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1709077100960&id=t2_12z44i&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=f95fa1d1-5781-4dbb-8ad3-1300cc43f7fa&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_c9439d84&dpm=&dpcc=&dprc=
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:21 GMT
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server: Varnish
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

GET
H2 200 / Show response
c.6sc.co/ 7 B
194 B 169ms
161ms XHR
text/html 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-184.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:21 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.huntress.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 4 B
282 B 351ms
111ms XHR
text/html 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-184.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Feb 2024 23:38:21 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.huntress.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: null
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1709077101175_34694324_633411604_24_942_54_114_219";dur=1
content-length: 4
expires: Tue, 27 Feb 2024 23:38:21 GMT

GET
H2 200 json Show response
forms.hscollectedforms.net/collected-forms/v1/config/ 115 B
435 B 310ms
301ms XHR
application/json 104.17.89.154
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=3911692&utk=

Requested by

Host: js.hscollectedforms.net
URL: https://js.hscollectedforms.net/collectedforms.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.89.154 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5d247e1c2efc38a727967b2f5f9e99b961d0cbe2b0aa1ddcf170bd6933409403

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.huntress.com/
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:21 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 8ed80b10-0c96-4eaf-9497-82dfffb1713e
x-envoy-upstream-service-time: 14
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 8ed80b10-0c96-4eaf-9497-82dfffb1713e
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.huntress.com
x-evy-trace-virtual-host: all
cache-control: max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-576f9d768-kfhpt
access-control-max-age: 180
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 85c442caec08e3e7-TLV

GET
H2 200 combinedConfigs Show response
cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/ 404 B
1 KB 235ms
227ms Fetch
application/json 104.19.155.83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=3911692&currentUrl=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Requested by

Host: js.hubspot.com
URL: https://js.hubspot.com/web-interactives-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.155.83 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

629de5c42a56b67812a858341eb4162b85218eed884271ca47b0388498dc8916

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 843b5ff7-11b3-401f-b654-a24901822b8e
content-encoding: br
x-envoy-upstream-service-time: 14
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 843b5ff7-11b3-401f-b654-a24901822b8e
server: cloudflare
vary: origin
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.huntress.com
x-evy-trace-virtual-host: all
access-control-max-age: 180
access-control-allow-credentials: true
cache-control: max-age=0, no-cache, no-store
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zZMFQMG4MBmqr3rV6GMHacUpIJcr7Bv%2FTX6r4PQdImTpvyCwCGuhAf4VllfgS1%2FOm18trlopnyc4ziS5ZOACtthFNEQdjF%2B3v6%2BAFo8VnvwNgwH3b%2FtBzExktixVgdYMPUUzEM%2F2GsoZV2aQ5jY%3D"}],"group":"cf-nel","max_age":604800}
x-robots-tag: noindex, follow
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 85c442cb0919e3e3-TLV
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-bfd765d7d-pd6kl

GET
DATA 200
OK truncated
/ Frame 8E35 14 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e

Request headers

accept-language: he-IL,he;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 8E35 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27

Request headers

accept-language: he-IL,he;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 8E35 2 KB
2 KB 112ms
111ms Image
image/png 142.250.185.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__rtl.css

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f3.1e100.net

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__rtl.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 08:49:56 GMT
x-content-type-options: nosniff
age: 53305
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2228
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Tue, 05 Mar 2024 08:49:56 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 8E35 15 KB
16 KB 340ms
111ms Font
font/woff2 142.250.185.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f3.1e100.net

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 09:03:23 GMT
x-content-type-options: nosniff
age: 52498
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 Feb 2025 09:03:23 GMT

GET
H3 200 sLPIoIr_9R2H1vFE63bCW9_RmUPMbLk-XyKwDAco0G4.js Show response
www.google.com/js/bg/ Frame 8E35 17 KB
7 KB 111ms
111ms Script
text/javascript 216.58.206.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/js/bg/sLPIoIr_9R2H1vFE63bCW9_RmUPMbLk-XyKwDAco0G4.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__iw.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.36 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil07s07-in-f4.1e100.net

Software

sffe /

Resource Hash

b0b3c8a08afff51d87d6f144eb76c25bdfd19943cc6cb93e5f22b00c0728d06e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LchEywUAAAAAAdAXlscEm7Kcb3DJ38pngRCQJsC&co=aHR0cHM6Ly93d3cuaHVudHJlc3MuY29tOjQ0Mw..&hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=normal&cb=h2nkydj1k8y7
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 09:07:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52274
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6937
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 17:30:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 26 Feb 2025 09:07:07 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame 8E35 102 B
135 B 122ms
122ms Other
text/javascript 216.58.206.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.36 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil07s07-in-f4.1e100.net

Software

GSE /

Resource Hash

15968c31de4feede3cef1e6d6f6d22cdf0e3357c787b8c33a9385680aa5e83d7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LchEywUAAAAAAdAXlscEm7Kcb3DJ38pngRCQJsC&co=aHR0cHM6Ly93d3cuaHVudHJlc3MuY29tOjQ0Mw..&hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=normal&cb=h2nkydj1k8y7
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Tue, 27 Feb 2024 23:38:21 GMT

GET
H2 200 saq_pxl Show response
tags.srv.stackadapt.com/ 138 B
333 B 208ms
208ms XHR
text/plain 52.28.87.155
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=yZKscIIzalsoNin7qAYxQw&is_js=true&landing_url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass&t=Understanding%20the%20ConnectWise%20ScreenConnect%20CVE-2024-1709%20%26%20CVE-2024-1708%20%7C%20Huntress%20Blog&tip=qTABNz3tUh1FUzwesI98DSX6LbkiDsMbKGU1sAEUFP8&host=https%3A%2F%2Fwww.huntress.com&sa-user-id-v3=s%253AAQAKINJGnSPnUygUSibcDPrkRZickSSvG-6Xqu_tHEN4GYmmEHwYBCDs5PmuBjABOgRUSQl9QgToZ2c4.Xh2VH3FdpBxTPoEGCG4Cijixgda9MMOBWAwiNqok2I4&sa-user-id-v2=s%253A2yI2DyuVUV1v8y8qpqw3-R-7TuQ.YGWzqnaxj%252BHgfY4udI8iA08It2bK%252FDTTtBWVUj3EHEo&sa-user-id=s%253A0-db22360f-2b95-515d-6ff3-2f2aa6ac37f9.%252Bgb2Ni7iJXYdCIsAsMuD5YsexKsvOuWHMxgU3tLIwHY
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.28.87.155 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-87-155.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: fc573eaf0e39d6b2429951f78b744dde5acb4cbee85a9b903aea0210072d9b48

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

access-control-allow-origin: https://www.huntress.com
date: Tue, 27 Feb 2024 23:38:21 GMT
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 138
access-control-allow-methods: GET
content-type: text/plain; charset=utf-8

GET
H2 200 saq_pxl Show response
tags.srv.stackadapt.com/ 138 B
333 B 208ms
208ms XHR
text/plain 52.28.87.155
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=yZKscIIzalsoNin7qAYxQw&is_js=true&landing_url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass&t=Understanding%20the%20ConnectWise%20ScreenConnect%20CVE-2024-1709%20%26%20CVE-2024-1708%20%7C%20Huntress%20Blog&tip=qTABNz3tUh1FUzwesI98DSX6LbkiDsMbKGU1sAEUFP8&host=https%3A%2F%2Fwww.huntress.com&sa-user-id-v3=s%253AAQAKINJGnSPnUygUSibcDPrkRZickSSvG-6Xqu_tHEN4GYmmEHwYBCDs5PmuBjABOgRUSQl9QgToZ2c4.Xh2VH3FdpBxTPoEGCG4Cijixgda9MMOBWAwiNqok2I4&sa-user-id-v2=s%253A2yI2DyuVUV1v8y8qpqw3-R-7TuQ.YGWzqnaxj%252BHgfY4udI8iA08It2bK%252FDTTtBWVUj3EHEo&sa-user-id=s%253A0-db22360f-2b95-515d-6ff3-2f2aa6ac37f9.%252Bgb2Ni7iJXYdCIsAsMuD5YsexKsvOuWHMxgU3tLIwHY
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.28.87.155 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-87-155.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: fc573eaf0e39d6b2429951f78b744dde5acb4cbee85a9b903aea0210072d9b48

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

access-control-allow-origin: https://www.huntress.com
date: Tue, 27 Feb 2024 23:38:21 GMT
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 138
access-control-allow-methods: GET
content-type: text/plain; charset=utf-8

GET
H2

200

id Show response
googleads.g.doubleclick.net/pagead/ Frame 552A
Redirect Chain

https://googleads.g.doubleclick.net/pagead/id
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

100 B
242 B

119ms
119ms

XHR
application/json

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY&enablejsapi=1&origin=https%3A%2F%2Fwww.huntress.com

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s65-in-f2.1e100.net

Software

cafe /

Resource Hash

151ec725ee7c99ca4c03243ba1d27d9bdc55c8c84048664eb854634a57b2e80b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 120
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 27 Feb 2024 23:38:21 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
access-control-allow-origin: https://www.youtube.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad_status.js Show response
static.doubleclick.net/instream/ Frame 552A 29 B
494 B 601ms
112ms Script
text/javascript 142.250.186.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.doubleclick.net/instream/ad_status.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/95cde7ed/www-embed-player.vflset/www-embed-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f6.1e100.net

Software

sffe /

Resource Hash

eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:33:41 GMT
x-content-type-options: nosniff
age: 280
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29
x-xss-protection: 0
last-modified: Thu, 12 Dec 2013 23:40:16 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 27 Feb 2024 23:48:41 GMT

GET
BLOB 200
OK 3d42140d-dc89-4cde-813a-a782b52cdc4e
https://www.huntress.com/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://www.huntress.com/3d42140d-dc89-4cde-813a-a782b52cdc4e
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Content-Length: 43
Content-Type: image/gif

OPTIONS
H2 200 Create
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 0
0 1391ms
119ms Preflight
text/html 216.58.206.42
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.42 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil07s07-in-f10.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-goog-api-key,x-user-agent
Access-Control-Request-Method: POST
Origin: https://www.youtube.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,x-goog-api-key,x-user-agent
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://www.youtube.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Tue, 27 Feb 2024 23:38:22 GMT
server: ESF
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H2 200 Create Show response
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 552A 87 KB
40 KB 129ms
128ms XHR
application/json+protobuf 216.58.206.42
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/95cde7ed/player_ias.vflset/iw_IL/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.42 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil07s07-in-f10.1e100.net

Software

ESF /

Resource Hash

5c3f7385d27ae86b8a0dd50875bd728710993ca9d36000aa0d2ad20a4a6c1d1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-User-Agent: grpc-web-javascript/0.1
Referer: https://www.youtube.com/
X-Goog-Api-Key: AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/json+protobuf

Response headers

date: Tue, 27 Feb 2024 23:38:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json+protobuf; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41002
x-xss-protection: 0

GET
H3 200 remote.js Show response
www.youtube.com/s/player/95cde7ed/player_ias.vflset/iw_IL/ Frame 552A 118 KB
33 KB 113ms
113ms Script
text/javascript 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/95cde7ed/player_ias.vflset/iw_IL/remote.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/95cde7ed/player_ias.vflset/iw_IL/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f14.1e100.net

Software

sffe /

Resource Hash

7879306396985ae1d55e9b084fcb0793214a169a262770770886f3f9eaf4dae3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY&enablejsapi=1&origin=https%3A%2F%2Fwww.huntress.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 08:49:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53353
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34087
x-xss-protection: 0
last-modified: Mon, 26 Feb 2024 05:14:55 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 26 Feb 2025 08:49:08 GMT

GET
H3 200 6mt_jkCC8QEMfVv4UaXe0WVRezbgElH9_VSMBGBwk28.js Show response
www.google.com/js/th/ Frame 552A 51 KB
20 KB 111ms
111ms Script
text/javascript 216.58.206.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/js/th/6mt_jkCC8QEMfVv4UaXe0WVRezbgElH9_VSMBGBwk28.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/95cde7ed/player_ias.vflset/iw_IL/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.36 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil07s07-in-f4.1e100.net

Software

sffe /

Resource Hash

ea6b7f8e4082f1010c7d5bf851a5ded165517b36e01251fdfd548c046070936f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 18:07:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19853
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19990
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 17:30:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 26 Feb 2025 18:07:28 GMT

GET
H2 200 maxresdefault.jpg
i.ytimg.com/vi/AWGoGO5jnvY/ Frame 552A 69 KB
69 KB 1394ms
115ms Image
image/jpeg 142.250.185.246
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.ytimg.com/vi/AWGoGO5jnvY/maxresdefault.jpg?sqp=-oaymwEmCIAKENAF8quKqQMa8AEB-AH-CYAC0AWKAgwIABABGEUgUihlMA8=&rs=AOn4CLAys0HIBW2uv1R2Z5Vr9OeTP0HhWg

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY&enablejsapi=1&origin=https%3A%2F%2Fwww.huntress.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.246 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f22.1e100.net

Software

sffe /

Resource Hash

57060dd390b97abfdefa4db0309a06cff310bfd52f220bbf2f4f83886cfde641

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 22:26:44 GMT
x-content-type-options: nosniff
age: 4298
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 70384
x-xss-protection: 0
server: sffe
etag: "0"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 28 Feb 2024 00:26:44 GMT

GET
DATA 200
OK truncated
/ Frame 552A 175 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2

Request headers

accept-language: he-IL,he;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 6FqcWoHZvrZixaGi1S3Re3Z90SCS3iq2_36hQSnSHQPtQVVkywH8WKka53MiBYBSP6DmqM-g9w=s68-c-k-c0x00ffffff-no-rj
yt3.ggpht.com/ Frame 552A 3 KB
3 KB 378ms
114ms Image
image/jpeg 172.217.18.1
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://yt3.ggpht.com/6FqcWoHZvrZixaGi1S3Re3Z90SCS3iq2_36hQSnSHQPtQVVkywH8WKka53MiBYBSP6DmqM-g9w=s68-c-k-c0x00ffffff-no-rj

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY&enablejsapi=1&origin=https%3A%2F%2Fwww.huntress.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra02s19-in-f1.1e100.net

Software

fife /

Resource Hash

819dfbb3b4773187de06060775662d73315d109d3eeb1a31e28d49112ab2fe47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 21:31:47 GMT
x-content-type-options: nosniff
age: 7594
cross-origin-resource-policy: cross-origin
content-disposition: inline;filename="channels4_profile.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2963
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 28 Feb 2024 21:31:47 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 552A 15 KB
15 KB 201ms
167ms Font
font/woff2 142.250.185.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY&enablejsapi=1&origin=https%3A%2F%2Fwww.huntress.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f3.1e100.net

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
Origin: https://www.youtube.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Fri, 23 Feb 2024 11:07:48 GMT
x-content-type-options: nosniff
age: 390633
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 22 Feb 2025 11:07:48 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 552A 15 KB
15 KB 223ms
189ms Font
font/woff2 142.250.185.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY&enablejsapi=1&origin=https%3A%2F%2Fwww.huntress.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f3.1e100.net

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
Origin: https://www.youtube.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 09:03:23 GMT
x-content-type-options: nosniff
age: 52498
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 Feb 2025 09:03:23 GMT

OPTIONS
H2 200 view
js.hs-banner.com/cookie-banner-public/v1/activity/ Frame 0
0 1645ms
504ms Preflight
application/octet-stream 172.64.153.27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/cookie-banner-public/v1/activity/view
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.27 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.huntress.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
access-control-allow-origin: https://www.huntress.com
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
access-control-max-age: 604800
cf-cache-status: DYNAMIC
cf-ray: 85c442d3ccd1e3e7-TLV
content-length: 0
content-type: application/octet-stream
date: Tue, 27 Feb 2024 23:38:23 GMT
server: cloudflare
timing-allow-origin: *
vary: origin
x-envoy-upstream-service-time: 0
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-8555f56d-pbxg4
x-evy-trace-virtual-host: all
x-hubspot-correlation-id: 8c63296b-e4b6-4c05-bd88-3fe65b8d010c
x-request-id: 8c63296b-e4b6-4c05-bd88-3fe65b8d010c

POST
H2 204 view Show response
js.hs-banner.com/cookie-banner-public/v1/activity/ 0
173 B 233ms
233ms XHR
text/plain 172.64.153.27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-banner.com/cookie-banner-public/v1/activity/view

Requested by

Host: js.hs-banner.com
URL: https://js.hs-banner.com/3911692.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.153.27 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.huntress.com/
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 27 Feb 2024 23:38:23 GMT
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 2ceb774f-5761-4afd-a3a5-16148f6b39d7
x-envoy-upstream-service-time: 21
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 2ceb774f-5761-4afd-a3a5-16148f6b39d7
server: cloudflare
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
access-control-allow-origin: https://www.huntress.com
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
vary: origin
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-8555f56d-hgmm2
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 85c442d6ea51e3e7-TLV

GET
H/1.1 200
OK counters.gif
perf-na1.hsforms.com/embed/v3/ 35 B
1 KB 1368ms
226ms Image
image/gif 104.17.207.249
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

104.17.207.249 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date: Tue, 27 Feb 2024 23:38:22 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: MISS
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: fa401f60-d6fd-4ff3-9f6b-38b160df9381
x-envoy-upstream-service-time: 5
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: fa401f60-d6fd-4ff3-9f6b-38b160df9381
Last-Modified: Tue, 27 Feb 2024 23:38:22 GMT
Server: cloudflare
X-Trace: 2BB9AD773BE0241CA3027DC3758139246064A23AC8000000000000000000
Vary: origin, Accept-Encoding
Content-Type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-bfd765d7d-4s88s
Access-Control-Expose-Headers: X-Origin-Hublet
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
X-Robots-Tag: none
CF-RAY: 85c442d3cfede3db-TLV

GET
H/1.1 200
OK counters.gif
forms.hsforms.com/embed/v3/ 35 B
1015 B 639ms
513ms Image
image/gif 104.18.160.125
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=4

Requested by

Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

104.18.160.125 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date: Tue, 27 Feb 2024 23:38:22 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: 64578e5d-c1f0-415f-be2c-b315d1a12c2f
x-envoy-upstream-service-time: 4
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 64578e5d-c1f0-415f-be2c-b315d1a12c2f
Server: cloudflare
X-Trace: 2B9C2C7700C2A1406B7DA3A99FAD98A20D500FFB7D000000000000000000
Vary: origin
Content-Type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-bfd765d7d-r4fkb
Access-Control-Expose-Headers: X-Origin-Hublet
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: false
X-Robots-Tag: none
CF-RAY: 85c442cdf855e3ed-TLV

GET
H3 200 cast_sender.js Show response
www.gstatic.com/cv/js/sender/v1/ Frame 552A 4 KB
2 KB 163ms
163ms Script
text/javascript 142.250.185.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/95cde7ed/player_ias.vflset/iw_IL/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f3.1e100.net

Software

sffe /

Resource Hash

ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2007
x-xss-protection: 0
last-modified: Tue, 16 Feb 2021 23:57:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="cloudview"
vary: Accept-Encoding
report-to: {"group":"cloudview","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 27 Feb 2024 23:38:21 GMT

GET
H3 204 generate_204
www.youtube.com/ Frame 552A 0
10 B 112ms
111ms Image
text/plain 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.youtube.com/generate_204?Ea64Dg
Requested by: Host: www.youtube.com
URL: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY&enablejsapi=1&origin=https%3A%2F%2Fwww.huntress.com
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.184.238 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s12-in-f14.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY&enablejsapi=1&origin=https%3A%2F%2Fwww.huntress.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:21 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 bframe Show response
www.google.com/recaptcha/api2/ Frame E6DC 7 KB
1 KB 124ms
123ms Document
text/html 216.58.206.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6LchEywUAAAAAAdAXlscEm7Kcb3DJ38pngRCQJsC

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__iw.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.36 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil07s07-in-f4.1e100.net

Software

GSE /

Resource Hash

8bb32fa0e592e2a44960ae7968209505aa45089c8ad2259d2b972523bde374c7

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-KXO-vC03e4EbD5aFQskL0Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.huntress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: he-IL,he;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-KXO-vC03e4EbD5aFQskL0Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 27 Feb 2024 23:38:21 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 cast_sender.js Show response
www.gstatic.com/eureka/clank/122/ Frame 552A 50 KB
14 KB 112ms
112ms Script
text/javascript 142.250.185.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/eureka/clank/122/cast_sender.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f3.1e100.net

Software

sffe /

Resource Hash

765a638d2813ec1b917fc56cf90863f88991ef2550c1a14c99e9e9b243e80f74

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 07:30:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58075
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview-release
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14711
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 16:03:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="cloudview-release"
vary: Accept-Encoding
report-to: {"group":"cloudview-release","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview-release"}]}
content-type: text/javascript
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Wed, 28 Feb 2024 07:30:26 GMT

GET
H3 200 styles__rtl.css
www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/ Frame E6DC 55 KB
24 KB 112ms
112ms Stylesheet
text/css 142.250.185.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__rtl.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6LchEywUAAAAAAdAXlscEm7Kcb3DJ38pngRCQJsC

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f3.1e100.net

Software

sffe /

Resource Hash

5f206b060caf20ae38c428c1bad44ccaf68b6345b63f2a7f06428e9747526c06

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Fri, 23 Feb 2024 11:25:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 389583
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24601
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 05:01:55 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 22 Feb 2025 11:25:18 GMT

GET
H3 200 recaptcha__iw.js Show response
www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/ Frame E6DC 518 KB
198 KB 120ms
120ms Script
text/javascript 142.250.185.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__iw.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6LchEywUAAAAAAdAXlscEm7Kcb3DJ38pngRCQJsC

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f3.1e100.net

Software

sffe /

Resource Hash

e5724b80dd7456460f12db0a8870676b40184fa7076eb751afb23be11164719c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 09:02:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52522
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 203025
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 05:01:55 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 26 Feb 2025 09:02:59 GMT

GET
H2 200 clarity.js Show response
www.clarity.ms/s/0.7.20/ 60 KB
25 KB 79ms
79ms Script
application/javascript 13.107.213.45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/s/0.7.20/clarity.js
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/uet/187059084
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.213.45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: cbcfb303a1e7d1f9da8965565b535f4122f2de2f1f3ed9f61f3f9e2dad3dcf9d

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:22 GMT
content-encoding: br
last-modified: Wed, 24 Jan 2024 14:33:55 GMT
etag: W/"0x8DC1CE97EB406F9"
vary: Accept-Encoding
x-azure-ref: 20240227T233822Z-easn74dzxh6epdh4wf64v2kxcg00000001hg0000000028t5
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
x-ms-request-id: 8b532d29-501e-0039-0a13-68d5c7000000
cache-control: public, max-age=86400
x-cache: TCP_HIT
x-ms-version: 2018-03-28
x-fd-int-roxy-purgeid: 51562430

POST
H/1.1 204
No Content collect Show response
p.clarity.ms/ 0
296 B 878ms
483ms XHR
text/plain 20.122.63.128
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://p.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.20/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.122.63.128 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://www.huntress.com/
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://www.huntress.com
Date: Tue, 27 Feb 2024 23:38:23 GMT
Access-Control-Allow-Credentials: true
Server: nginx/1.18.0 (Ubuntu)
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:2f7711a9-b21e-4abe-a9d6-5b0ce5d18b64

GET
H2 200 getuidj Show response
secure.adnxs.com/ 11 B
701 B 352ms
115ms XHR
application/json 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Feb 2024 23:38:23 GMT
an-x-request-uuid: 86d4d92e-0f05-460c-96bf-814adebdb650
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.huntress.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 31.187.78.228; 31.187.78.228; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 11
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
194 B 112ms
111ms XHR
text/html 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-184.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:23 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.huntress.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 4 B
281 B 128ms
128ms XHR
text/html 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-184.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Feb 2024 23:38:23 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.huntress.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: null
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1709077103033_34694324_633415311_20_1040_54_0_219";dur=1
content-length: 4
expires: Tue, 27 Feb 2024 23:38:23 GMT

GET
H2 200 core Show response
rc-widget-frame.js.driftt.com/ Frame FE57 2 KB
1 KB 641ms
411ms Document
text/html 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1709077200000/5d3cypit2iz8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

14e6206b0b854f8eb373b1ccfbac42efdb97e1034de1355abb4ee81aa0672ec2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.huntress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: he-IL,he;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-encoding: gzip
content-type: text/html
date: Tue, 27 Feb 2024 23:38:23 GMT
etag: W/"6a5cea74d414ec151635bd2880abb1c3"
last-modified: Mon, 21 Aug 2023 14:57:03 GMT
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-id: 5GcyAGCZ0c1bWndJSLHTkw7BjAcxN1JlsnSnhbBpv1jFBGvOuZVpFw==
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-amz-version-id: hIxJdEPbt_45OV8bTT9Ad1M7VE.ABA8G
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 23

GET
H2 200 blockedDomains.json Show response
hubspotonwebflow.com/assets/js/ 98 KB
23 KB 131ms
131ms Fetch
application/json 76.76.21.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://hubspotonwebflow.com/assets/js/blockedDomains.json

Requested by

Host: hubspotonwebflow.com
URL: https://hubspotonwebflow.com/assets/js/form-123.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.22 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

944352d0198c673b45a699471c970aef85458ea3c58a3ed825b0f0e4f33f999c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:23 GMT
content-encoding: br
strict-transport-security: max-age=63072000
server: Vercel
x-vercel-id: fra1::xzmk6-1709077103035-4edd7fc22a75
age: 60
x-matched-path: /assets/js/blockedDomains.json
etag: W/"04708d47dd194d37b8231a65de7a66f1"
x-vercel-cache: HIT
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
content-disposition: inline; filename="blockedDomains.json"

GET
H2 200 blockList Show response
hubspotonwebflow.com/api/forms/ 47 B
137 B 259ms
258ms Fetch
application/json 76.76.21.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://hubspotonwebflow.com/api/forms/blockList?id=92048dff-ffdc-421f-9344-58c3ff0002d9

Requested by

Host: hubspotonwebflow.com
URL: https://hubspotonwebflow.com/assets/js/form-123.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.22 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

b9b4f19dee3d4910ab6fb4ea6e8a3126cfd5386c0bec674b65461a5192dba995

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:23 GMT
content-encoding: br
strict-transport-security: max-age=63072000
server: Vercel
x-vercel-id: fra1::iad1::gz9lg-1709077103036-7ba93fa9e77c
age: 0
x-matched-path: /api/forms/blockList
x-vercel-cache: MISS
vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: *
x-vercel-execution-region: iad1
cache-control: public, max-age=0, must-revalidate
access-control-allow-headers: Content-Type, Authorization

GET
H2 200 blockList Show response
hubspotonwebflow.com/api/forms/ 47 B
328 B 257ms
257ms Fetch
application/json 76.76.21.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://hubspotonwebflow.com/api/forms/blockList?id=c32ae9e7-4a4b-4436-a6e4-0de41bd8df62

Requested by

Host: hubspotonwebflow.com
URL: https://hubspotonwebflow.com/assets/js/form-123.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.22 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

b9b4f19dee3d4910ab6fb4ea6e8a3126cfd5386c0bec674b65461a5192dba995

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:23 GMT
content-encoding: br
strict-transport-security: max-age=63072000
server: Vercel
x-vercel-id: fra1::iad1::xrzkr-1709077103036-e0c68f0192e4
age: 0
x-matched-path: /api/forms/blockList
x-vercel-cache: MISS
vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: *
x-vercel-execution-region: iad1
cache-control: public, max-age=0, must-revalidate
access-control-allow-headers: Content-Type, Authorization

GET
H2 200 zi-tag.js Show response
js.zi-scripts.com/ 8 KB
3 KB 198ms
70ms Script
application/javascript 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/zi-tag.js
Requested by: Host: www.huntress.com
URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bfae35edc61595bd27d16c01ddc44ef00c152c0006e16f836101d3b6a6621d01

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:23 GMT
x-amz-version-id: lFoq_FZJwJ3rDVe9.7kNMZjc5YKK6r5L
content-encoding: gzip
cf-cache-status: DYNAMIC
last-modified: Mon, 11 Dec 2023 12:17:02 GMT
server: cloudflare
via: 1.1 c929a0b0be95dbd556dd38270accc062.cloudfront.net (CloudFront)
x-amz-cf-pop: TLV50-C1
etag: W/"15c02cdee0df6c26ba3d8c62d912c66c"
age: 66144
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cf-ray: 85c442d69a0ee3d3-TLV
x-amz-cf-id: TEvUwyP_wyFcvK2bsQAVYbIu0IShaS09LCoFlLKIcDw3FPLYC3Ay9Q==

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
1 KB 624ms
248ms Image
image/gif 104.19.155.83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=4083444840&v=1.1&a=3911692&rcu=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass&pu=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass&t=Understanding+the+ConnectWise+ScreenConnect+CVE-2024-1709+%26+CVE-2024-1708+%7C+Huntress+Blog&cts=1709077102983&vi=ca3bc6e6d3fcc67841aef50987ffaac7&nc=true&ce=false&pt=1&cc=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.155.83 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 9c469070-45fd-401f-8852-070942b397e9
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 12
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 9c469070-45fd-401f-8852-070942b397e9
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=98ct6jV30wef6s0SlukyhbLV67NTt1UGjS2mzSS8W4M%2Bi5FqWJjrO%2BRn3rS5vc8%2Fqk3%2B8S8ukrYNlOVutTNmhdSntY1RP0XAw61b9Ua1jMBfc5nj%2BXRLoG78TI9e4DOzCtxl"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-68f68ffdf9-fs88q
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 85c442d82b96e3d7-TLV
x-robots-tag: none

GET
H2

200

c.gif
c.clarity.ms/
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=B383D687DAAE40348FAA08D31EE76F1F&RedC=c.clarity.ms&MXFR=1D426B4DAF3363AC0F3F7F7FAB336D43
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=B383D687DAAE40348FAA08D31EE76F1F&MUID=1DC059F4C13F6EC3391F4DC6C0426FE0

42 B
443 B

133ms
132ms

Image
image/gif

68.219.88.97
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=B383D687DAAE40348FAA08D31EE76F1F&MUID=1DC059F4C13F6EC3391F4DC6C0426FE0
Protocol: H2
Server: 68.219.88.97 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Feb 2024 23:38:23 GMT
last-modified: Fri, 09 Feb 2024 19:55:32 GMT
server: Microsoft-IIS/10.0
etag: "2155d7f0915bda1:0"
x-powered-by: ASP.NET
content-type: image/gif
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-length: 42

Redirect headers

pragma: no-cache
date: Tue, 27 Feb 2024 23:38:23 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 45532E1B448148179990539F247FF422 Ref B: TLV30EDGE0119 Ref C: 2024-02-27T23:38:23Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=B383D687DAAE40348FAA08D31EE76F1F&MUID=1DC059F4C13F6EC3391F4DC6C0426FE0
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

OPTIONS
H3 200 GenerateIT
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 0
0 119ms
119ms Preflight
text/html 216.58.206.42
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.42 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil07s07-in-f10.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-goog-api-key,x-user-agent
Access-Control-Request-Method: POST
Origin: https://www.youtube.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,x-goog-api-key,x-user-agent
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://www.youtube.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Tue, 27 Feb 2024 23:38:23 GMT
server: ESF
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 GenerateIT Show response
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 552A 90 B
134 B 123ms
123ms XHR
application/json+protobuf 216.58.206.42
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/95cde7ed/player_ias.vflset/iw_IL/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.42 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil07s07-in-f10.1e100.net

Software

ESF /

Resource Hash

b9c3b5c8dd9fda103f750f15c52b04423cf1791056ed251dad9e80210987f877

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-User-Agent: grpc-web-javascript/0.1
Referer: https://www.youtube.com/
X-Goog-Api-Key: AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/json+protobuf

Response headers

date: Tue, 27 Feb 2024 23:38:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json+protobuf; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 110
x-xss-protection: 0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 394ms
384ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=a87a3edc53b5a86d1795d11887b5aa39&svisitor=null&visitor=94f1245d-4338-4d83-8c17-f4ba37077af1&session=6a5f63fa-13cf-4747-86df-4a5079ac9bfc&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Tue%2C%2027%20Feb%202024%2023%3A38%3A19%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22This%20blog%20discusses%20the%20Huntress%20Team%27s%20analysis%20efforts%20of%20the%20two%20vulnerabilities%20and%20software%20weaknesses%20in%20ConnectWise%20ScreenConnect%20(CVE-2024-1708%20and%20CVE-2024-1709)%20and%20the%20technical%20details%20behind%20this%20attack.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Understanding%20the%20ConnectWise%20ScreenConnect%20CVE-2024-1709%20%26amp%3B%20CVE-2024-1708%20%7C%20Huntress%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass&pageViewId=4b06a3b9-855e-4373-824b-5959b0bd39aa&webTagId=e666a54d-ff29-48f9-9baa-2be6ac05412e&v=1.1.15

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:23 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 342ms
332ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=a87a3edc53b5a86d1795d11887b5aa39&svisitor=null&visitor=94f1245d-4338-4d83-8c17-f4ba37077af1&session=6a5f63fa-13cf-4747-86df-4a5079ac9bfc&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22a87a3edc53b5a86d1795d11887b5aa39%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2027%20Feb%202024%2023%3A38%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2027%20Feb%202024%2023%3A38%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22c081b6bcc07a45b013b81ff3441b82387640805c%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2027%20Feb%202024%2023%3A38%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2027%20Feb%202024%2023%3A38%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2027%20Feb%202024%2023%3A38%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2027%20Feb%202024%2023%3A38%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setWhiteListFields%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2027%20Feb%202024%2023%3A38%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2027%20Feb%202024%2023%3A38%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%228769192b-20ba-4df2-8d62-2740a805c3e8%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2027%20Feb%202024%2023%3A38%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2027%20Feb%202024%2023%3A38%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCompanyDetailsExpiration%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2027%20Feb%202024%2023%3A38%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableMapCookieCapture%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2027%20Feb%202024%2023%3A38%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2027%20Feb%202024%2023%3A38%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22This%20blog%20discusses%20the%20Huntress%20Team%27s%20analysis%20efforts%20of%20the%20two%20vulnerabilities%20and%20software%20weaknesses%20in%20ConnectWise%20ScreenConnect%20(CVE-2024-1708%20and%20CVE-2024-1709)%20and%20the%20technical%20details%20behind%20this%20attack.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Understanding%20the%20ConnectWise%20ScreenConnect%20CVE-2024-1709%20%26amp%3B%20CVE-2024-1708%20%7C%20Huntress%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass&pageViewId=4b06a3b9-855e-4373-824b-5959b0bd39aa&webTagId=e666a54d-ff29-48f9-9baa-2be6ac05412e&v=1.1.15

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:23 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 getSubscriptions Show response
js.zi-scripts.com/unified/v1/master/ 150 B
383 B 619ms
618ms Fetch
application/json 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 5a79efc8ca07a0cd5975e5af74a91ebe7a1ef5cfc9eaff89904bb5bd73dd194f

Request headers

visited_url: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Referer: https://www.huntress.com/
accept-language: he-IL,he;q=0.9
Authorization: Bearer 5880e3e5891679926699
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 27 Feb 2024 23:38:24 GMT
via: 1.1 399b5715f700bb807285dd950c15453e.cloudfront.net (CloudFront)
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
x-amz-cf-pop: TLV50-C1
x-powered-by: Express
etag: W/"96-IoHqjrRKS0fFEmrkOeHpd3PovPY"
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cf-ray: 85c442dbaf8ce3cf-TLV
x-amz-cf-id: crwNYmh5mhLcoQ8XU-YZfCuvBonDdSVyZNCuLQB_V9qjmj5SPidy0w==
apigw-requestid: T0bRngqUvHcESJw=

OPTIONS
H2 204 getSubscriptions
js.zi-scripts.com/unified/v1/master/ Frame 0
0 734ms
616ms Preflight 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,visited_url
Access-Control-Request-Method: GET
Origin: https://www.huntress.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *
access-control-max-age: 0
apigw-requestid: T0bRgj-LvHcES5g=
cf-cache-status: DYNAMIC
cf-ray: 85c442d7c816e3cf-TLV
date: Tue, 27 Feb 2024 23:38:23 GMT
server: cloudflare
vary: Access-Control-Request-Headers
via: 1.1 399b5715f700bb807285dd950c15453e.cloudfront.net (CloudFront)
x-amz-cf-id: zEdj8QAKe0ApijUtApY2EqSC3hHvTj2s3lurfwoiV9GC-Cbapfgd7w==
x-amz-cf-pop: TLV50-C1
x-cache: Miss from cloudfront
x-powered-by: Express

POST
H3 200 log_event Show response
www.youtube.com/youtubei/v1/ Frame 552A 28 B
50 B 124ms
123ms XHR
application/json 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/95cde7ed/www-embed-player.vflset/www-embed-player.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f14.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
X-Goog-Request-Time: 1709077103464
Content-Type: application/json
X-YouTube-Utc-Offset: 120
X-YouTube-Client-Name: 56
Referer: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY&enablejsapi=1&origin=https%3A%2F%2Fwww.huntress.com
X-YouTube-Client-Version: 1.20240225.00.00
X-YouTube-Time-Zone: Asia/Jerusalem
X-Goog-Visitor-Id: CgthWTM0bUU4X1lIOCjs5PmuBjIKCgJJTBIEGgAgUg%3D%3D
X-YouTube-Ad-Signals: dt=1709077101053&flash=0&frm=2&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C700%2C395&vis=1&wgl=true&ca_type=image

Response headers

date: Tue, 27 Feb 2024 23:38:23 GMT
content-encoding: br
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN
vary: Origin, X-Origin, Referer
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31
x-xss-protection: 0

GET
H2 200 runtime~main.23dacaf3.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 6 KB
3 KB 414ms
413ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

7573e5629fdd86c1b9715e81fd55e01c7cf7febbfc3562f5acbb757c0d4cce64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Origin: https://rc-widget-frame.js.driftt.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:23 GMT
x-amz-version-id: pIvWjpmnkFEOPFn4Wb5jKsJCJYLlBZpR
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Mon, 21 Aug 2023 14:57:27 GMT
server: istio-envoy
etag: W/"7bebf8444c728503329344c5817cc4e6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: XTHvBaSKTd9ERhT1qNApb8JY8HY7yxnouNkP0KdmIOJP4EN6owNIag==

GET
H2 200 9.4a3e9801.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 35 KB
13 KB 512ms
511ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/9.4a3e9801.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

2a8a441d8086f20a64563edc759aba1de84d932e34ff77b8bb0279a730cdb428

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Origin: https://rc-widget-frame.js.driftt.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:23 GMT
x-amz-version-id: pqAgwfcZAYDBBripNHVNn5B3.VCXRzFc
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Tue, 27 Feb 2024 23:06:47 GMT
server: istio-envoy
etag: W/"c6f58dd3d60f07462254b842dd4f9ca1"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: AC-ri0dK_J5ipzco10wwiIYoS2g1tFh_YZjpjLN1srCLCylZQhP58A==

GET
H2 200 main~493df0b3.91dc5a14.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 7 KB
3 KB 409ms
409ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/main~493df0b3.91dc5a14.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

1ce5bbfddabe83a619dffbd897ac79e94ca961f04cf463583a421a22f5329938

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Origin: https://rc-widget-frame.js.driftt.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:23 GMT
x-amz-version-id: aQ8O6UMWsN.2o5G5k1LSH1svCMcNLzIM
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 14
last-modified: Mon, 21 Aug 2023 14:57:27 GMT
server: istio-envoy
etag: W/"c11c9776fa434757756e10e6ded61c75"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: yeB8IkqOQQGOMQDYLVBDvt6wNP426e4wik76ZKSJek5yMRh_SZ3KLQ==

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 412ms
412ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=a87a3edc53b5a86d1795d11887b5aa39&svisitor=null&visitor=94f1245d-4338-4d83-8c17-f4ba37077af1&session=6a5f63fa-13cf-4747-86df-4a5079ac9bfc&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2027%20Feb%202024%2023%3A38%3A23%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2027%20Feb%202024%2023%3A38%3A19%20GMT%22%2C%22timeSpent%22%3A%224128%22%2C%22totalTimeSpent%22%3A%224128%22%7D&isIframe=false&m=%7B%22description%22%3A%22This%20blog%20discusses%20the%20Huntress%20Team%27s%20analysis%20efforts%20of%20the%20two%20vulnerabilities%20and%20software%20weaknesses%20in%20ConnectWise%20ScreenConnect%20(CVE-2024-1708%20and%20CVE-2024-1709)%20and%20the%20technical%20details%20behind%20this%20attack.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Understanding%20the%20ConnectWise%20ScreenConnect%20CVE-2024-1709%20%26amp%3B%20CVE-2024-1708%20%7C%20Huntress%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass&pageViewId=4b06a3b9-855e-4373-824b-5959b0bd39aa&an_uid=0&webTagId=e666a54d-ff29-48f9-9baa-2be6ac05412e&v=1.1.15

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:24 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H/1.1 204
No Content collect Show response
p.clarity.ms/ 0
296 B 191ms
191ms XHR
text/plain 20.122.63.128
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://p.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.20/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.122.63.128 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://www.huntress.com/
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://www.huntress.com
Date: Tue, 27 Feb 2024 23:38:24 GMT
Access-Control-Allow-Credentials: true
Server: nginx/1.18.0 (Ubuntu)
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:2f7711a9-b21e-4abe-a9d6-5b0ce5d18b64

GET
H2 200 51.558be3c5.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 23 KB
8 KB 426ms
422ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b0af909b7ae6ad2644bfe2a60d939092aaf113b2cbc4ed2981a892869143b98a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:24 GMT
x-amz-version-id: UpPie2_pLxC8QavzdTpsZEt3byQPLDGk
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Tue, 27 Feb 2024 23:06:46 GMT
server: istio-envoy
etag: W/"fa281fcbe4b2e35558d60fae3e316367"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 5-QlNj9StGS5EN0-Pp2fhT9DAVIzwlWlEnj3I30qKB5TpnFIDms8oA==

GET
H2 200 33.ae4de0a0.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 36 KB
10 KB 502ms
499ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/33.ae4de0a0.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e12404ccb0492da0a89fbda8db0ddb3c2358fcbd6d29b0c106ba840ca5f5e8ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:24 GMT
x-amz-version-id: PUG2tPuHbg6UXU15H37d6Lifu.5b8Act
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 16
last-modified: Mon, 21 Aug 2023 14:57:25 GMT
server: istio-envoy
etag: W/"db0cd5b66c52523e10b87a0c8a2db182"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: gVoUyVsTIFrCzYsFkM2cc80WXJ0QlcmK0n7auFgZxOkF9ghTrtSD1g==

GET
H2 200 22.6b9a301a.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 32 KB
11 KB 414ms
411ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/22.6b9a301a.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

8f0f8792237470ee661c6afc32ca68200dd74bcc0d544d0fd54c7777af362eae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:24 GMT
x-amz-version-id: oTigH5r6OqWR1AnzyVu4BgxbP9tgHYDa
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 18
last-modified: Tue, 27 Feb 2024 23:06:45 GMT
server: istio-envoy
etag: W/"d8739a9fe9a3a42936f5cd86c8727494"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: uLwXHDZyr791rrntFSab-xIqH2LIIpevKrbGvTcRnmOLELzJFASQKg==

GET
H2 200 19.6f85b843.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 17 KB
6 KB 429ms
425ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/19.6f85b843.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

afbd41e7209fa3aef6f53c7a5713aa542a7be54c432fec2d690e0dfaccd528d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:24 GMT
x-amz-version-id: 0Bof7bXLXNU7fAgOGeOepDumYXcXsUVD
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Tue, 27 Feb 2024 23:06:45 GMT
server: istio-envoy
etag: W/"e28ebc3391b56e8f01ea063dc089e9d3"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: qF15YPvhAShPSzK-9TlU66xvFfyzGjizhtnU0pfEIqMiiUJANYwVKQ==

GET
H2 200 41.b4fc4de2.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 25 KB
8 KB 418ms
414ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/41.b4fc4de2.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

edf1011ad272d21b66ae82a21a9d029186dc81c9f13972203fc3107f75835d4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:24 GMT
x-amz-version-id: S5vH98C9qbr3dUmyPHRrjYCgiIwitQv7
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 16
last-modified: Tue, 27 Feb 2024 23:06:46 GMT
server: istio-envoy
etag: W/"a2ace4f65aa7b34dedb884f6cfe9df8d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: noAaK8LACXYFnfKMWkC3gKbA5ijN2ubmJ6xe6kec3TNkWMvu4zJTkQ==

GET
H2 200 20.8c21ea18.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 74 KB
23 KB 235ms
232ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/20.8c21ea18.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:24 GMT
x-amz-version-id: vQFp.h.BM06EHZdsAZFbKKMvdHAMIeyD
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 21
last-modified: Tue, 27 Feb 2024 23:06:45 GMT
server: istio-envoy
etag: W/"6d77a76055d81227033363af2f18caf8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: yf3JY_0oOJmVb3wwLlQOp9j6BhAvza0n0JjTDyh5zWwm36ccLcsEpQ==

GET
H2 200 27.3951aad8.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 66 KB
20 KB 512ms
509ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/27.3951aad8.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e8e658c81a7ff92a6e0f9049ee3a8fc42082e8303abb6ed44c73361259cbdbae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:24 GMT
x-amz-version-id: PLRwkxTy0W_1o8rwzVQG6XR9UyxAvjNh
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 16
last-modified: Sat, 02 Sep 2023 21:37:07 GMT
server: istio-envoy
etag: W/"5b2b6d0508fe18c3efb6bcd6249fd4e1"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: HVPAhS9XATnbMGhbY9jM1AKZg-esnx7T4ee13mLyCzVPa5LdaXhdaw==

GET
H2 200 14.e24a6190.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 91 KB
28 KB 447ms
444ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/14.e24a6190.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6c9c6406c9bd9814cf84974221433003377b67f071ec5411fddbcba4ec109bca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:24 GMT
x-amz-version-id: O8.4sIIlgTle7EJ5vxVCVzbmz2AS_Zwn
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Tue, 27 Feb 2024 23:06:45 GMT
server: istio-envoy
etag: W/"16d7ae86e21434a32157d3226ac9bb77"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: lzkxCmAACnq67Pq_V2LQjvYubPkWQDlos_fHbFOv_radRVa_PNNTwg==

GET
H2 200 11.639238ba.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 23 KB
7 KB 466ms
463ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/11.639238ba.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:24 GMT
x-amz-version-id: H7zKoCd5sVZtGJjb.ipFe0xm7XQinRkv
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 26
last-modified: Tue, 27 Feb 2024 23:06:44 GMT
server: istio-envoy
etag: W/"4049f38c00add1738dc4806148ff8829"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: bLvaARcUrsW0ukv7-lUJE6g7Doi2BaJ5iIem3fqkP3R7otOHnrjyJg==

GET
H2 200 18.9c1bd1fb.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 62 KB
20 KB 455ms
452ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/18.9c1bd1fb.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e555f4b34b579e6528d6bbd4819620a634c0759b41dfa99520b7ca5aa5117b11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:24 GMT
x-amz-version-id: 2.6QSWj0X3N3ykGfZUEnH9l8.0oxNdZj
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 23
last-modified: Tue, 27 Feb 2024 23:06:45 GMT
server: istio-envoy
etag: W/"02f09379c544befa413d22eb57ed41de"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: SYQiFZkF3g_ZlZE-wz55Jdc9GVJVEUsZCxUKvECu-mzUBN0huxtWLw==

GET
H2 200 49.f7274268.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 105 KB
34 KB 576ms
573ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/49.f7274268.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6861a320271e0fda832800e20d53b858ef409f88d9bc9c1a48953888289d1ea3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:24 GMT
x-amz-version-id: Qj5ldSXqexTHKzLdY.tgXGwUHx42KvMA
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 37
last-modified: Tue, 27 Feb 2024 23:06:46 GMT
server: istio-envoy
etag: W/"e268d36b98f0119a2bb1a15f69fd4ffe"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: oPNCbdKxrjC1xttVved9umYY_d4iYN0IcLid2uRg5j4D2N7HbIp7tQ==

GET
H2 200 40.31ef8dbf.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 12 KB
4 KB 467ms
465ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/40.31ef8dbf.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

bba54915db71fc417be4d5852ec7d138d7c3fa90356ddee98b5267a7db7e6b5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:24 GMT
x-amz-version-id: LTYzwjStVjwXdLtHANZQUemeIzsD_miH
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 18
last-modified: Tue, 27 Feb 2024 23:06:46 GMT
server: istio-envoy
etag: W/"b0793fa46e8c0ae1846b7be8a833da35"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: z_4ldNxN6j2ANCBgS_0Vsc7ZsyRA51O9TquzlVkn4N_CZmbXjlM4OA==

GET
H2 200 29.31d09948.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 13 KB
6 KB 494ms
492ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/29.31d09948.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

7641f066c35d0ca15d4897bfe49d640ed4c143ff8f04030c2020cbb2acfa7b0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:24 GMT
x-amz-version-id: FNEIOPUbwZ9t9xqza7rLVYulgSISvAue
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 25
last-modified: Tue, 27 Feb 2024 23:06:45 GMT
server: istio-envoy
etag: W/"455157cb49065fb85fed54901ddaeb0e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: MshmJOGnxIgIvnTJrjxZbLScISg8XFRf98ToitEPJMmdiMjTFg62aQ==

GET
H2 200 21.b8c41db9.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 17 KB
7 KB 475ms
472ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/21.b8c41db9.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:24 GMT
x-amz-version-id: E2horPZYZt1SzkHWRKk4AborEIsh.CbG
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 18
last-modified: Tue, 27 Feb 2024 23:06:45 GMT
server: istio-envoy
etag: W/"65e5c965272e021ae33ff8bc39565ef5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: bkysb_9JQnP694kDc-WMFhuY_LwaIxsbGVbTcvdm0V3M_sE6-nPWtw==

GET
H2 200 8.98b34517.chunk.css
rc-widget-frame.js.driftt.com/core/assets/css/ Frame FE57 31 KB
5 KB 486ms
484ms Stylesheet
text/css 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/css/8.98b34517.chunk.css

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

794dc30b5582c5b0c4a06c2e0776f6527a84c91d5f7abb9384e7588d0ab3a910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:24 GMT
x-amz-version-id: iNKtCZtb69S5Xg2ti_W3KaKTIlBxoqLp
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 23
last-modified: Mon, 21 Aug 2023 14:57:23 GMT
server: istio-envoy
etag: W/"82429fd1682dcb60e14996ad58a35a4f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: zGJ0Iy6vAjG9Dcxz2jxQBtcRKZ4XLMvCoP7nh2aYQ5YRfrHN7JNAig==

GET
H2 200 8.5fdda827.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 81 KB
25 KB 595ms
593ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/8.5fdda827.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e523f47c65c171a685ca8f1bb0c0c432f4d71104fa56e8f6163126ec908cc430

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:24 GMT
x-amz-version-id: s5Gs7OuwDj2F26kpSyydH_032jxZE3YX
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 53
last-modified: Mon, 21 Aug 2023 14:57:26 GMT
server: istio-envoy
etag: W/"f78079aaffe016efb8ec35b9fbb9f42f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: rHojelS5Y02KpEeq4inO563kAKficLzdbrH1ayA61rvUHP7WomXhcQ==

GET
H2 200 16.22abfce0.chunk.css
rc-widget-frame.js.driftt.com/core/assets/css/ Frame FE57 24 B
694 B 470ms
469ms Stylesheet
text/css 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/css/16.22abfce0.chunk.css

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:24 GMT
x-amz-version-id: fBtaFb.n2WaN_oHLWbPW5f8eewDaLXJ.
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 14
content-length: 24
last-modified: Tue, 27 Feb 2024 23:06:43 GMT
server: istio-envoy
etag: "0c5dad92482d9a7c7c253510f5082465"
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: UJgQp2VKaedYKI6SrFd86iOYtZj_3Y-b0XyPw0gdfPp2Ai0NA_31yA==

GET
H2 200 16.890a0911.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 91 KB
24 KB 587ms
586ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/16.890a0911.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

860c659e8836feb6a6b4fc4c9b7195e4ab0a04e4642473c0780ae554fbf6ffb2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:24 GMT
x-amz-version-id: 2cJi_0AtsucvWstmkbj3mO1t8SiuDMru
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 48
last-modified: Mon, 21 Aug 2023 14:57:25 GMT
server: istio-envoy
etag: W/"52b055a08e59141b8f7b7947c7d7ab69"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: udbyBr4Qinjc9-0sslJCCovCoIY7OhTdPyg20_2npfc-zwGUJnI0IA==

GET
H2 200 24.24e43c3b.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 50 KB
14 KB 560ms
559ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/24.24e43c3b.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

eb6ce397310855bbef74043afcdda989653ad7b7b385191e8c8d622eee74b367

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:24 GMT
x-amz-version-id: J3Ynz_VL_Xe.kEj4VqPxsio5dIqXBI10
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 16
last-modified: Mon, 21 Aug 2023 14:57:25 GMT
server: istio-envoy
etag: W/"390d4b78f4c738295b7974aca941d031"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: aGmJ9Oh7bKMBOBoSjDz23posBf5Qw1rP1qVrpfdUHpINYldUIniI_g==

GET
H2 200 17.413337a8.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 40 KB
13 KB 477ms
476ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/17.413337a8.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

10b977a814bd9ca3e018a07b6e1197c9a9fa89a27a2419158d22f41ab8a29508

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:24 GMT
x-amz-version-id: Ud1ylpzTdwt3qfnkRXUYob2T_ovQMI1N
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Mon, 21 Aug 2023 14:57:25 GMT
server: istio-envoy
etag: W/"4aea30e551ee7f04a564c0408c291306"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: vioIkKT4YrRl3pluRzg-vUSokakt3nXJJ0iuldgkNpCRUZqpCKEMvg==

GET
H3 200 / Show response
ws.zoominfo.com/pixel/62f67a71a4cf97008ef6d460/ 3 KB
2 KB 506ms
444ms Fetch
text/javascript 104.16.137.15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/62f67a71a4cf97008ef6d460/?iszitag=true

Requested by

Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.137.15 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

5feb1224febe4002ba3c028bbb17a47b1762ca33ec3f5698e684b9071bbabdd9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

visited-url: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Referer: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
_vtok: MzEuMTg3Ljc4LjIyOA==
_zitok: bb29c455cfbdcd5b43801709077104
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: text/javascript

Response headers

date: Tue, 27 Feb 2024 23:38:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 google
server: cloudflare
x-powered-by: Express
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: https://www.huntress.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
alt-svc: h3=":443"; ma=86400
cf-ray: 85c442e23d4ee3c7-TLV

OPTIONS
H2 200 /
ws.zoominfo.com/pixel/62f67a71a4cf97008ef6d460/ Frame 0
0 368ms
235ms Preflight
text/html 104.16.137.15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/62f67a71a4cf97008ef6d460/?iszitag=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.137.15 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: _vtok,_zitok,content-type,visited-url
Access-Control-Request-Method: GET
Origin: https://www.huntress.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
access-control-allow-origin: https://www.huntress.com
allow: GET,HEAD
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 85c442e059b7e3c7-TLV
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 27 Feb 2024 23:38:24 GMT
server: cloudflare
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 345ms
345ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=a87a3edc53b5a86d1795d11887b5aa39&svisitor=null&visitor=94f1245d-4338-4d83-8c17-f4ba37077af1&session=6a5f63fa-13cf-4747-86df-4a5079ac9bfc&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2027%20Feb%202024%2023%3A38%3A24%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2027%20Feb%202024%2023%3A38%3A23%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225129%22%7D&isIframe=false&m=%7B%22description%22%3A%22This%20blog%20discusses%20the%20Huntress%20Team%27s%20analysis%20efforts%20of%20the%20two%20vulnerabilities%20and%20software%20weaknesses%20in%20ConnectWise%20ScreenConnect%20(CVE-2024-1708%20and%20CVE-2024-1709)%20and%20the%20technical%20details%20behind%20this%20attack.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Understanding%20the%20ConnectWise%20ScreenConnect%20CVE-2024-1709%20%26amp%3B%20CVE-2024-1708%20%7C%20Huntress%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass&pageViewId=4b06a3b9-855e-4373-824b-5959b0bd39aa&an_uid=0&webTagId=e666a54d-ff29-48f9-9baa-2be6ac05412e&v=1.1.15

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:25 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 0.0b2ebd4a.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 9 KB
3 KB 414ms
412ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:25 GMT
x-amz-version-id: 9_roXiORIvpMvmQ75nk5jHKvwwD5wafS
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Tue, 27 Feb 2024 23:06:44 GMT
server: istio-envoy
etag: W/"c5efcdc9e465604f32cf24af10fd6c13"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 0fUFgMre_JeNVsLqGSI3Ck5yUIN5RbR9UX8OjgrXZXx2E_ovjNJABw==

GET
H2 200 4.07aa08a5.chunk.css
rc-widget-frame.js.driftt.com/core/assets/css/ Frame FE57 7 KB
2 KB 226ms
224ms Stylesheet
text/css 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/css/4.07aa08a5.chunk.css

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:25 GMT
x-amz-version-id: wzblrhR8VgaZ91O5gq0aMSI2PU89S5cp
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 17
last-modified: Mon, 21 Aug 2023 14:57:23 GMT
server: istio-envoy
etag: W/"189aeffd571884559dababa22c66d75a"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: TtLy-0GaJ7-SGX_jxw0QwZeVE_LR8rPP896-HJ-h_-82fQ7guMExWA==

GET
H2 200 4.36582b8b.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 54 KB
15 KB 228ms
226ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/4.36582b8b.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6a6a06c6f8fb209f9e92af2bb5ed0c0d0e767211a1a92e631e1d0ce056488387

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:25 GMT
x-amz-version-id: aXK3nhxEmGQGmcWeEUpmTanxIifnp1mO
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 18
last-modified: Mon, 21 Aug 2023 14:57:25 GMT
server: istio-envoy
etag: W/"eb4f4fdfa625f5036ae2538950af438e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: cvVvyeVpUXjCrx2iKHxl9mAEYYKPf58YC-iO8dCKzBVKRHUMCV2Y_A==

GET
H2 200 34.4924e4bf.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 27 KB
8 KB 444ms
442ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/34.4924e4bf.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

15736c00b563c558ec1e7d531c0d8bd7d8cc24c2026adbc2dcf0ccd3e48f7d65

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:25 GMT
x-amz-version-id: T7ywXmlgZ2pn_NjEp3YMDrKgM16OYgwy
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 51
last-modified: Mon, 21 Aug 2023 14:57:25 GMT
server: istio-envoy
etag: W/"2a9499a40949c70c9c00081b06639cb0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: evAtj_rd5CGpv5hALszxtL7xidAbM6cf5v0TSvpchrAKR2uzeT3QyQ==

GET
H2 200 1.12ba17b6.chunk.css
rc-widget-frame.js.driftt.com/core/assets/css/ Frame FE57 44 KB
7 KB 408ms
406ms Stylesheet
text/css 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/css/1.12ba17b6.chunk.css

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

58fdb03fac3e89e51525a5a45eb777395d1b499bf4483e96201b6becddbe516f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:25 GMT
x-amz-version-id: h9hvTfExeynnRbEc92UbAe21gECXOs0b
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 15
last-modified: Tue, 27 Feb 2024 23:06:43 GMT
server: istio-envoy
etag: W/"3b8ba82e1bac13ee29e9764a55620d99"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 8TJ5cYcnx7lfnKzyj1yvIdr1cYhNxsqJ6ZpC6_p96ssDBcZjCuv3gQ==

GET
H2 200 1.9d9c8c3b.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 54 KB
17 KB 411ms
409ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/1.9d9c8c3b.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

5e4e01da0230734413d39e4657ac95b4ccf45092ff61a162aa1f4d111a166735

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:25 GMT
x-amz-version-id: TN5uaySIype7BWdOQeU5pFJLqRV.3qiK
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 16
last-modified: Mon, 21 Aug 2023 14:57:24 GMT
server: istio-envoy
etag: W/"bc8dde7d353b792cb424661adcff29fb"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 0QJylNX8dgZPbSqrx4eIeHi_gWS2KZ5jxKPJGzhAJzbJgQjsain0Dw==

GET
H2 200 3.bbe0e1fa.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 24 KB
10 KB 240ms
239ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/3.bbe0e1fa.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

ba3035c1cbfbd4ebb878f85acde3d846c6e9e90081de78ddcaf3126b4e8823b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:25 GMT
x-amz-version-id: pHxDHN0IINa0RNuxMPvQ8pBn4Eg1GWSc
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 31
last-modified: Mon, 21 Aug 2023 14:57:25 GMT
server: istio-envoy
etag: W/"b394f9cf6fe473cdb6852b332234aa52"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: y7WhhugmSEG-1pe77N-flhYpTi0U_v5fsQJ01sFgkQsPg_y_1rP7ZA==

GET
H2 200 26.5208cc6b.chunk.css
rc-widget-frame.js.driftt.com/core/assets/css/ Frame FE57 11 KB
3 KB 230ms
229ms Stylesheet
text/css 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/css/26.5208cc6b.chunk.css

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

0591af742c10a8ad2020502cccbf97cb4fc1cfc48acaf588043d70e77b2c3aaf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:25 GMT
x-amz-version-id: SrCjVsE3413g5wEL9F8CX8IFIQaqzFVz
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Mon, 21 Aug 2023 14:57:23 GMT
server: istio-envoy
etag: W/"0842e637a23acc114afbb6195c984564"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: GDkmryapcxenKUxL169mtg_5ikST_GyjqdnHp_9LIP4NEAITywf_SQ==

GET
H2 200 26.69219246.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 16 KB
6 KB 284ms
283ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/26.69219246.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

d674a115404e8d29a650437584421bd9d7ec57c4d43fe3e0a09adc080d521c44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:25 GMT
x-amz-version-id: xHgUeRJlJNXFuOCOFJ6VHVB_xDcgAWBV
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Mon, 21 Aug 2023 14:57:25 GMT
server: istio-envoy
etag: W/"c41c7243f45ea540e99a3256f4942432"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: OL7hZLbAE9oQeIGKIMc9HOYvuhC9LdVh5d2-ScKVmj26IeY3RU6scw==

GET
H2 200 25.7addeee7.chunk.css
rc-widget-frame.js.driftt.com/core/assets/css/ Frame FE57 9 KB
2 KB 223ms
222ms Stylesheet
text/css 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/css/25.7addeee7.chunk.css

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

a7a9292edd72228ac6b7839b6e29a832ab45515a5c78d548ccd5fd8a2b1942ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:25 GMT
x-amz-version-id: EFJHE_lMh.tvaT0GqPW.1ROLceWNBRoz
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 16
last-modified: Mon, 21 Aug 2023 14:57:23 GMT
server: istio-envoy
etag: W/"b9011653b355d04d18b2ff93e45e1ecd"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: deXJtNVpEOuLGFHmbkHVNYiFq3hwDXmZHijAmbIVl8m1YeSuIjCP3A==

GET
H2 200 25.915ff314.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 47 KB
15 KB 465ms
465ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/25.915ff314.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e5149bac0cdad7bbd9d1b7badb88909929d324ee90b6dd1628e0c59024d68e7c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:25 GMT
x-amz-version-id: qod1m4nnLfUgaMaxljkZuFfY2SywXHfx
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 18
last-modified: Mon, 21 Aug 2023 14:57:25 GMT
server: istio-envoy
etag: W/"12bceaba2da6c30ab2a0aacbde681b0c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: _Es6e_F-3ryhIjk1fqyLEjSYi5nPwN0zVAV9F75SqwhLSc8YafdKCg==

GET
H2 200 28.e29661b2.chunk.css
rc-widget-frame.js.driftt.com/core/assets/css/ Frame FE57 561 B
1 KB 420ms
420ms Stylesheet
text/css 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/css/28.e29661b2.chunk.css

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

d04196ec92f307c66ad56e3adbd4536e6c504a251299183c2c016de66a65af39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:25 GMT
x-amz-version-id: yOY99EI9PDEu6PYQSPkvCce7eoR8ev5W
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 23
content-length: 561
last-modified: Mon, 21 Aug 2023 14:57:23 GMT
server: istio-envoy
etag: "5847d5731c3141aa511411d6c66a193c"
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: hQYXzes6JZLpe_KCMgV3LxPS3G9rqhXqa2cSIQf_3bT_z8Oun9L01Q==

GET
H2 200 28.7257241a.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 49 KB
14 KB 558ms
558ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/28.7257241a.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

f4d1dc5e2bebcc6c035e733b5586f308c032e377d490d733835fbc1fb0e5d979

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:25 GMT
x-amz-version-id: Aw7E9DaiC.0zygWe8D.HQj28dALSaXA6
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Mon, 21 Aug 2023 14:57:25 GMT
server: istio-envoy
etag: W/"e737f53b0791dac4c523770b4992131c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 884fSONWbfPMXU-njcG6oOjnqgX-hxG-k7ohXsn3lQqdrtnJ01S9_g==

GET
H2 200 35.3cdf48ae.chunk.css
rc-widget-frame.js.driftt.com/core/assets/css/ Frame FE57 16 KB
3 KB 227ms
227ms Stylesheet
text/css 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/css/35.3cdf48ae.chunk.css

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

1650436b42349eba90400162f9104f8abd0e8b846cf91d26c907c300dd8d7f85

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:25 GMT
x-amz-version-id: V1yopT2bXZUj.CNczvGqS7_vfWAIiP2A
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 21
last-modified: Mon, 21 Aug 2023 14:57:23 GMT
server: istio-envoy
etag: W/"ac16e52f547ce8f3de32d9d7d591c2c0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: rw3ww5rSe1m6eFl5jctteA3DQm35D2WABH3hQcrzyksF8ZiOPuhT-Q==

GET
H2 200 35.3969a3d7.chunk.js Show response
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 11 KB
5 KB 314ms
314ms Script
application/javascript 18.66.147.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-widget-frame.js.driftt.com/core/assets/js/35.3969a3d7.chunk.js

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/runtime~main.23dacaf3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-59.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

ca38f2df2a3be653605830a05931aeac85fbd1c3fa2e483a334fdc25e3463503

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=9c03053a-1d09-4f06-a2ed-e4894f7ea2c3&sessionStarted=1709077102.967&campaignRefreshToken=dcd72923-5532-4501-bfd4-c11ec0f892bc&pageLoadStartTime=1709077098914&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:25 GMT
x-amz-version-id: _L8fRFK5jC3YnnGaFitzP.KBJ4MXVS_2
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 16
last-modified: Mon, 21 Aug 2023 14:57:25 GMT
server: istio-envoy
etag: W/"dcd622adceee29d53432ca3f6e9eb777"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: bofZbctrW59fu4VNz62u4Jnp-kpuyNCrWCiCz3J_DDwEqYyfcQsKpw==

POST
H2 200 v2 Show response
bootstrap.api.drift.com/widget_bootstrap/ping/ Frame FE57 208 B
648 B 600ms
195ms XHR
application/json 54.147.21.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://bootstrap.api.drift.com/widget_bootstrap/ping/v2

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-147-21-139.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

facf8de270be69de3d2a6fc877d6bbf24baacdeb6f8c5b39a4ac4853bcc096bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://rc-widget-frame.js.driftt.com/
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 27 Feb 2024 23:38:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: istio-envoy
requestid: 832a9d4792766b2c
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
vary: Accept-Encoding
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 208

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 444ms
443ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=a87a3edc53b5a86d1795d11887b5aa39&svisitor=null&visitor=94f1245d-4338-4d83-8c17-f4ba37077af1&session=6a5f63fa-13cf-4747-86df-4a5079ac9bfc&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2027%20Feb%202024%2023%3A38%3A25%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2027%20Feb%202024%2023%3A38%3A24%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226130%22%7D&isIframe=false&m=%7B%22description%22%3A%22This%20blog%20discusses%20the%20Huntress%20Team%27s%20analysis%20efforts%20of%20the%20two%20vulnerabilities%20and%20software%20weaknesses%20in%20ConnectWise%20ScreenConnect%20(CVE-2024-1708%20and%20CVE-2024-1709)%20and%20the%20technical%20details%20behind%20this%20attack.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Understanding%20the%20ConnectWise%20ScreenConnect%20CVE-2024-1709%20%26amp%3B%20CVE-2024-1708%20%7C%20Huntress%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass&pageViewId=4b06a3b9-855e-4373-824b-5959b0bd39aa&an_uid=0&webTagId=e666a54d-ff29-48f9-9baa-2be6ac05412e&v=1.1.15

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:26 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 200 v2 Show response
customer.api.drift.com/integrations/hubspot/utk/ Frame FE57 2 B
64 B 275ms
274ms XHR
application/json 54.147.21.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://customer.api.drift.com/integrations/hubspot/utk/v2

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-147-21-139.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://rc-widget-frame.js.driftt.com/
accept-language: he-IL,he;q=0.9
Authorization
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 27 Feb 2024 23:38:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: istio-envoy
requestid: 5cfc58238cb23a40
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
vary: Accept-Encoding
access-control-allow-credentials: true
x-envoy-upstream-service-time: 82
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 2

OPTIONS
H2 200 v2
customer.api.drift.com/integrations/hubspot/utk/ Frame 0
0 202ms
194ms Preflight
text/plain 54.147.21.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://customer.api.drift.com/integrations/hubspot/utk/v2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-147-21-139.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://rc-widget-frame.js.driftt.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-max-age: 1209600
allow: POST,OPTIONS
content-length: 13
content-type: text/plain
date: Tue, 27 Feb 2024 23:38:26 GMT
requestid: driftcc3b75c4d489e158ebf0bbef2b5
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
x-envoy-upstream-service-time: 2

POST
H2 200 v3 Show response
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame FE57 25 B
89 B 215ms
206ms XHR
application/json 54.147.21.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/widget/init/v3

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-147-21-139.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://rc-widget-frame.js.driftt.com/
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 27 Feb 2024 23:38:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: istio-envoy
requestid: 72d300b4b72f385c
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
vary: Accept-Encoding
access-control-allow-credentials: true
x-envoy-upstream-service-time: 15
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 25

POST
H2 200 widget_bootstrap Show response
bootstrap.api.drift.com/ Frame FE57 10 KB
4 KB 381ms
381ms XHR
application/json 54.147.21.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://bootstrap.api.drift.com/widget_bootstrap

Requested by

Host: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-147-21-139.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

ad8f7f9fca3ba0ead7b113adb6d8cd0656ad955f911de45c52fb13fc4e827d7c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://rc-widget-frame.js.driftt.com/
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 27 Feb 2024 23:38:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
server: istio-envoy
requestid: df5eebcd3b65cd21
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
vary: Accept-Encoding
access-control-allow-credentials: true
x-envoy-upstream-service-time: 190
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 411ms
411ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=a87a3edc53b5a86d1795d11887b5aa39&svisitor=null&visitor=94f1245d-4338-4d83-8c17-f4ba37077af1&session=6a5f63fa-13cf-4747-86df-4a5079ac9bfc&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2027%20Feb%202024%2023%3A38%3A26%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2027%20Feb%202024%2023%3A38%3A25%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%227132%22%7D&isIframe=false&m=%7B%22description%22%3A%22This%20blog%20discusses%20the%20Huntress%20Team%27s%20analysis%20efforts%20of%20the%20two%20vulnerabilities%20and%20software%20weaknesses%20in%20ConnectWise%20ScreenConnect%20(CVE-2024-1708%20and%20CVE-2024-1709)%20and%20the%20technical%20details%20behind%20this%20attack.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Understanding%20the%20ConnectWise%20ScreenConnect%20CVE-2024-1709%20%26amp%3B%20CVE-2024-1708%20%7C%20Huntress%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass&pageViewId=4b06a3b9-855e-4373-824b-5959b0bd39aa&an_uid=0&webTagId=e666a54d-ff29-48f9-9baa-2be6ac05412e&v=1.1.15

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.huntress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 23:38:27 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET img.gif
b.6sc.co/v1/beacon/ 0
0

POST
H/1.1 204
No Content collect Show response
p.clarity.ms/ 0
296 B 191ms
190ms XHR
text/plain 20.122.63.128
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://p.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.20/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.122.63.128 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://www.huntress.com/
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://www.huntress.com
Date: Tue, 27 Feb 2024 23:38:28 GMT
Access-Control-Allow-Credentials: true
Server: nginx/1.18.0 (Ubuntu)
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:2f7711a9-b21e-4abe-a9d6-5b0ce5d18b64

POST track
event.api.drift.com/ Frame FE57 0
0

OPTIONS
H2 200 track
event.api.drift.com/ Frame 0
0 198ms
192ms Preflight
text/plain 54.147.21.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://event.api.drift.com/track

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-147-21-139.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://rc-widget-frame.js.driftt.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-max-age: 1209600
allow: POST,OPTIONS
content-length: 13
content-type: text/plain
date: Tue, 27 Feb 2024 23:38:28 GMT
requestid: drift0b0347148f68fcfdb6441727e0f
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
x-envoy-upstream-service-time: 0

GET 57.28dde8ce.chunk.js
rc-widget-frame.js.driftt.com/core/assets/js/ Frame FE57 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: b.6sc.co
URL: https://b.6sc.co/v1/beacon/img.gif?token=a87a3edc53b5a86d1795d11887b5aa39&svisitor=null&visitor=94f1245d-4338-4d83-8c17-f4ba37077af1&session=6a5f63fa-13cf-4747-86df-4a5079ac9bfc&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2027%20Feb%202024%2023%3A38%3A27%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2027%20Feb%202024%2023%3A38%3A26%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%228133%22%7D&isIframe=false&m=%7B%22description%22%3A%22This%20blog%20discusses%20the%20Huntress%20Team%27s%20analysis%20efforts%20of%20the%20two%20vulnerabilities%20and%20software%20weaknesses%20in%20ConnectWise%20ScreenConnect%20(CVE-2024-1708%20and%20CVE-2024-1709)%20and%20the%20technical%20details%20behind%20this%20attack.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Understanding%20the%20ConnectWise%20ScreenConnect%20CVE-2024-1709%20%26amp%3B%20CVE-2024-1708%20%7C%20Huntress%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fa-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass&pageViewId=4b06a3b9-855e-4373-824b-5959b0bd39aa&an_uid=0&webTagId=e666a54d-ff29-48f9-9baa-2be6ac05412e&v=1.1.15

Domain: event.api.drift.com
URL: https://event.api.drift.com/track

Domain: rc-widget-frame.js.driftt.com
URL: https://rc-widget-frame.js.driftt.com/core/assets/js/57.28dde8ce.chunk.js

Verdicts & Comments Add Verdict or Comment

166 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

62 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: OGKxw_8N0es
.youtube.com/	1970-01-20 23:03:49	Name: VISITOR_INFO1_LIVE Value: aY34mE8_YH8
.huntress.com/	1970-01-20 20:54:13	Name: _gcl_au Value: 1.1.1671912534.1709077100
.huntress.com/	1970-01-21 04:20:37	Name: _ga_GCTMBVFESS Value: GS1.1.1709077100.1.0.1709077100.60.0.0
.huntress.com/	1970-01-21 04:20:37	Name: _ga Value: GA1.1.867216211.1709077101
.huntress.com/	1970-01-20 18:44:38	Name: _sp_ses.1564 Value: *
.huntress.com/	1970-01-21 04:20:37	Name: _sp_id.1564 Value: 433c3647-0ed0-4ce6-b25a-a03f8e272bc6.1709077101.1.1709077101.1709077101.f23c9275-bd04-405f-9858-6b223ab4a2fb
.huntress.com/	1970-01-20 18:46:03	Name: _uetsid Value: 4a45dff0d5c911eeb157e538913bff34
.huntress.com/	1970-01-21 04:06:13	Name: _uetvid Value: 4a45fc40d5c911eeb9e1b5a134d70e9b
tracking.g2crowd.com/	1970-01-20 19:04:46	Name: _session_id Value: dd46380c6277959808f016a727bb4f22
.g2crowd.com/	1970-01-20 18:44:38	Name: __cf_bm Value: 3e9WzHOL_PbQRnQo01hSK3L9P8oMGWEcOc9nlrxv718-1709077100-1.0-AZqBd3UgPYkCN4zR3xRIhl3d3nMiz0Z6WHeUVkWoQsqw4NLBC2EIUm+Hna7bi1WpALZAcb1089X5+c3f89zZ9R0=
tags.srv.stackadapt.com/	1970-01-21 03:30:13	Name: sa-user-id Value: s%3A0-db22360f-2b95-515d-6ff3-2f2aa6ac37f9.%2Bgb2Ni7iJXYdCIsAsMuD5YsexKsvOuWHMxgU3tLIwHY
.srv.stackadapt.com/	1970-01-21 03:30:13	Name: sa-user-id Value: s%3A0-db22360f-2b95-515d-6ff3-2f2aa6ac37f9.%2Bgb2Ni7iJXYdCIsAsMuD5YsexKsvOuWHMxgU3tLIwHY
tags.srv.stackadapt.com/	1970-01-21 03:30:13	Name: sa-user-id-v2 Value: s%3A2yI2DyuVUV1v8y8qpqw3-R-7TuQ.YGWzqnaxj%2BHgfY4udI8iA08It2bK%2FDTTtBWVUj3EHEo
.srv.stackadapt.com/	1970-01-21 03:30:13	Name: sa-user-id-v2 Value: s%3A2yI2DyuVUV1v8y8qpqw3-R-7TuQ.YGWzqnaxj%2BHgfY4udI8iA08It2bK%2FDTTtBWVUj3EHEo
tags.srv.stackadapt.com/	1970-01-21 03:30:13	Name: sa-user-id-v3 Value: s%3AAQAKINJGnSPnUygUSibcDPrkRZickSSvG-6Xqu_tHEN4GYmmEHwYBCDs5PmuBjABOgRUSQl9QgToZ2c4.Xh2VH3FdpBxTPoEGCG4Cijixgda9MMOBWAwiNqok2I4
.srv.stackadapt.com/	1970-01-21 03:30:13	Name: sa-user-id-v3 Value: s%3AAQAKINJGnSPnUygUSibcDPrkRZickSSvG-6Xqu_tHEN4GYmmEHwYBCDs5PmuBjABOgRUSQl9QgToZ2c4.Xh2VH3FdpBxTPoEGCG4Cijixgda9MMOBWAwiNqok2I4
.techtarget.com/	1970-01-20 18:44:38	Name: __cf_bm Value: THjY1DUzldUDiQ5wdA0iDGglsAZPGm116WMkQgDycHQ-1709077100-1.0-AU+QxKgeBURUTkLeMTUlyxx0eWxOKefTWklUmefcjuGoW1MmOJAgLgzl3ib4T0JP1vNAG7HKkGVRmey+JARU8WY=
.bing.com/	1970-01-21 04:06:13	Name: MUID Value: 1DC059F4C13F6EC3391F4DC6C0426FE0
www.huntress.com/	1970-01-21 03:30:13	Name: sa-user-id Value: s%253A0-db22360f-2b95-515d-6ff3-2f2aa6ac37f9.%252Bgb2Ni7iJXYdCIsAsMuD5YsexKsvOuWHMxgU3tLIwHY
www.huntress.com/	1970-01-21 03:30:13	Name: sa-user-id-v2 Value: s%253A2yI2DyuVUV1v8y8qpqw3-R-7TuQ.YGWzqnaxj%252BHgfY4udI8iA08It2bK%252FDTTtBWVUj3EHEo
www.huntress.com/	1970-01-21 03:30:13	Name: sa-user-id-v3 Value: s%253AAQAKINJGnSPnUygUSibcDPrkRZickSSvG-6Xqu_tHEN4GYmmEHwYBCDs5PmuBjABOgRUSQl9QgToZ2c4.Xh2VH3FdpBxTPoEGCG4Cijixgda9MMOBWAwiNqok2I4
www.huntress.com/	1970-01-21 03:30:13	Name: Metadata_visitor_id Value: lt50dmyvqjke10i4qr8
www.huntress.com/	1970-01-20 18:44:38	Name: Metadata_session_id Value: lt50dmywdvfwkiawt4t
.huntress.com/	1970-01-20 20:54:13	Name: _fbp Value: fb.1.1709077100952.73046999
.huntress.com/	1970-01-20 20:54:13	Name: _rdt_uuid Value: 1709077100958.f95fa1d1-5781-4dbb-8ad3-1300cc43f7fa
.linkedin.com/	1970-01-20 20:54:13	Name: li_sugr Value: 0ccdfd4b-4394-41d5-a265-2e4a75cb5cae
.linkedin.com/	1970-01-20 18:46:03	Name: lidc Value: "b=VGST08:s=V:r=V:a=V:p=V:g=2825:u=1:x=1:i=1709077101:t=1709163501:v=2:sig=AQHMQpapsuCjUn4TMixVxjxhefPtI9W4"
.linkedin.com/	1970-01-20 19:27:49	Name: UserMatchHistory Value: AQI0aOUj208BKQAAAY3s7vrHAxPiTylNCFmHKJ0M6ELBZDQwIAPv0XiGiSk3KlRgyqSVsXgz4QgvOw
.linkedin.com/	1970-01-20 19:27:49	Name: AnalyticsSyncHistory Value: AQJ8Uv5ihJOJowAAAY3s7vrHBMWhXdH-vsCO4yJ1S3slitDBFAfCf9ho6zWHO84HJVTFRABZnN9deUhhATUjHw
.linkedin.com/	1970-01-21 03:30:13	Name: bcookie Value: "v=2&96496df0-902a-4f86-8147-313d0e823193"
.t.co/	1970-01-21 04:20:37	Name: muc_ads Value: 4c2c418d-1fcc-499f-a898-1a5fb7077c44
.huntress.com/	1970-01-21 03:30:13	Name: _hjSessionUser_2159185 Value: eyJpZCI6ImE3NDgxN2U5LTFmNTMtNTYyYy1hM2IyLTQ0ZDk3ZWZkY2UzNiIsImNyZWF0ZWQiOjE3MDkwNzcxMDE0OTAsImV4aXN0aW5nIjp0cnVlfQ==
.huntress.com/	1970-01-20 18:44:38	Name: _hjSession_2159185 Value: eyJpZCI6IjA5ZDkyYzRkLWUxY2ItNDhkYy04ZGQwLTg0MTNkMWMwYmZmYSIsImMiOjE3MDkwNzcxMDE0OTIsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
.twitter.com/	1970-01-21 04:20:37	Name: guest_id_marketing Value: v1%3A170907710132223465
.twitter.com/	1970-01-21 04:20:37	Name: guest_id_ads Value: v1%3A170907710132223465
.twitter.com/	1970-01-21 04:20:37	Name: personalization_id Value: "v1_I+pbjAtZ+ei01muUA0ybxw=="
.twitter.com/	1970-01-21 04:20:37	Name: guest_id Value: v1%3A170907710132223465
.www.linkedin.com/	1970-01-21 03:30:13	Name: bscookie Value: "v=1&20240227233821bfec73c1-1f16-4062-8120-2eb44122231fAQGZv5nM-yFVpbl0gL0BeMIecUQgKPdO"
.a.usbrowserspeed.com/	1970-01-21 03:30:13	Name: tuid Value: b581d818-421f-499b-8318-a693d5711c6c
www.clarity.ms/	1970-01-21 03:30:13	Name: CLID Value: 9e33421bc4da416da51be6dd59b626b3.20240227.20250226
.huntress.com/	1970-01-21 03:30:13	Name: _clck Value: 18bqwdh%7C2%7Cfjm%7C0%7C1518
www.huntress.com/	1970-01-20 18:44:38	Name: drift_campaign_refresh Value: dcd72923-5532-4501-bfd4-c11ec0f892bc
www.huntress.com/	1970-01-21 04:20:37	Name: _gd_visitor Value: 94f1245d-4338-4d83-8c17-f4ba37077af1
www.huntress.com/	1970-01-20 18:44:51	Name: _gd_session Value: 6a5f63fa-13cf-4747-86df-4a5079ac9bfc
.adnxs.com/	1970-01-21 04:20:37	Name: receive-cookie-deprecation Value: 1
www.huntress.com/	1970-01-20 18:54:41	Name: _an_uid Value: 0
.c.bing.com/	1970-01-20 18:54:41	Name: MR Value: 0
.c.bing.com/	1970-01-21 04:06:13	Name: SRM_B Value: 1DC059F4C13F6EC3391F4DC6C0426FE0
.6sc.co/	1970-01-21 04:20:37	Name: 6suuid Value: b4641102276201006f72de65f2010000c9307b00
.huntress.com/	1970-01-20 18:46:03	Name: _clsk Value: ex3d6n%7C1709077103564%7C1%7C1%7Cp.clarity.ms%2Fcollect
.hubspot.com/	1970-01-20 18:44:38	Name: __cf_bm Value: GeMsjFKrR8Lh7.3kA5jbqjUcgy7dD0fjmwKg0CPKS4o-1709077103-1.0-AT3FDWoUtq1LmYvGwiYuYMT55CoxN0Amt0rfYNDmmiKGhO0VSwv61BHss9khDdHr0exsyctEjlxRflJ6GLXCXMo=
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: p.3r9SD0sHbHaLtDKyGl0jgRTrst1AWq259CpxZItME-1709077103580-0.0-604800000
.c.clarity.ms/	1969-12-31 23:59:59	Name: SM Value: C
.clarity.ms/	1970-01-21 04:06:13	Name: MUID Value: 1DC059F4C13F6EC3391F4DC6C0426FE0
.c.clarity.ms/	1970-01-20 18:54:41	Name: MR Value: 0
.c.clarity.ms/	1970-01-20 18:44:37	Name: ANONCHK Value: 0
.www.huntress.com/	1970-01-21 03:30:13	Name: _zitok Value: bb29c455cfbdcd5b43801709077104
.zoominfo.com/	1970-01-20 18:44:38	Name: __cf_bm Value: mFgqsHV.vhoSLwZHaJKNCGCd8UphiFURyP9KE.YklMM-1709077105-1.0-Aa+dvo1EXH2FaPBN7Le8jEZmGPm7WcFKRTc6j79Qd+t6UlN4WQL9CU+Zm+yjwzQKbA/eD7CUfbwxxSfpXxZ9WMU=
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: BhFchl8cBu2cuPhVuyktMOezWvd6szTMlgehFSlnM5c-1709077105380-0.0-604800000
www.huntress.com/	1970-01-21 04:20:37	Name: drift_aid Value: 97840055-e8c1-4640-9cbe-68dabc7a4c6e
www.huntress.com/	1970-01-21 04:20:37	Name: driftt_aid Value: 97840055-e8c1-4640-9cbe-68dabc7a4c6e

125 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass(Line 131) Message: Unrecognized feature: 'web-share'.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass(Line 209) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass(Line 209) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://connect.facebook.net/signals/config/403957864408442?v=2.9.147&r=stable&domain=www.huntress.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100(Line 105) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.quora.com
a.usbrowserspeed.com
alb.reddit.com
analytics.google.com
analytics.twitter.com
api-gw.metadata.io
api.neverbounce.com
assets-global.website-files.com
assets.website-files.com
b.6sc.co
bat.bing.com
bootstrap.api.drift.com
c.6sc.co
c.bing.com
c.clarity.ms
cdn.jsdelivr.net
cdn.metadata.io
cdn.neverbounce.com
connect.facebook.net
cta-service-cms2.hubspot.com
customer.api.drift.com
d3e54v103j8qbb.cloudfront.net
event.api.drift.com
fonts.gstatic.com
forms.hscollectedforms.net
forms.hsforms.com
gist.github.com
github.githubassets.com
google.com
googleads.g.doubleclick.net
hubspotonwebflow.com
huntresscdn.com
i.ytimg.com
ibc-flow.techtarget.com
ipv6.6sc.co
j.6sc.co
jnn-pa.googleapis.com
js.driftt.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsadspixel.net
js.hscollectedforms.net
js.hsleadflows.net
js.hubspot.com
js.na.chilipiper.com
js.zi-scripts.com
metrics.api.drift.com
p.clarity.ms
perf-na1.hsforms.com
px.ads.linkedin.com
q.quora.com
rc-widget-frame.js.driftt.com
script.hotjar.com
secure.adnxs.com
snap.licdn.com
static.ads-twitter.com
static.doubleclick.net
static.hotjar.com
stats.g.doubleclick.net
t.co
tags.srv.stackadapt.com
tools.refokus.com
track.hubspot.com
tracking.g2crowd.com
trk.techtarget.com
webhooks.fivetran.com
ws.zoominfo.com
www.clarity.ms
www.facebook.com
www.google.co.il
www.google.com
www.googletagmanager.com
www.gstatic.com
www.huntress.com
www.linkedin.com
www.redditstatic.com
www.youtube.com
yt3.ggpht.com
b.6sc.co
event.api.drift.com
rc-widget-frame.js.driftt.com
104.16.137.15
104.16.190.89
104.16.80.186
104.16.88.20
104.17.207.249
104.17.230.163
104.17.89.154
104.18.125.12
104.18.160.125
104.18.36.196
104.19.155.83
104.244.42.131
104.244.42.133
13.107.213.45
13.107.42.14
13.225.78.111
13.32.27.21
13.33.187.119
140.82.121.3
142.250.184.238
142.250.185.131
142.250.185.142
142.250.185.174
142.250.185.227
142.250.185.246
142.250.186.104
142.250.186.38
142.250.186.67
151.101.129.140
151.101.65.140
157.240.253.1
157.240.253.35
162.159.152.17
172.217.16.194
172.217.18.1
172.64.144.225
172.64.150.44
172.64.153.27
172.67.68.218
18.245.46.48
18.245.86.87
18.66.147.59
18.66.97.14
18.66.97.37
184.24.77.28
185.199.109.154
199.232.188.157
2.17.100.184
20.122.63.128
204.79.197.200
216.58.206.36
216.58.206.42
34.111.208.231
34.111.224.162
34.159.227.151
34.202.4.253
34.217.7.238
37.252.172.123
52.222.232.144
52.28.87.155
52.4.62.73
54.147.21.139
54.68.63.216
63.35.51.142
68.219.88.97
74.125.71.156
76.76.21.22
76.76.21.98
0020be3f1555293342637940e02d32e0f0c3b1951f6a274c00a6e3afe91610d1
00d08ce080678db0c54af3944723e28b27e8bdc24146f813477b5b58fe65376c
01d887f604f5f9cf0707707d61b0b6db0f44bb692a6cf15ba8c95f74a1bc138d
02c65a6d1cdc752f31b0be2157d9c6f65e72c7f3e781eea941bd848caf8a332e
0591af742c10a8ad2020502cccbf97cb4fc1cfc48acaf588043d70e77b2c3aaf
0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0c7178cc6ca34fb18e30f070a5e7a1c287b2d7ccfcba2cfdf06e0f46eda55740
0e04153b5f73bfa7866948f2a9870593d69bfde14e77a1a06af5f567096e5a09
0f596cb38dc72ae999b1a7d5dcd3cb1b1b2c99dc27486943e52f08d32c8dfb18
10b977a814bd9ca3e018a07b6e1197c9a9fa89a27a2419158d22f41ab8a29508
14c59924cdca7796d9578872e6933998297b41cb0a2951ccaf7de4bd7cf921ff
14e6206b0b854f8eb373b1ccfbac42efdb97e1034de1355abb4ee81aa0672ec2
151ec725ee7c99ca4c03243ba1d27d9bdc55c8c84048664eb854634a57b2e80b
15736c00b563c558ec1e7d531c0d8bd7d8cc24c2026adbc2dcf0ccd3e48f7d65
15968c31de4feede3cef1e6d6f6d22cdf0e3357c787b8c33a9385680aa5e83d7
1650436b42349eba90400162f9104f8abd0e8b846cf91d26c907c300dd8d7f85
19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563
19680a27e88da4a3713af26571b4849096e75d617f2845574af7fd15746256bb
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1ce5bbfddabe83a619dffbd897ac79e94ca961f04cf463583a421a22f5329938
1e4c2421421b6cf5524e02216937448a77114d75f93468724af367184313ae8e
215162d385055d4248ce3810f5294fb0e1a857b2b18997d00805ca98f480fc79
28cf2b2374a7fe727fa05e23727151034a93103de21eda97e5b4513a26b83c70
2939d067bced6e2e3e43c1b10d2b067cb980410c2cc42fd3e867798a4a36c697
2a33dce92d031e437387a6e75f9c8b44785fe76324b5f4e6daf179e9427d0a0b
2a8a441d8086f20a64563edc759aba1de84d932e34ff77b8bb0279a730cdb428
2c699eb55ae3fe61b3d783c8936ab1eb949c596a5c89118f703e328ede2b8308
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
33b900fc8ec76da783f8a7aa7bc711f70f8f09704d13126c7e0454064b162f71
350cf9ff67297ce9f79b1a35fb7205326d21f149ab404f81ec875968f0b7d083
36b097a74149a547cc7fe1da7b5a9cacf6c36d2f91872f11874479e1d4fafee2
389070ccfb044fe066247777f8f7d7177d7f1add5ac4d84a63e376a010a1f556
3a9886679dab1ea5d82978ea93e590cd27fb5902bb664d9c8f55ecf2256b6d5a
3b3f4331825536e7bfea2547e2bd1b906dfaeb46a4d0ee5c43961f90fdbfbea7
3db9c167e90b10ff974e1efce11fc76330279b2e282df0a6c0a42e56bbf4f68b
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3e74699ee2810c89e5df5bd0d0506256c46f1e73108f40dc993b49cc210203db
404c2e69414531ea3b2f142c5bc8455cfc59b1c0748277f8fcfa2538306a3f69
4081a5f270ace3305571b8f393e20c3a50141d103fb6fced35cf64d5182c2cd2
43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
44dbbb0a1da3d1a2b3f637ba2eff82150de83164b3caf824fc0fc46633588de3
45396b8359112c614d4aab3fcb716deaabc47e477078f675d7bf69f5791c8f53
476391eb30402ffa649859e58b65a4524a75f3988f55777c0b19225db3699da9
49cd7b7181e7181af04b5848a8eb65c40415c59f999977e7122f928bd3a106b2
4e938e5b4fe364bd2d00ec08067f98aa54b1398df28287257b8434012ff20033
5172e93284d4516ea2e8fea2469a9b23556d92360b344cb50985c91db3cdbb12
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55014dbf69631ed5825be787f9c494ca876a9504a85a82fd32806bfe724be1c2
553797b86e5516ebb3b4a6ffc794d7d9eca1fc1f3ca8ab0703e5eff9934e29c8
57060dd390b97abfdefa4db0309a06cff310bfd52f220bbf2f4f83886cfde641
574196df2113d3b8463aa9225da93d50b8d2453c16ababa1b6bbbe9b63efe56a
58e89e283b8f550f453c0fb517da994c3529f6336d6d7bd1593ec0e04d8c102d
58fdb03fac3e89e51525a5a45eb777395d1b499bf4483e96201b6becddbe516f
59435c97638a01eaf751949c97b484bac9ab16f17459f82e4a832b9a79e22910
5a79efc8ca07a0cd5975e5af74a91ebe7a1ef5cfc9eaff89904bb5bd73dd194f
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5c3f7385d27ae86b8a0dd50875bd728710993ca9d36000aa0d2ad20a4a6c1d1c
5d247e1c2efc38a727967b2f5f9e99b961d0cbe2b0aa1ddcf170bd6933409403
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
5e4e01da0230734413d39e4657ac95b4ccf45092ff61a162aa1f4d111a166735
5f206b060caf20ae38c428c1bad44ccaf68b6345b63f2a7f06428e9747526c06
5feb1224febe4002ba3c028bbb17a47b1762ca33ec3f5698e684b9071bbabdd9
629de5c42a56b67812a858341eb4162b85218eed884271ca47b0388498dc8916
6432f355492e71d3ef3f718ece533e2b6d10d800849a41d4c308e48ef6ba128c
66689e1abd7d828b57f6b65035a71f1df855a4e80dc06d43fc0c2ef961fc5b3e
67786077050307fcffb9795d3f5fd2a2e5d3956e692181609fee98693604d321
67b21e62c1980c312509a7fd0475ffe52ee546a1014f4506ec113fab10a1f09e
67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2
6861a320271e0fda832800e20d53b858ef409f88d9bc9c1a48953888289d1ea3
6a6a06c6f8fb209f9e92af2bb5ed0c0d0e767211a1a92e631e1d0ce056488387
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6c9c6406c9bd9814cf84974221433003377b67f071ec5411fddbcba4ec109bca
6d3e049fc10e5ccd8c18da785740145dc0d5393bd5c5bbfdb136f52023d07d5a
6ee38878cd3f57c918114ecd1a74bc75e5165f45fd1e9503056e8dc2e542288f
6f3642cd8faa981a6b7f71cb0bd88a222ed7c92510100761c38f4bfd689853f2
71425f588c17edb9905c3ed73aee0404b58772b91c8154fe53d3157f58f0b2e2
740bb313221bda5543b6fbe0bce3dd276cc70c4fd9aa0bae9d46b149406becf5
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
7573e5629fdd86c1b9715e81fd55e01c7cf7febbfc3562f5acbb757c0d4cce64
7641f066c35d0ca15d4897bfe49d640ed4c143ff8f04030c2020cbb2acfa7b0b
765a638d2813ec1b917fc56cf90863f88991ef2550c1a14c99e9e9b243e80f74
77eda3beb67865c89e220f909e24c8624f05e107c82649a2165c8ba116e99f12
7879306396985ae1d55e9b084fcb0793214a169a262770770886f3f9eaf4dae3
794dc30b5582c5b0c4a06c2e0776f6527a84c91d5f7abb9384e7588d0ab3a910
7a0a3edf7292523aa8dd079542a633cbd45eb882d6aebb4cacfe4b97f9601e97
7ae55f9afeb001ff5aef3f3754bb6ac0c9dfd9df171130572cbfc04db6e09e33
7cc2d877629fff74472a275de25a3c9abcefa24f23bc18756c43081554caf9b6
7f62ee80b8c824f30ad6c278146632d25b7e159e0a9cd91a356068eb9340061c
819dfbb3b4773187de06060775662d73315d109d3eeb1a31e28d49112ab2fe47
82ba33778a6595a59baef6e6964c64d7c3e9888c2bbf74461f1948b295db28e2
8323a2d9c9e1f89ab87c4463fccb464202b4990a9a7b235f7e056b0689b135f7
84d9a8398452005a5d2abc445e3c54aabd86e648ed214d420d7fb323262719b1
860c659e8836feb6a6b4fc4c9b7195e4ab0a04e4642473c0780ae554fbf6ffb2
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
89aa43cb2db8717165e898b18806ad757585f8815f9f514bb0afbd3c390def95
8a8567e7607dddbc5a4dbcefcd92aeb2e19a8fe8bee4b0a566e9dce691677329
8bb32fa0e592e2a44960ae7968209505aa45089c8ad2259d2b972523bde374c7
8c1781ec4483c6fb3bd9ad005d312800eaf24e232c12976624bff84f8ab908b3
8cede167f8e0eb1a742b600847e11c36e71ca6f8a2392c2474f31387b0cd5f4c
8f0f089b8d2746c56340171bba62f027d4d2dc0f520588d9480432693381e14a
8f0f8792237470ee661c6afc32ca68200dd74bcc0d544d0fd54c7777af362eae
91fc65299ce98830bcd88fa13b9a5bd1880fde358af7c6cebe4b95f20e14cb20
93a2fd82dd3a13a9e9ce0583f3bde1b6e88da6ebce30fa8c87cee4d9d927e4d2
944352d0198c673b45a699471c970aef85458ea3c58a3ed825b0f0e4f33f999c
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9bcad26a447cbeb43523bd54477bc26548e4932086610e251d302f57af1ab93c
a0eb564e8b104002217b23d191c384d64d77b30fa37b0f124db645e16096cfd3
a1e79865576e220b93dfe34d011286a8335ee8ac4eb6450300fb45a4f15a600e
a447d3663b55765c353cd2d4067634356183f5589b5af36e703e452926669f0e
a4aba4543a40b2e2d78e4006eb941a3a18cf95dc81041ad362321a3995bcc898
a577cc713533d7a1edbc5186c3f7b8788bbf317a857111150778d6a617220cec
a7a9292edd72228ac6b7839b6e29a832ab45515a5c78d548ccd5fd8a2b1942ff
aa8b379f14b0d120d8c9a72effcf7c718ba150d23e37420eaa441c628e42d1ba
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ace449f8c185f9f62716fd9998c8f4d09f6849ead77ec8c3849aa69f4c8c1d36
ad1a0bf17b8433241806ec0b3cb9c17be616ea295df90068ab3e646de802e111
ad8f7f9fca3ba0ead7b113adb6d8cd0656ad955f911de45c52fb13fc4e827d7c
afbd41e7209fa3aef6f53c7a5713aa542a7be54c432fec2d690e0dfaccd528d1
b0af909b7ae6ad2644bfe2a60d939092aaf113b2cbc4ed2981a892869143b98a
b0b3c8a08afff51d87d6f144eb76c25bdfd19943cc6cb93e5f22b00c0728d06e
b5c7dca4d4d058fb9d5be514d932f42554649242edfaa890898b5eb4c09b7c90
b7bd039fcf8ea3ece5223d270ecf6d66277f9cf7ddacb8fd3f20d1702432c3bb
b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1
b9662a50703853ca2a318262d930668b8ae42333c6b413a424d0296212c40865
b9b4f19dee3d4910ab6fb4ea6e8a3126cfd5386c0bec674b65461a5192dba995
b9c3b5c8dd9fda103f750f15c52b04423cf1791056ed251dad9e80210987f877
ba3035c1cbfbd4ebb878f85acde3d846c6e9e90081de78ddcaf3126b4e8823b0
bba54915db71fc417be4d5852ec7d138d7c3fa90356ddee98b5267a7db7e6b5b
bfae35edc61595bd27d16c01ddc44ef00c152c0006e16f836101d3b6a6621d01
c1ae5b294dafd600a8377432c1cf1f05694e1d82ced9931f8ba71a11d753c2f1
c2a101f313f27c267a744088e44664a87d2ec7dc2a3464bf1319a95094dc76db
c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140
c99531b584c2990420c6cf8f267e27bca20375cf89d4afdcaa5b3afb7a9f35d2
c99d11cb4960d6e1918ed55d5bcbb316d38b51098e2efc1201904d7274d3273e
ca38f2df2a3be653605830a05931aeac85fbd1c3fa2e483a334fdc25e3463503
cb71e959e48a15247f687beda65881cf3a66e572e7b08ff60631e9071c80a52f
cbcfb303a1e7d1f9da8965565b535f4122f2de2f1f3ed9f61f3f9e2dad3dcf9d
cd8fd067e7bf84283f653e98980f7cc7c344f4a4777a2cdf5aa888e52678d487
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
cf8edbedfd479fe7cc642e3a1db515dd1103f2d7864f0db5cae6144fbde44ea4
d04196ec92f307c66ad56e3adbd4536e6c504a251299183c2c016de66a65af39
d674a115404e8d29a650437584421bd9d7ec57c4d43fe3e0a09adc080d521c44
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
d902c3e15f49b1b6477b075c2384aab2b01ece853370c61ffeb04662a11cf4db
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
de1e399b07289f3b0a8d35142e363e128124a1185770e214e25e58030dad48e5
dec888202913f9630b63196880ea2e96210c59df2905e55154fe88432c1b0e3d
e0360227c48e1c8334b6adb5cdd071c93d5324b6b2860b82f261e69c6c93d561
e12404ccb0492da0a89fbda8db0ddb3c2358fcbd6d29b0c106ba840ca5f5e8ab
e25771659046bed206f576f67ef77c46c7c639fde3b416a20e279703ae25a669
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5149bac0cdad7bbd9d1b7badb88909929d324ee90b6dd1628e0c59024d68e7c
e523f47c65c171a685ca8f1bb0c0c432f4d71104fa56e8f6163126ec908cc430
e555f4b34b579e6528d6bbd4819620a634c0759b41dfa99520b7ca5aa5117b11
e5724b80dd7456460f12db0a8870676b40184fa7076eb751afb23be11164719c
e788d900c315814a8b4f8e8fff385175b5f9e79f5c0cab923a57b8088c4c9a13
e8e658c81a7ff92a6e0f9049ee3a8fc42082e8303abb6ed44c73361259cbdbae
ea6b7f8e4082f1010c7d5bf851a5ded165517b36e01251fdfd548c046070936f
eb6ce397310855bbef74043afcdda989653ad7b7b385191e8c8d622eee74b367
ebde95e07992c2e57ae18f8badfad62c3263a6baeda6c9bb05cfe642f69ef459
ed4da8d59696a378f7440bbbd1485c2ecf592dd09fbe8a03b01803a251ef1e03
edf1011ad272d21b66ae82a21a9d029186dc81c9f13972203fc3107f75835d4b
ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f
ee9f2f620122112ded1f6498ba96d1c797429ab7c07806f689ed5d7142c15973
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2314da0b26cc727445f74c19d54f2f75944ea1a610497231ba6a5d9e541acf0
f4d1dc5e2bebcc6c035e733b5586f308c032e377d490d733835fbc1fb0e5d979
f6de8eff2f2f46b4d3e24716caa22af17db498dfbbc0ae5e984d7ea8b098f7d8
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f87a1bbd0c50fc599544d3ccfad1c7bb1509f7b7eaa2d814dd700f6427fc6ac1
f882272d89b62b5397ed4085b9d96b3458baceac7a6a776a62718878ec600575
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
facf8de270be69de3d2a6fc877d6bbf24baacdeb6f8c5b39a4ac4853bcc096bb
fc573eaf0e39d6b2429951f78b744dde5acb4cbee85a9b903aea0210072d9b48
fca96e23cbef68956d5776a0e13de71ab3e0d82c192d143bc93a063776ee81ad
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

www.huntress.com Open in urlscan Pro 63.35.51.142 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

230 Requests

97 %HTTPS

0 %IPv6

53 Domains

79 Subdomains

69 IPs

4 Countries

5269 kBTransfer

16988 kBSize

62 Cookies

27 Outgoing links

Redirected requests

230 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.huntress.com Open in urlscan Pro
63.35.51.142 Public Scan

Screenshot
Live screenshot

Full Image

230
Requests

97 %
HTTPS

0 %
IPv6

53
Domains

79
Subdomains

69
IPs

4
Countries

5269 kB
Transfer

16988 kB
Size

62
Cookies

230 HTTP transactions
3 data transactions