duo.com Open in urlscan Pro
143.204.98.6  Public Scan

9 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 23

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1634707900583&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7540%26time%3D1634707900583%26url%3Dhttps%253A%252F%252Fduo.com%252Fdecipher%252Ftelecom-firms-compromised-in-lightbasin-cyberattacks%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1634707900583&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&liSync=true

Request Chain 43

• https://dpm.demdex.net/id?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1634707900836 HTTP 302
• https://dpm.demdex.net/id/rd?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1634707900836

Request Chain 60

• https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=Njk2OTA1Mjk3MTcyNzMzOTc4MTM0MzQzNzE0Njk5NDA4MTgwNzE= HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=Njk2OTA1Mjk3MTcyNzMzOTc4MTM0MzQzNzE0Njk5NDA4MTgwNzE=&google_tc= HTTP 302
• https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEGRJQmLDr2sAXa7-Jqi4Gkw&google_cver=1?gdpr=0&gdpr_consent=

Request Chain 70

• https://usermatch.krxd.net/um/v2?partner=adobe&id=69690529717273397813434371469940818071 HTTP 302
• https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=69690529717273397813434371469940818071

79 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request telecom-firms-compromised-in-lightbasin-cyberattacks Show response duo.com/decipher/	77 KB 22 KB	199ms 167ms	Document text/html	143.204.98.6 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.6 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-6.fra50.r.cloudfront.net Software Duo/1.0 / Resource Hash 773f9a3bd5d0b561fea830cbd453c6b04ca75654077a10b5da025b767e77a38d Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :method GET :authority duo.com :scheme https :path /decipher/telecom-firms-compromised-in-lightbasin-cyberattacks pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers content-type text/html; charset=utf-8 content-length 22341 cache-control max-age=300 content-encoding gzip date Wed, 20 Oct 2021 05:31:40 GMT etag W/"616f19ef-1322f" expires Wed, 20 Oct 2021 05:36:40 GMT last-modified Tue, 19 Oct 2021 19:18:07 GMT referrer-policy no-referrer-when-downgrade server Duo/1.0 strict-transport-security max-age=63072000; includeSubDomains; x-content-type-options nosniff x-frame-options SAMEORIGIN x-ua-compatible IE=Edge,chrome=1 x-xss-protection 1; mode=block vary Accept-Encoding x-cache Miss from cloudfront via 1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-amz-cf-id Hyluq5WvHZIqkppuoBJEFshM4Tzs2uYGMqOfTOVBo5QJJw2NwPTduw==
GET H2	200	production-2018.css duo.com/site/themes/duo/css/	513 KB 99 KB	171ms 171ms	Stylesheet text/css	143.204.98.6 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://duo.com/site/themes/duo/css/production-2018.css?v=1634238315 Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.6 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-6.fra50.r.cloudfront.net Software Duo/1.0 / Resource Hash 7bc994ade30ccad02b02ced6d3e99430b0235c930f711557690934d8ea66cefd Request headers :path /site/themes/duo/css/production-2018.css?v=1634238315 pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority duo.com referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma public date Wed, 20 Oct 2021 05:31:40 GMT content-encoding gzip last-modified Thu, 14 Oct 2021 19:05:15 GMT server Duo/1.0 x-amz-cf-pop FRA50-C1 etag W/"61687f6b-8032b" vary Accept-Encoding x-cache Miss from cloudfront content-type text/css via 1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront) cache-control max-age=31536000 public, must-revalidate, proxy-revalidate, max-age=31536000 x-amz-cf-id 0uCpIyOQvE3VmGQXtR21fPvA6D-uffrjo6yAmy875E1mM3hVhKJYAg== expires Thu, 20 Oct 2022 05:31:40 GMT
GET H2	200	d-logo--light.svg duo.com/assets/img/decipher/logos/	4 KB 2 KB	11ms 11ms	Image image/svg+xml	143.204.98.6 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://duo.com/assets/img/decipher/logos/d-logo--light.svg Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.6 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-6.fra50.r.cloudfront.net Software Duo/1.0 / Resource Hash 694b5d6220eb8a349b60ce749052c3b923c8449bbfb4ebfb68f4fc27f1b7e92b Request headers :path /assets/img/decipher/logos/d-logo--light.svg pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority duo.com referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma public date Tue, 19 Oct 2021 10:43:54 GMT content-encoding gzip last-modified Wed, 24 Oct 2018 13:44:56 GMT server Duo/1.0 age 67666 etag W/"5bd07758-ff2" vary Accept-Encoding x-cache Hit from cloudfront content-type image/svg+xml via 1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront) cache-control max-age=31536000 public, must-revalidate, proxy-revalidate, max-age=31536000 x-amz-cf-pop FRA50-C1 x-amz-cf-id Mli1iDCD50cDKX2sV48X8lNrNTcz2qjYMzFeNhT4HS4G37rqWelQTQ== expires Wed, 19 Oct 2022 10:43:54 GMT
GET H2	200	gtm.js Show response www.googletagmanager.com/	268 KB 79 KB	58ms 37ms	Script application/javascript	142.250.185.136 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.136 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s50-in-f8.1e100.net Software Google Tag Manager / Resource Hash c8e48f82e91f5bac6353c7db81753d16c68a96816eedec7f8a1b4ebebad5c3f9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 05:31:40 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 80066 x-xss-protection 0 last-modified Wed, 20 Oct 2021 03:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 20 Oct 2021 05:31:40 GMT
GET H2	200	d-logo--footer.svg duo.com/assets/img/decipher/logos/	3 KB 2 KB	11ms 11ms	Image image/svg+xml	143.204.98.6 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://duo.com/assets/img/decipher/logos/d-logo--footer.svg Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.6 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-6.fra50.r.cloudfront.net Software Duo/1.0 / Resource Hash c33592c7a249c98164b3d533c58fae62ced2b403deab8f2d0cce4c4f1cbb285d Request headers :path /assets/img/decipher/logos/d-logo--footer.svg pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority duo.com referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma public date Tue, 19 Oct 2021 10:43:54 GMT content-encoding gzip last-modified Wed, 24 Oct 2018 13:44:56 GMT server Duo/1.0 age 67666 etag W/"5bd07758-b5f" vary Accept-Encoding x-cache Hit from cloudfront content-type image/svg+xml via 1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront) cache-control max-age=31536000 public, must-revalidate, proxy-revalidate, max-age=31536000 x-amz-cf-pop FRA50-C1 x-amz-cf-id CuLL2K-_CoZzRVyZQUGoGloO7ECjijW4Ws0Ph1veNWGWQLBceayI1A== expires Wed, 19 Oct 2022 10:43:54 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.1.4/	82 KB 30 KB	59ms 18ms	Script text/javascript	142.250.186.138 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.138 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f10.1e100.net Software sffe / Resource Hash 22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 19 Oct 2021 05:03:47 GMT content-encoding gzip x-content-type-options nosniff age 88073 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 29725 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="hosted-libraries-pushers" expires Wed, 19 Oct 2022 05:03:47 GMT
GET H2	200	production-2018.min.js Show response duo.com/site/themes/duo/js/build/	761 KB 271 KB	171ms 171ms	Script application/javascript	143.204.98.6 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://duo.com/site/themes/duo/js/build/production-2018.min.js?v=1634238315 Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.6 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-6.fra50.r.cloudfront.net Software Duo/1.0 / Resource Hash 458e7c80a4951c17c8ae7501b9bfad429ae31d82e241773378d89adf2e9b2e6a Request headers :path /site/themes/duo/js/build/production-2018.min.js?v=1634238315 pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority duo.com referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma public date Wed, 20 Oct 2021 05:31:40 GMT content-encoding gzip last-modified Thu, 14 Oct 2021 19:05:15 GMT server Duo/1.0 x-amz-cf-pop FRA50-C1 etag W/"61687f6b-be5a4" vary Accept-Encoding x-cache Miss from cloudfront content-type application/javascript; charset=utf-8 via 1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront) cache-control max-age=31536000 public, must-revalidate, proxy-revalidate, max-age=31536000 x-amz-cf-id iHsCqFC0uzkiU4OUqMbCeJC0MEf11cHyWjPro7_QJGRVP-rbiNrSWg== expires Thu, 20 Oct 2022 05:31:40 GMT
GET H2	200	E-v1.js Show response fast.wistia.net/assets/external/	619 KB 118 KB	37ms 6ms	Script application/javascript	151.101.130.110 FASTLY
General Check archive.org Show headers Download Go to Full URL https://fast.wistia.net/assets/external/E-v1.js Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.130.110 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 228f0559eebdaa83c3960c137262b7b0f17e3f2982ee6a54b8d82c4c2a393f5d Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 05:31:40 GMT content-encoding br vary Accept-Encoding age 2756 x-cache HIT, HIT content-length 120170 x-served-by cache-dca12927-DCA, cache-hhn4044-HHN access-control-allow-origin * x-browser-version 93 last-modified Mon, 18 Oct 2021 13:09:36 GMT x-timer S1634707900.453649,VS0,VE0 etag "616d7210-1d56a" strict-transport-security max-age=0 content-type application/javascript via 1.1 varnish, 1.1 varnish cache-control public, max-age=3600 x-browser chrome x-ecma-v modern accept-ranges bytes timing-allow-origin * x-cache-hits 1, 88
GET H2	200	ctm.js Show response www.cisco.com/c/dam/cdc/t/	128 KB 30 KB	162ms 8ms	Script application/x-javascript	95.100.76.145 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.cisco.com/c/dam/cdc/t/ctm.js Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.3, , CHACHA20_POLY1305 Server 95.100.76.145 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a95-100-76-145.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 1921bee4b409248cf69d59cf72dd4336385e643b12bebeff2e20c1dee738467b Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; frame-ancestors *.cisco.com *.jasper.com *.ciscospark.com *.ciscolive.com http://cisco.lookbookhq.com https://cisco.lookbookhq.com testcisco.marketing.adobe.com cisco.marketing.adobe.com ciscosales.my.salesforce.com test.salesforce.com zedo.com hindustantimes.com economictimes.indiatimes.com *.webex.com *.cdw.com *.cdwg.com *.cdw.ca *.meraki-go.com http://ciscopartners.lookbookhq.com https://ciscopartners.lookbookhq.com ciscolearningsystem.com ciscocustomer.lookbookhq.com cisco.lookbookhq.com ccsmedia.com *.itquotes.ie dteonline.com ampito-cisco.com arkphire.com *.insight.com *.ccsmedia.com *.ebuyer.com *.lambda-tek.com *.storm-technologies.com *.vohkus.com *.bechtle.com *.rainfocus.com *.broadbandbuyer.com *.hardware.com shop.redpontem.com; Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 05:31:40 GMT content-encoding gzip x-content-type-options nosniff vary Accept-Encoding content-length 29885 x-xss-protection 1; mode=block pragma no-cache cdchost wemxweb-publish-prod2-01 x-test-debug nURL=www.cisco.com,realm=0,isRealm=0,realmDomain=0,shortrealm=0,upgradeTest=1 server Apache x-frame-options SAMEORIGIN etag "1fea6-5ce5310ab7480-gzip" strict-transport-security max-age=31536000 content-type application/x-javascript cache-control max-age=0, no-cache, no-store content-security-policy upgrade-insecure-requests; frame-ancestors *.cisco.com *.jasper.com *.ciscospark.com *.ciscolive.com http://cisco.lookbookhq.com https://cisco.lookbookhq.com testcisco.marketing.adobe.com cisco.marketing.adobe.com ciscosales.my.salesforce.com test.salesforce.com zedo.com hindustantimes.com economictimes.indiatimes.com *.webex.com *.cdw.com *.cdwg.com *.cdw.ca *.meraki-go.com http://ciscopartners.lookbookhq.com https://ciscopartners.lookbookhq.com ciscolearningsystem.com ciscocustomer.lookbookhq.com cisco.lookbookhq.com ccsmedia.com *.itquotes.ie dteonline.com ampito-cisco.com arkphire.com *.insight.com *.ccsmedia.com *.ebuyer.com *.lambda-tek.com *.storm-technologies.com *.vohkus.com *.bechtle.com *.rainfocus.com *.broadbandbuyer.com *.hardware.com shop.redpontem.com; accept-ranges bytes expires Wed, 20 Oct 2021 05:31:40 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	48 KB 20 KB	28ms 7ms	Script text/javascript	142.250.186.174 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.174 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f14.1e100.net Software Golfe2 / Resource Hash fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Wed, 13 Oct 2021 16:38:54 GMT server Golfe2 age 5434 date Wed, 20 Oct 2021 04:01:06 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 19747 expires Wed, 20 Oct 2021 06:01:06 GMT
GET H2	200	bizible.js Show response cdn.bizible.com/scripts/	83 KB 32 KB	46ms 7ms	Script application/x-javascript	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/scripts/bizible.js?account=duo.com Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67F3) / Resource Hash de22a1f465480545ea9595d61c16ad21ad40e6b2509cca0e76d2601980e52988 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 05:31:40 GMT content-encoding gzip last-modified Tue, 19 Oct 2021 19:36:25 GMT server ECS (frb/67F3) age 27712 etag "8d28e9a20c5d71:0" vary Accept-Encoding x-cache HIT content-type application/x-javascript cache-control max-age=86400 accept-ranges bytes content-length 32249
GET H/1.1	200 OK	insight.min.js Show response snap.licdn.com/li.lms-analytics/	5 KB 2 KB	33ms 7ms	Script application/x-javascript	2.16.186.18 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2.16.186.18 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-186-18.deploy.static.akamaitechnologies.com Software / Resource Hash fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Wed, 20 Oct 2021 05:31:40 GMT Content-Encoding gzip Last-Modified Wed, 29 Sep 2021 19:17:49 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=23278 Connection keep-alive Accept-Ranges bytes Content-Length 2036
GET H2	200	ebdaa317731b0.js Show response t.contentsquare.net/uxa/	299 KB 63 KB	31ms 7ms	Script application/javascript	65.9.71.60 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://t.contentsquare.net/uxa/ebdaa317731b0.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.71.60 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 34bd0b5502e2f1e64b599f55faff54ef46590ef1fcee0545d1003b6043fabb95 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Tue, 19 Oct 2021 12:16:01 GMT content-encoding gzip last-modified Tue, 19 Oct 2021 12:15:15 GMT server AmazonS3 age 62140 etag "8c75afcfdd00687ffbb525e5b2d0e326" x-cache Hit from cloudfront content-type application/javascript;charset=utf-8 via 1.1 47a7b8b932d91b0edbfc42f1ba94ebc1.cloudfront.net (CloudFront) cache-control max-age=900 x-amz-cf-pop FRA56-C1 accept-ranges bytes content-length 64297 x-amz-cf-id 8oafB_AgdG4MFLLnc49Ud8x2o1oo1JF3MyKPDCb-K48_adV5OvfFDg==
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	98 KB 26 KB	21ms 6ms	Script application/x-javascript	185.60.216.19 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.60.216.19 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS xx-fbcdn-shv-01-frx5.fbcdn.net Software / Resource Hash 4b5e988359c30afd1d84b7a5118296f1fc33f4527d530b096ca27aa7fbfef99a Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 25969 x-xss-protection 0 pragma public x-fb-debug P7HEb26GM133BIALmpo5Xid7fnVA61ZHK09qmC8pHnVgxdAfZwcdC1KvUBiRrFFtT7Qxx/iahRfyiu9YsURJFg== x-fb-trip-id 917726464 x-frame-options DENY cross-origin-opener-policy same-origin-allow-popups cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" date Wed, 20 Oct 2021 05:31:40 GMT strict-transport-security max-age=31536000; preload; includeSubDomains report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-fb-rlafr 0 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H/1.1	200 OK	munchkin-beta.js Show response munchkin.marketo.net/	1 KB 1 KB	40ms 9ms	Script application/x-javascript	104.111.234.67 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin-beta.js Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.234.67 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-234-67.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash aaddb9b9a1d45c5de508e64c3dace01f450e4a7521229e99f03838f5067cc8f9 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Wed, 20 Oct 2021 05:31:40 GMT Content-Encoding gzip Last-Modified Fri, 01 Oct 2021 01:04:09 GMT Server AkamaiNetStorage ETag "d2b1913e6438b06d03258094a8c365f8:1633050249.484514" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 752
GET H2	200	bat.js Show response bat.bing.com/	34 KB 10 KB	71ms 41ms	Script application/javascript	204.79.197.200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 204.79.197.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS a-0001.a-msedge.net Software / Resource Hash d891455e32c9a425e36e190047b1f58abeb7e3709eff687134ddea7ac9cfdd3b Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 05:31:39 GMT content-encoding gzip last-modified Wed, 06 Oct 2021 19:11:47 GMT x-msedge-ref Ref A: 4EC0EA73855C453893F6537C7D40FC98 Ref B: PRG01EDGE0807 Ref C: 2021-10-20T05:31:40Z etag "805b72e6bad71:0" vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript access-control-allow-origin * cache-control private,max-age=1800 accept-ranges bytes content-length 10001
GET H2	200	aquant.js Show response secure.quantserve.com/	24 KB 9 KB	24ms 8ms	Script application/javascript	91.228.74.226 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://secure.quantserve.com/aquant.js?a=p-4CduNLZtPCAtp Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.228.74.226 , United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 2d452ca7bf499867307ebfa48373084a42e1f56ec0a26e5bb2e12f01888c3cc9 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 05:31:40 GMT content-encoding gzip etag "XUylRaJiJNdi08iU32oNYQ==" vary Accept-Encoding content-type application/javascript cache-control private, max-age=604800 cross-origin-resource-policy cross-origin accept-ranges bytes expires Wed, 27 Oct 2021 05:31:40 GMT
GET H/1.1	200 OK	6si.min.js Show response j.6sc.co/	27 KB 9 KB	43ms 6ms	Script application/javascript	104.89.35.64 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.89.35.64 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-89-35-64.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 2707e48726a3f7ec48a1d1aec9738f20b36bac1535cfa9de2e4d92310c4e7e7a Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Wed, 20 Oct 2021 05:31:40 GMT Content-Encoding gzip X-Content-Type-Options nosniff Connection keep-alive Vary Accept-Encoding Content-Length 8575 Pragma no-cache Last-Modified Thu, 07 Oct 2021 17:17:43 GMT Server nginx/1.14.0 (Ubuntu) ETag "615f2bb7-6a5f" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type application/javascript Access-Control-Allow-Origin Cache-Control private, no-cache, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 20 Oct 2021 05:31:40 GMT
GET H/1.1	200 OK	lp.js Show response metadata-static-files.sfo2.cdn.digitaloceanspaces.com/pixel/	5 KB 6 KB	42ms 6ms	Script application/x-javascript	205.185.216.42 HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://metadata-static-files.sfo2.cdn.digitaloceanspaces.com/pixel/lp.js Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 205.185.216.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US), Reverse DNS map2.hwcdn.net Software / Resource Hash b4ce07480e7da205dd1a60eaa25d5ce2775dd2f29617dc7c898239366da246c2 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Wed, 20 Oct 2021 05:31:40 GMT Connection Keep-Alive Last-Modified Thu, 09 Sep 2021 12:32:55 GMT x-amz-request-id tx00000000000005c4ea357-00616826c7-1558d748-sfo2a etag "4e0149dff271e7a7afbf4de0d4e20577" Vary Access-Control-Request-Headers,Access-Control-Request-Method,Origin X-HW 1634707900.dop013.fr8.t,1634707900.cds241.fr8.shn,1634707900.cds241.fr8.c Content-Type application/x-javascript Cache-Control max-age=112523 x-rgw-object-type Normal strict-transport-security max-age=15552000; includeSubDomains; preload Accept-Ranges bytes Content-Length 5434
GET H2	200	bizible.js Show response cdn.bizible.com/scripts/	83 KB 32 KB	17ms 9ms	Script application/x-javascript	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/scripts/bizible.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67F3) / Resource Hash de22a1f465480545ea9595d61c16ad21ad40e6b2509cca0e76d2601980e52988 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 05:31:40 GMT content-encoding gzip last-modified Tue, 19 Oct 2021 19:36:25 GMT server ECS (frb/67F3) age 27712 etag "8d28e9a20c5d71:0" vary Accept-Encoding x-cache HIT content-type application/x-javascript cache-control max-age=86400 accept-ranges bytes content-length 32249
GET H2	200	inlinks.js Show response jscloud.net/x/12296/	943 B 998 B	67ms 21ms	Script application/javascript	104.26.5.39 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://jscloud.net/x/12296/inlinks.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.5.39 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 96c5bfab045aceeb52ae2daa17605f436dd4ab9be43bbc87ac3debdbc9768ffb Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 05:31:40 GMT content-encoding br cf-cache-status HIT last-modified Thu, 15 Jul 2021 06:33:19 GMT server cloudflare age 2468 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=u%2F98lyaO4Y1F1dAOglWbpr1EDBoW9JXtOppv4pi62SmNNVqWuIZDfTu%2BDpudwPcv44GouIgxoUJ8sqQ7jMIV8aIEyiktjcEf5EuWP9FEkEhkfTh4JUtTT5cy6W2F"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6a0fdc7aca9f4120-PRG
GET H2	200	216127175396154 Show response connect.facebook.net/signals/config/	490 KB 144 KB	150ms 150ms	Script application/x-javascript	185.60.216.19 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/216127175396154?v=2.9.47&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.60.216.19 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS xx-fbcdn-shv-01-frx5.fbcdn.net Software / Resource Hash 31b3c73b67967ebe398c0303931b84d2dc06b77ca231fdf549c1f08c5c809a91 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 x-xss-protection 0 pragma public x-fb-debug oJF3/3BaOn0hemPEnz29OvlfEIg3c2q6dpvKtTQesRPSAEtEAxp0AMpzrzxL2cnJKH3n5gS8XekcfNiFnymxtw== x-fb-trip-id 917726464 x-frame-options DENY cross-origin-opener-policy same-origin-allow-popups cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" date Wed, 20 Oct 2021 05:31:40 GMT strict-transport-security max-age=31536000; preload; includeSubDomains report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-fb-rlafr 0 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	rules-p-4CduNLZtPCAtp.js Show response rules.quantcount.com/	2 KB 1 KB	23ms 7ms	Script application/javascript	143.204.98.62 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://rules.quantcount.com/rules-p-4CduNLZtPCAtp.js Requested by Host: secure.quantserve.com URL: https://secure.quantserve.com/aquant.js?a=p-4CduNLZtPCAtp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.62 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-62.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash 1d48d4cabc9c195baa08e42be70679688d706970ddd862bd91b857109d2a8874 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 04:47:26 GMT content-encoding gzip age 3445 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin access-control-allow-origin * last-modified Wed, 03 Feb 2021 00:36:24 GMT server AmazonS3 etag W/"7d60bb0c5a7bdaca5a9466f9ef246056" vary Accept-Encoding access-control-allow-methods GET content-type application/javascript via 1.1 6ea9fcffa719a56ee2be748a73d37974.cloudfront.net (CloudFront) cache-control max-age=3600 x-amz-cf-pop FRA50-C1 x-amz-cf-id nUbT8k1BSPy8rNfgQmCscAwDbTmqHnnsf7gf_-vuGnR7WhXESntjoA==
GET H3	200	js Show response www.google-analytics.com/gtm/	89 KB 35 KB	33ms 19ms	Script application/javascript	142.250.186.174 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/gtm/js?id=GTM-WV3KTWL&t=gtm4&cid=1747793963.1634707901 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.174 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f14.1e100.net Software Google Tag Manager / Resource Hash 31ed21aabf19a2ee8204e31d91cab8ff288e54c55dfd4d97d3cd240695c8eb43 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 05:31:40 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35723 x-xss-protection 0 last-modified Wed, 20 Oct 2021 03:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 20 Oct 2021 05:31:40 GMT
GET H2	200	collect px.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1634707900583&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7540%26time%3D1634707900583%26url%3Dhttps%253A%252F%252Fduo.com%252Fdecipher%252F... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1634707900583&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&liSync=true	0 80 B	140ms 139ms	Image application/javascript	108.174.11.85 LINKEDIN
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1634707900583&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&liSync=true Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.174.11.85 , United States, ASN14413 (LINKEDIN, US), Reverse DNS 108-174-11-85.fwd.linkedin.com Software Play / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 05:31:41 GMT server Play linkedin-action 1 x-li-fabric prod-ltx1 x-li-proto http/2 x-li-pop prod-edc2 content-type application/javascript content-length 0 x-li-uuid Oyxb0yymrxawoEyOyyoAAA== Redirect headers strict-transport-security max-age=31536000 x-content-type-options nosniff linkedin-action 1 x-cache CONFIG_NOCACHE content-length 0 x-li-uuid AAXOwhfAcuVrxKsdscZsxA== pragma no-cache x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 8E5D391049AB4C99AA6CFF99D61C39B9 Ref B: PRG01EDGE1108 Ref C: 2021-10-20T05:31:40Z date Wed, 20 Oct 2021 05:31:40 GMT expect-ct max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct" x-frame-options sameorigin x-li-fabric prod-ltx1 location https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1634707900583&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&liSync=true cache-control no-cache, no-store content-security-policy default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self' x-li-proto http/2 expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	200	xdframe-single-domain-1.1.0.html Show response csxd.contentsquare.net/uxa/ Frame 45FB	2 KB 1 KB	87ms 7ms	Document text/html	18.66.122.117 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://csxd.contentsquare.net/uxa/xdframe-single-domain-1.1.0.html?pid=5637&cookieNames=_cs_id,_cs_s,_cs_cvars,_cs_ex Requested by Host: t.contentsquare.net URL: https://t.contentsquare.net/uxa/ebdaa317731b0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.122.117 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash bf7635163c0991525863f3b5eb809ab7770fcdd92de0e916c162b8f1fbb71b1a Request headers :method GET :authority csxd.contentsquare.net :scheme https :path /uxa/xdframe-single-domain-1.1.0.html?pid=5637&cookieNames=_cs_id,_cs_s,_cs_cvars,_cs_ex pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Response headers content-type text/html date Fri, 05 Feb 2021 02:16:12 GMT last-modified Wed, 29 Apr 2020 11:07:34 GMT etag W/"895e1defcb016da8da1092f66778b99a" x-amz-server-side-encryption AES256 cache-control max-age=31536000 server AmazonS3 content-encoding gzip vary Accept-Encoding x-cache Hit from cloudfront via 1.1 3072267d18c4d0ed9e535752800364e0.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P2 x-amz-cf-id ELBEuZOE6YeaFKADHkK_Rpk19EyEKyugKMtRDA71xEdGcKBwW-NCWA== age 22216529
GET BLOB	200 OK	097cfd4f-5553-4d00-9caf-09705a61303c https://duo.com/	6 KB 0		Other application/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://duo.com/097cfd4f-5553-4d00-9caf-09705a61303c Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 277e94c418c4d17c94d4c0b3be5133ee32b955c909eebfec9b9d014c52dd4f7b Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Length 6435 Content-Type application/javascript
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/161/	11 KB 5 KB	7ms 7ms	Script application/x-javascript	104.111.234.67 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/161/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/munchkin-beta.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.234.67 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-234-67.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Wed, 20 Oct 2021 05:31:40 GMT Content-Encoding gzip Last-Modified Wed, 08 Sep 2021 00:38:21 GMT Server AkamaiNetStorage ETag "0e0eefac8daf874e8b1aa34aeb160c52:1631061501.737429" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Cache-Control max-age=8640000 Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 4681 Expires Fri, 28 Jan 2022 05:31:40 GMT
GET H2	200	pixel;r=555710553;labels=_fp.event.Default;rf=0;a=p-4CduNLZtPCAtp;url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks;uht=2;fpan=1;fpa=P0-761926959-163470790... pixel.quantserve.com/	35 B 372 B	12ms 11ms	Image image/gif	91.228.74.226 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://pixel.quantserve.com/pixel;r=555710553;labels=_fp.event.Default;rf=0;a=p-4CduNLZtPCAtp;url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks;uht=2;fpan=1;fpa=P0-761926959-1634707900642;pbc=;ns=0;ce=1;qjs=1;qv=00a3769c-20210929173447;cm=;gdpr=0;ref=;d=duo.com;je=0;sr=1600x1200x24;dst=0;et=1634707900642;tzo=0;ogl=site_name.Decipher%2Ctype.website%2Curl.https%3A%2F%2Fduo%252Ecom%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks%2Ctitle.Telecom%20Firms%20Compromised%20in%20LightBasin%20Cyberattacks%2Cdescription.A%20well-known%20attack%20group%20has%20compromised%20at%20least%2013%20telecommunications%20organiz%2Cimage.https%3A%2F%2Fduo%252Ecom%2Fassets%2Fimg%2Fseo-images%2Fglobal-network-decipher%252Ejpg%2Cimage%3Awidth.1200%2Cimage%3Aheight.630 Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.228.74.226 , United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8 Security Headers Name Value Strict-Transport-Security max-age=86400 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 20 Oct 2021 05:31:40 GMT strict-transport-security max-age=86400 p3p CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV" cache-control private, no-cache, no-store, proxy-revalidate content-type image/gif content-length 35 expires Fri, 04 Aug 1978 12:00:00 GMT
GET H2	204	4006052.js Show response bat.bing.com/p/action/	0 110 B	43ms 43ms	Script text/plain	204.79.197.200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/4006052.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 204.79.197.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS a-0001.a-msedge.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers access-control-allow-origin * date Wed, 20 Oct 2021 05:31:39 GMT cache-control private,max-age=86400 x-msedge-ref Ref A: 57E6E4801F56444AAB0E3461D648399E Ref B: PRG01EDGE0807 Ref C: 2021-10-20T05:31:40Z x-cache CONFIG_NOCACHE
GET H2	200	httpsduocomdeciphertelecomfirmscompromisedinlightbasincyberattacks.json Show response jscloud.net/x/13009/	26 B 546 B	361ms 325ms	XHR application/json	104.26.5.39 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://jscloud.net/x/13009/httpsduocomdeciphertelecomfirmscompromisedinlightbasincyberattacks.json Requested by Host: jscloud.net URL: https://jscloud.net/x/12296/inlinks.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.5.39 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0a998ab5472475c3418c7977b6214c566aad928094dceb86d2e9f53bdbdd26c0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 05:31:41 GMT cf-cache-status DYNAMIC last-modified Thu, 16 Jan 2020 10:42:21 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y8OX%2FqCQHMY3fIa%2BR2vnL7TCEyOBhKm0rKMilCbrKDN3NQ%2BtBG9jTLNmEGpajLguL%2Fglv7yKYQ1u37PJOu7Q2vIIb9CrEs3OyngNRBfwRYdsOPX7jrry9%2Bc7lflU"}],"group":"cf-nel","max_age":604800} content-type application/json access-control-allow-origin * nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} accept-ranges bytes cf-ray 6a0fdc7b5cdaf9de-PRG content-length 26
POST H3	200	collect Show response www.google-analytics.com/j/	2 B 22 B	15ms 14ms	XHR text/plain	142.250.186.174 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j93&a=330059425&t=pageview&_s=1&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&ul=en-us&de=UTF-8&dt=Telecom%20Firms%20Compromised%20in%20LightBasin%20Cyberattacks%20%7C%20Decipher&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAAAADQAAAAC~&jid=1692418536&gjid=1133430683&cid=1747793963.1634707901&tid=UA-20141016-1&_gid=723177448.1634707901&_r=1&gtm=2wgai0MFPB9D&z=750420001 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.174 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f14.1e100.net Software Golfe2 / Resource Hash de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 20 Oct 2021 05:31:40 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://duo.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	2 B 455 B	42ms 14ms	XHR text/plain	64.233.166.154 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j93&tid=UA-20141016-1&cid=1747793963.1634707901&jid=856833850&gjid=1078456523&_gid=723177448.1634707901&_u=aGDAgAADQAAAAG~&z=754241983 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 64.233.166.154 , United States, ASN15169 (GOOGLE, US), Reverse DNS wm-in-f154.1e100.net Software Golfe2 / Resource Hash 6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Wed, 20 Oct 2021 05:31:40 GMT content-type text/plain access-control-allow-origin https://duo.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	collect www.google-analytics.com/	35 B 55 B	6ms 6ms	Image image/gif	142.250.186.174 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j93&a=330059425&t=pageview&_s=1&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&ul=en-us&de=UTF-8&dt=Telecom%20Firms%20Compromised%20in%20LightBasin%20Cyberattacks%20%7C%20Decipher&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAgAADQAAAAC~&jid=856833850&gjid=1078456523&cid=1747793963.1634707901&tid=UA-20141016-1&_gid=723177448.1634707901&gtm=2wgai0MFPB9D&cg3=Decipher%20Traffic%20Only&z=26492395 Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.174 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f14.1e100.net Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Tue, 19 Oct 2021 14:24:45 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 54415 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
POST H/1.1	200 OK	visitWebPage 074-uqx-410.mktoresp.com/webevents/	2 B 311 B	839ms 160ms	Ping text/plain	192.28.147.68 OMNITURE
General Check archive.org Show headers Download Go to Full URL https://074-uqx-410.mktoresp.com/webevents/visitWebPage?_mchNc=1634707900669&_mchCn=&_mchId=074-UQX-410&_mchTk=_mch-duo.com-1634707900668-36963&_mchHo=duo.com&_mchPo=&_mchRu=%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&_mchPc=https%3A&_mchVr=161&_mchEcid=&_mchHa=&_mchRe=&_mchQp= Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/161/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.28.147.68 , United States, ASN15224 (OMNITURE, US), Reverse DNS Software nginx / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Date Wed, 20 Oct 2021 05:31:41 GMT Content-Encoding gzip Server nginx Transfer-Encoding chunked Content-Type text/plain; charset=UTF-8 Access-Control-Allow-Origin * Connection keep-alive X-Request-Id b47351c3-5e5f-41ed-998e-2d68feeb6870
GET H2	200	utag.js Show response tags.tiqcdn.com/utag/cisco/duo/prod/	206 KB 56 KB	62ms 37ms	Script application/x-javascript	104.75.88.194 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js Requested by Host: www.cisco.com URL: https://www.cisco.com/c/dam/cdc/t/ctm.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.75.88.194 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-75-88-194.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 2d2e57540ff71f6d05829900966e48105573fc813446fe83c499cb5c0e4b576c Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 05:31:40 GMT content-encoding gzip last-modified Thu, 14 Oct 2021 17:08:17 GMT server AkamaiNetStorage etag "794513f113b73df6cf0d7c6aa6ee25d8:1634231297.769017" vary Accept-Encoding content-type application/x-javascript cache-control max-age=300 accept-ranges bytes expires Wed, 20 Oct 2021 05:36:40 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	2 B 68 B	17ms 14ms	XHR text/plain	64.233.166.154 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j93&tid=UA-20141016-1&cid=1747793963.1634707901&jid=1692418536&gjid=1133430683&_gid=723177448.1634707901&_u=aGDAAAACQAAAAC~&z=962911804 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 64.233.166.154 , United States, ASN15169 (GOOGLE, US), Reverse DNS wm-in-f154.1e100.net Software Golfe2 / Resource Hash 6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Wed, 20 Oct 2021 05:31:40 GMT content-type text/plain access-control-allow-origin https://duo.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.com/ads/	42 B 522 B	46ms 18ms	Image image/gif	142.250.185.164 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-20141016-1&cid=1747793963.1634707901&jid=856833850&_u=aGDAgAADQAAAAG~&z=601202335 Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.164 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s51-in-f4.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 20 Oct 2021 05:31:40 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.com/ads/	42 B 107 B	47ms 20ms	Image image/gif	142.250.185.164 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-20141016-1&cid=1747793963.1634707901&jid=1692418536&_u=aGDAAAACQAAAAC~&z=378069209 Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.164 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s51-in-f4.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 20 Oct 2021 05:31:40 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	204	pageview c.contentsquare.net/	0 320 B	96ms 28ms	Image text/plain	52.208.183.15 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://c.contentsquare.net/pageview?pid=5637&uu=82928de6-7d5e-a4ec-e25b-faced8c5a3f6&sn=1&lv=1634707900&lhd=1634707900&hd=1634707900&pn=1&dw=1600&dh=5755&ww=1600&wh=1200&sw=1600&sh=1200&dr=&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&uc=1&la=en-US&v=11.4.3&r=580456 Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.208.183.15 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-208-183-15.eu-west-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 20 Oct 2021 05:31:40 GMT access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin * cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 content-disposition inline timing-allow-origin * access-control-allow-headers Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With expires Sun, 24 Oct 1982 23:00:00 GMT
GET H3	200	120108061684670 Show response connect.facebook.net/signals/config/	490 KB 143 KB	145ms 144ms	Script application/x-javascript	185.60.216.19 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/120108061684670?v=2.9.47&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 185.60.216.19 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS xx-fbcdn-shv-01-frx5.fbcdn.net Software / Resource Hash 3b52d24dea81e1cb94f23369d0ce79aa423595c9e5ae7a3b66bc0bc6aeb3d58a Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 x-xss-protection 0 pragma public x-fb-debug /8uy7qVixvQN+PuORAWxwX/r5tWAxXscciXA8+1tUVr40+r98XJCNgDlHwrw8ZqrUSs9UcJ7Kf2cFEm4WMOucQ== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Wed, 20 Oct 2021 05:31:40 GMT strict-transport-security max-age=31536000; preload; includeSubDomains report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-fb-rlafr 0 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	44 B 313 B	21ms 6ms	Image image/gif	185.60.216.35 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=216127175396154&ev=PageView&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&rl=&if=false&ts=1634707900756&sw=1600&sh=1200&v=2.9.47&r=stable&ec=0&o=30&fbp=fb.1.1634707900755.1977959718&it=1634707900556&coo=false&rqm=GET Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.60.216.35 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS edge-star-mini-shv-01-frx5.facebook.com Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 05:31:40 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 44 expires Wed, 20 Oct 2021 05:31:40 GMT
GET H2	200	din1451alt_g-webfont.woff2 duo.com/site/themes/duo/fonts/din1451alt/	22 KB 23 KB	168ms 168ms	Font application/octet-stream	143.204.98.6 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://duo.com/site/themes/duo/fonts/din1451alt/din1451alt_g-webfont.woff2 Requested by Host: duo.com URL: https://duo.com/site/themes/duo/css/production-2018.css?v=1634238315 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.6 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-6.fra50.r.cloudfront.net Software Duo/1.0 / Resource Hash ede067783c02098828dfe0bda385a9913ff79006eb2cd1a406bcc18e66cd7bad Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-fetch-mode cors origin https://duo.com accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 sec-fetch-dest font cookie _gcl_au=1.1.626796007.1634707901; _ga=GA1.2.1747793963.1634707901; _gid=GA1.2.723177448.1634707901; _biz_uid=f2dafd389e6940b9c1cad0f72200b27b; _biz_sid=1a7033; _biz_nA=1; _biz_pendingA=%5B%22m%2Fipv%3F_biz_r%3D%26_biz_h%3D-1906410348%26_biz_u%3Df2dafd389e6940b9c1cad0f72200b27b%26_biz_s%3D1a7033%26_biz_l%3Dhttps%253A%252F%252Fduo.com%252Fdecipher%252Ftelecom-firms-compromised-in-lightbasin-cyberattacks%26_biz_t%3D1634707900637%26_biz_i%3DTelecom%2520Firms%2520Compromised%2520in%2520LightBasin%2520Cyberattacks%2520%257C%2520Decipher%26_biz_n%3D0%26a%3Dduo.com%26rnd%3D216210%22%5D; _gat_UA-20141016-1=1; _dc_gtm_UA-20141016-1=1; _mkto_trk=id:074-UQX-410&token:_mch-duo.com-1634707900668-36963; __qca=P0-761926959-1634707900642; _cs_c=1; _cs_id=82928de6-7d5e-a4ec-e25b-faced8c5a3f6.1634707900.1.1634707900.1634707900.1627413105.1668871900732; _cs_s=1.0.0.1634709700733; _fbp=fb.1.1634707900755.1977959718 :path /site/themes/duo/fonts/din1451alt/din1451alt_g-webfont.woff2 pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept */* cache-control no-cache :authority duo.com referer https://duo.com/site/themes/duo/css/production-2018.css?v=1634238315 :scheme https sec-fetch-site same-origin :method GET Referer https://duo.com/site/themes/duo/css/production-2018.css?v=1634238315 Origin https://duo.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers strict-transport-security max-age=63072000; includeSubDomains; via 1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront) x-content-type-options nosniff x-amz-cf-pop FRA50-C1 x-cache RefreshHit from cloudfront date Wed, 20 Oct 2021 05:31:40 GMT content-length 22668 x-xss-protection 1; mode=block x-ua-compatible IE=Edge,chrome=1 referrer-policy no-referrer-when-downgrade last-modified Wed, 24 Oct 2018 13:45:04 GMT server Duo/1.0 etag "5bd07760-588c" x-frame-options SAMEORIGIN content-type application/octet-stream cache-control max-age=300 accept-ranges bytes x-amz-cf-id vZrt538RqkHDpPjDuDRgZPjF8wX2w1o7YXbXVsuQbeWi5mw1j4erfQ== expires Wed, 20 Oct 2021 05:36:40 GMT
GET H2	200	din1451alt-webfont.woff2 duo.com/site/themes/duo/fonts/din1451alt/	17 KB 18 KB	169ms 169ms	Font application/octet-stream	143.204.98.6 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://duo.com/site/themes/duo/fonts/din1451alt/din1451alt-webfont.woff2 Requested by Host: duo.com URL: https://duo.com/site/themes/duo/css/production-2018.css?v=1634238315 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.6 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-6.fra50.r.cloudfront.net Software Duo/1.0 / Resource Hash e9f76eabead93f85fc4dc190dca4b1419dcd76b57b1c22649856b01d3ac2536e Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-fetch-mode cors origin https://duo.com accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 sec-fetch-dest font cookie _gcl_au=1.1.626796007.1634707901; _ga=GA1.2.1747793963.1634707901; _gid=GA1.2.723177448.1634707901; _biz_uid=f2dafd389e6940b9c1cad0f72200b27b; _biz_sid=1a7033; _biz_nA=1; _biz_pendingA=%5B%22m%2Fipv%3F_biz_r%3D%26_biz_h%3D-1906410348%26_biz_u%3Df2dafd389e6940b9c1cad0f72200b27b%26_biz_s%3D1a7033%26_biz_l%3Dhttps%253A%252F%252Fduo.com%252Fdecipher%252Ftelecom-firms-compromised-in-lightbasin-cyberattacks%26_biz_t%3D1634707900637%26_biz_i%3DTelecom%2520Firms%2520Compromised%2520in%2520LightBasin%2520Cyberattacks%2520%257C%2520Decipher%26_biz_n%3D0%26a%3Dduo.com%26rnd%3D216210%22%5D; _gat_UA-20141016-1=1; _dc_gtm_UA-20141016-1=1; _mkto_trk=id:074-UQX-410&token:_mch-duo.com-1634707900668-36963; __qca=P0-761926959-1634707900642; _cs_c=1; _cs_id=82928de6-7d5e-a4ec-e25b-faced8c5a3f6.1634707900.1.1634707900.1634707900.1627413105.1668871900732; _cs_s=1.0.0.1634709700733; _fbp=fb.1.1634707900755.1977959718 :path /site/themes/duo/fonts/din1451alt/din1451alt-webfont.woff2 pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept */* cache-control no-cache :authority duo.com referer https://duo.com/site/themes/duo/css/production-2018.css?v=1634238315 :scheme https sec-fetch-site same-origin :method GET Referer https://duo.com/site/themes/duo/css/production-2018.css?v=1634238315 Origin https://duo.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers strict-transport-security max-age=63072000; includeSubDomains; via 1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront) x-content-type-options nosniff x-amz-cf-pop FRA50-C1 x-cache RefreshHit from cloudfront date Wed, 20 Oct 2021 05:31:40 GMT content-length 17424 x-xss-protection 1; mode=block x-ua-compatible IE=Edge,chrome=1 referrer-policy no-referrer-when-downgrade last-modified Wed, 24 Oct 2018 13:45:04 GMT server Duo/1.0 etag "5bd07760-4410" x-frame-options SAMEORIGIN content-type application/octet-stream cache-control max-age=300 accept-ranges bytes x-amz-cf-id IbDlSDWhyNyFyP4V4yUVEYcYrSuQWBIqW__TFeB20W7Fr0J_IK8lgw== expires Wed, 20 Oct 2021 05:36:40 GMT
GET H/1.1	200 OK	rd Show response dpm.demdex.net/id/ Redirect Chain https://dpm.demdex.net/id?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1634707900836 https://dpm.demdex.net/id/rd?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1634707900836	775 B 1 KB	33ms 32ms	XHR application/json	18.200.208.216 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dpm.demdex.net/id/rd?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1634707900836 Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.200.208.216 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-200-208-216.eu-west-1.compute.amazonaws.com Software / Resource Hash 218e5071797313848c9bba684f28efd3393134063fc5d3ce437fd28d6ace05ad Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers DCS dcs-prod-irl1-2-v019-06bdc6eea.edge-irl1.demdex.com UNKNOWN Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains content-encoding gzip X-TID +6IRGliNTDM= Vary Origin P3P policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin https://duo.com Cache-Control no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json;charset=utf-8 Content-Length 486 Expires Thu, 01 Jan 1970 00:00:00 UTC Redirect headers DCS dcs-prod-irl1-2-v019-0440bd2ad.edge-irl1.demdex.com UNKNOWN Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains Access-Control-Allow-Origin https://duo.com X-TID pkJnz9z3Tqs= Vary Origin P3P policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Location https://dpm.demdex.net/id/rd?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1634707900836 Cache-Control no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Access-Control-Allow-Credentials true Connection keep-alive Content-Length 0 Expires Thu, 01 Jan 1970 00:00:00 UTC
GET H2	200	d-shape--blockquote.svg duo.com/assets/img/decipher/svg/	239 B 668 B	166ms 165ms	Image image/svg+xml	143.204.98.6 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://duo.com/assets/img/decipher/svg/d-shape--blockquote.svg Requested by Host: duo.com URL: https://duo.com/site/themes/duo/css/production-2018.css?v=1634238315 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.6 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-6.fra50.r.cloudfront.net Software Duo/1.0 / Resource Hash e2b5ac6297e5e12b9122d79ee4d3da217fd76f6631d2dc0c764442a7d05464b2 Request headers :path /assets/img/decipher/svg/d-shape--blockquote.svg pragma no-cache cookie _gcl_au=1.1.626796007.1634707901; _ga=GA1.2.1747793963.1634707901; _gid=GA1.2.723177448.1634707901; _biz_uid=f2dafd389e6940b9c1cad0f72200b27b; _biz_sid=1a7033; _biz_nA=1; _biz_pendingA=%5B%22m%2Fipv%3F_biz_r%3D%26_biz_h%3D-1906410348%26_biz_u%3Df2dafd389e6940b9c1cad0f72200b27b%26_biz_s%3D1a7033%26_biz_l%3Dhttps%253A%252F%252Fduo.com%252Fdecipher%252Ftelecom-firms-compromised-in-lightbasin-cyberattacks%26_biz_t%3D1634707900637%26_biz_i%3DTelecom%2520Firms%2520Compromised%2520in%2520LightBasin%2520Cyberattacks%2520%257C%2520Decipher%26_biz_n%3D0%26a%3Dduo.com%26rnd%3D216210%22%5D; _gat_UA-20141016-1=1; _dc_gtm_UA-20141016-1=1; _mkto_trk=id:074-UQX-410&token:_mch-duo.com-1634707900668-36963; __qca=P0-761926959-1634707900642; _cs_c=1; _cs_id=82928de6-7d5e-a4ec-e25b-faced8c5a3f6.1634707900.1.1634707900.1634707900.1627413105.1668871900732; _cs_s=1.0.0.1634709700733; _fbp=fb.1.1634707900755.1977959718; utag_main=v_id:017c9c2f0993001986dddc474a3003072004d06a00b08$_sn:1$_se:1$_ss:1$_st:1634709700820$ses_id:1634707900820%3Bexp-session$_pn:1%3Bexp-session$vapi_domain:duo.com; AMCV_B8D07FF4520E94C10A490D4C%40AdobeOrg=281789898%7CMCIDTS%7C18921%7CvVersion%7C4.1.0 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority duo.com referer https://duo.com/site/themes/duo/css/production-2018.css?v=1634238315 :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://duo.com/site/themes/duo/css/production-2018.css?v=1634238315 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma public date Wed, 20 Oct 2021 05:31:40 GMT via 1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront) last-modified Wed, 24 Oct 2018 13:44:56 GMT server Duo/1.0 x-amz-cf-pop FRA50-C1 etag "5bd07758-ef" x-cache Miss from cloudfront content-type image/svg+xml cache-control max-age=31536000 public, must-revalidate, proxy-revalidate, max-age=31536000 accept-ranges bytes content-length 239 x-amz-cf-id sJlSrggoXxk8KK-_6ajgc-RMxF4fb9N9JXEewjgZQx9LExIfQMnFYw== expires Thu, 20 Oct 2022 05:31:40 GMT
GET H2	200	diamond.svg duo.com/assets/img/decipher/svg/	187 B 622 B	14ms 13ms	Image image/svg+xml	143.204.98.6 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://duo.com/assets/img/decipher/svg/diamond.svg Requested by Host: duo.com URL: https://duo.com/site/themes/duo/css/production-2018.css?v=1634238315 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.6 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-6.fra50.r.cloudfront.net Software Duo/1.0 / Resource Hash 45f9c9efb71fae4c333607520017c544fb9dc13100dd260f6148eb179b919d68 Request headers :path /assets/img/decipher/svg/diamond.svg pragma no-cache cookie _gcl_au=1.1.626796007.1634707901; _ga=GA1.2.1747793963.1634707901; _gid=GA1.2.723177448.1634707901; _biz_uid=f2dafd389e6940b9c1cad0f72200b27b; _biz_sid=1a7033; _biz_nA=1; _biz_pendingA=%5B%22m%2Fipv%3F_biz_r%3D%26_biz_h%3D-1906410348%26_biz_u%3Df2dafd389e6940b9c1cad0f72200b27b%26_biz_s%3D1a7033%26_biz_l%3Dhttps%253A%252F%252Fduo.com%252Fdecipher%252Ftelecom-firms-compromised-in-lightbasin-cyberattacks%26_biz_t%3D1634707900637%26_biz_i%3DTelecom%2520Firms%2520Compromised%2520in%2520LightBasin%2520Cyberattacks%2520%257C%2520Decipher%26_biz_n%3D0%26a%3Dduo.com%26rnd%3D216210%22%5D; _gat_UA-20141016-1=1; _dc_gtm_UA-20141016-1=1; _mkto_trk=id:074-UQX-410&token:_mch-duo.com-1634707900668-36963; __qca=P0-761926959-1634707900642; _cs_c=1; _cs_id=82928de6-7d5e-a4ec-e25b-faced8c5a3f6.1634707900.1.1634707900.1634707900.1627413105.1668871900732; _cs_s=1.0.0.1634709700733; _fbp=fb.1.1634707900755.1977959718; utag_main=v_id:017c9c2f0993001986dddc474a3003072004d06a00b08$_sn:1$_se:1$_ss:1$_st:1634709700820$ses_id:1634707900820%3Bexp-session$_pn:1%3Bexp-session$vapi_domain:duo.com; AMCV_B8D07FF4520E94C10A490D4C%40AdobeOrg=281789898%7CMCIDTS%7C18921%7CvVersion%7C4.1.0 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority duo.com referer https://duo.com/site/themes/duo/css/production-2018.css?v=1634238315 :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://duo.com/site/themes/duo/css/production-2018.css?v=1634238315 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma public date Tue, 19 Oct 2021 10:43:54 GMT via 1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront) last-modified Wed, 24 Oct 2018 13:44:56 GMT server Duo/1.0 age 67666 etag "5bd07758-bb" x-cache Hit from cloudfront content-type image/svg+xml cache-control max-age=31536000 public, must-revalidate, proxy-revalidate, max-age=31536000 x-amz-cf-pop FRA50-C1 accept-ranges bytes content-length 187 x-amz-cf-id c5H8VQQWxoc8AaKv0geRabltoUxt_8T2WH33JdzCq_S12DNKgnnE7w== expires Wed, 19 Oct 2022 10:43:54 GMT
GET H3	200	/ www.facebook.com/tr/	44 B 91 B	16ms 8ms	Image image/gif	185.60.216.35 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=120108061684670&ev=PageView&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&rl=&if=false&ts=1634707900924&sw=1600&sh=1200&v=2.9.47&r=stable&ec=0&o=30&fbp=fb.1.1634707900755.1977959718&it=1634707900556&coo=false&rqm=GET Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H3 Security QUIC, , AES_128_GCM Server 185.60.216.35 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS edge-star-mini-shv-01-frx5.facebook.com Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 05:31:40 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin content-length 44 alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 priority u=3,i expires Wed, 20 Oct 2021 05:31:40 GMT
GET H/1.1	200 OK	dest5.html Show response cisco.demdex.net/ Frame C21B	7 KB 3 KB	132ms 31ms	Document text/html	52.17.185.148 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cisco.demdex.net/dest5.html?d_nsid=0 Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.17.185.148 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-17-185-148.eu-west-1.compute.amazonaws.com Software / Resource Hash 7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Host cisco.demdex.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest iframe Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Accept-Encoding gzip, deflate, br Cookie demdex=69690529717273397813434371469940818071 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Response headers Accept-Ranges bytes Cache-Control no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private content-encoding gzip Content-Type text/html;charset=UTF-8 date Wed, 20 Oct 2021 05:31:41 GMT DCS dcs-prod-irl1-1-v019-03035d387.edge-irl1.demdex.com UNKNOWN Expires Thu, 01 Jan 1970 00:00:00 UTC last-modified Thu, 14 Oct 2021 10:46:54 GMT P3P policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains vary accept-encoding X-TID ZX+LF8zISkI= Content-Length 2791 Connection keep-alive
GET H2	200	id Show response smetrics.cisco.com/	48 B 501 B	68ms 17ms	XHR application/x-javascript	15.236.176.210 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://smetrics.cisco.com/id?d_visid_ver=4.1.0&d_fieldgroup=A&mcorgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&mid=75814106805939959082749674889644808470&ts=1634707900999 Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 15.236.176.210 Paris, France, ASN16509 (AMAZON-02, US), Reverse DNS ec2-15-236-176-210.eu-west-3.compute.amazonaws.com Software jag / Resource Hash 8012bdcf29bf0a2240ae789079226b00d33882c995338e44f803086845836505 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers date Wed, 20 Oct 2021 05:31:41 GMT x-content-type-options nosniff server jag xserver anedge-b4c7fdd79-ph7xg vary Origin x-c main-1540.I13d07b.M0-522 p3p CP="This is not a P3P policy" access-control-allow-origin https://duo.com cache-control no-cache, no-store, max-age=0, no-transform, private access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains content-type application/x-javascript;charset=utf-8 content-length 48 x-xss-protection 1; mode=block
GET H2	200	icon-sprite.20210716.svg Show response duo.com/site/themes/duo/fonts/	243 KB 81 KB	13ms 13ms	XHR image/svg+xml	143.204.98.6 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://duo.com/site/themes/duo/fonts/icon-sprite.20210716.svg Requested by Host: duo.com URL: https://duo.com/site/themes/duo/js/build/production-2018.min.js?v=1634238315 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.6 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-6.fra50.r.cloudfront.net Software Duo/1.0 / Resource Hash 52bebb3587e40b87de4c9b43417ff90a3dff499b24ce969f09a06990990f3921 Request headers :path /site/themes/duo/fonts/icon-sprite.20210716.svg pragma no-cache cookie _gcl_au=1.1.626796007.1634707901; _ga=GA1.2.1747793963.1634707901; _gid=GA1.2.723177448.1634707901; _biz_uid=f2dafd389e6940b9c1cad0f72200b27b; _biz_sid=1a7033; _biz_nA=1; _biz_pendingA=%5B%22m%2Fipv%3F_biz_r%3D%26_biz_h%3D-1906410348%26_biz_u%3Df2dafd389e6940b9c1cad0f72200b27b%26_biz_s%3D1a7033%26_biz_l%3Dhttps%253A%252F%252Fduo.com%252Fdecipher%252Ftelecom-firms-compromised-in-lightbasin-cyberattacks%26_biz_t%3D1634707900637%26_biz_i%3DTelecom%2520Firms%2520Compromised%2520in%2520LightBasin%2520Cyberattacks%2520%257C%2520Decipher%26_biz_n%3D0%26a%3Dduo.com%26rnd%3D216210%22%5D; _gat_UA-20141016-1=1; _dc_gtm_UA-20141016-1=1; _mkto_trk=id:074-UQX-410&token:_mch-duo.com-1634707900668-36963; __qca=P0-761926959-1634707900642; _cs_c=1; _cs_id=82928de6-7d5e-a4ec-e25b-faced8c5a3f6.1634707900.1.1634707900.1634707900.1627413105.1668871900732; _cs_s=1.0.0.1634709700733; _fbp=fb.1.1634707900755.1977959718; utag_main=v_id:017c9c2f0993001986dddc474a3003072004d06a00b08$_sn:1$_se:1$_ss:1$_st:1634709700820$ses_id:1634707900820%3Bexp-session$_pn:1%3Bexp-session$vapi_domain:duo.com; AMCVS_B8D07FF4520E94C10A490D4C%40AdobeOrg=1; AMCV_B8D07FF4520E94C10A490D4C%40AdobeOrg=281789898%7CMCIDTS%7C18921%7CMCMID%7C75814106805939959082749674889644808470%7CMCAAMLH-1635312700%7C6%7CMCAAMB-1635312700%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1634715101s%7CNONE%7CvVersion%7C4.1.0 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode cors accept */* cache-control no-cache sec-fetch-dest empty :authority duo.com referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma public date Wed, 01 Sep 2021 05:58:33 GMT content-encoding gzip last-modified Fri, 16 Jul 2021 21:25:09 GMT server Duo/1.0 age 4231988 etag W/"60f1f935-3caee" vary Accept-Encoding x-cache Hit from cloudfront content-type image/svg+xml via 1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront) cache-control max-age=31536000 public, must-revalidate, proxy-revalidate, max-age=31536000 x-amz-cf-pop FRA50-C1 x-amz-cf-id LSE3uZX9u8euL5xKEK1TwwcCdysOan90-j7xR8ALlKLvhIEiys1EsA== expires Thu, 01 Sep 2022 05:58:33 GMT
GET H2	200	ctm.js Show response www.cisco.com/c/dam/cdc/t/	128 KB 30 KB	10ms 10ms	Script application/x-javascript	95.100.76.145 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.cisco.com/c/dam/cdc/t/ctm.js Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.3, , CHACHA20_POLY1305 Server 95.100.76.145 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a95-100-76-145.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 1921bee4b409248cf69d59cf72dd4336385e643b12bebeff2e20c1dee738467b Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; frame-ancestors *.cisco.com *.jasper.com *.ciscospark.com *.ciscolive.com http://cisco.lookbookhq.com https://cisco.lookbookhq.com testcisco.marketing.adobe.com cisco.marketing.adobe.com ciscosales.my.salesforce.com test.salesforce.com zedo.com hindustantimes.com economictimes.indiatimes.com *.webex.com *.cdw.com *.cdwg.com *.cdw.ca *.meraki-go.com http://ciscopartners.lookbookhq.com https://ciscopartners.lookbookhq.com ciscolearningsystem.com ciscocustomer.lookbookhq.com cisco.lookbookhq.com ccsmedia.com *.itquotes.ie dteonline.com ampito-cisco.com arkphire.com *.insight.com *.ccsmedia.com *.ebuyer.com *.lambda-tek.com *.storm-technologies.com *.vohkus.com *.bechtle.com *.rainfocus.com *.broadbandbuyer.com *.hardware.com shop.redpontem.com; Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 05:31:41 GMT content-encoding gzip x-content-type-options nosniff vary Accept-Encoding content-length 29885 x-xss-protection 1; mode=block pragma no-cache cdchost wemxweb-publish-prod2-01 x-test-debug nURL=www.cisco.com,realm=0,isRealm=0,realmDomain=0,shortrealm=0,upgradeTest=1 server Apache x-frame-options SAMEORIGIN etag "1fea6-5ce5310ab7480-gzip" strict-transport-security max-age=31536000 content-type application/x-javascript cache-control max-age=0, no-cache, no-store content-security-policy upgrade-insecure-requests; frame-ancestors *.cisco.com *.jasper.com *.ciscospark.com *.ciscolive.com http://cisco.lookbookhq.com https://cisco.lookbookhq.com testcisco.marketing.adobe.com cisco.marketing.adobe.com ciscosales.my.salesforce.com test.salesforce.com zedo.com hindustantimes.com economictimes.indiatimes.com *.webex.com *.cdw.com *.cdwg.com *.cdw.ca *.meraki-go.com http://ciscopartners.lookbookhq.com https://ciscopartners.lookbookhq.com ciscolearningsystem.com ciscocustomer.lookbookhq.com cisco.lookbookhq.com ccsmedia.com *.itquotes.ie dteonline.com ampito-cisco.com arkphire.com *.insight.com *.ccsmedia.com *.ebuyer.com *.lambda-tek.com *.storm-technologies.com *.vohkus.com *.bechtle.com *.rainfocus.com *.broadbandbuyer.com *.hardware.com shop.redpontem.com; accept-ranges bytes expires Wed, 20 Oct 2021 05:31:41 GMT
GET H2	200	ipv cdn.bizible.com/m/	43 B 327 B	7ms 7ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=f2dafd389e6940b9c1cad0f72200b27b&_biz_s=1a7033&_biz_l=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&_biz_t=1634707900637&_biz_i=Telecom%20Firms%20Compromised%20in%20LightBasin%20Cyberattacks%20%7C%20Decipher&_biz_n=0&a=duo.com&rnd=216210&cdn_o=a&_biz_z=1634707901249 Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6739) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 20 Oct 2021 05:31:41 GMT last-modified Thu, 14 Oct 2021 01:06:59 GMT server ECS (frb/6739) age 534282 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" cache-control no-cache, no-store accept-ranges bytes content-type Image/GIF content-length 43 expires -1
GET H2	200	u cdn.bizibly.com/	43 B 203 B	17ms 6ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizibly.com/u?_biz_u=f2dafd389e6940b9c1cad0f72200b27b&_biz_s=1a7033&_biz_l=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&_biz_t=1634707901252&_biz_i=Telecom%20Firms%20Compromised%20in%20LightBasin%20Cyberattacks%20%7C%20Decipher&a=duo.com&rnd=543829&cdn_o=a&_biz_z=1634707901252 Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67C2) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 20 Oct 2021 05:31:41 GMT last-modified Thu, 14 Oct 2021 23:57:07 GMT server ECS (frb/67C2) age 452075 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" cache-control no-cache, no-store accept-ranges bytes content-type Image/GIF content-length 43 expires -1
GET H2	200	utag.5.js Show response tags.tiqcdn.com/utag/cisco/duo/prod/	71 KB 25 KB	285ms 285ms	Script application/x-javascript	104.75.88.194 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.5.js?utv=ut4.46.202110141708 Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.75.88.194 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-75-88-194.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 3af7c05eb5a2423969186314c2df01462f89bcbb46d1d2c81c5a782b2ceee981 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 05:31:41 GMT content-encoding gzip last-modified Thu, 14 Oct 2021 17:08:17 GMT server AkamaiNetStorage etag "fa54c443961e65143efa7a7d0cea34f0:1634231297.33339" vary Accept-Encoding content-type application/x-javascript cache-control max-age=1296000 accept-ranges bytes content-length 25619 expires Thu, 04 Nov 2021 05:31:41 GMT
GET H2	200	utag.3.js Show response tags.tiqcdn.com/utag/cisco/duo/prod/	21 KB 7 KB	275ms 275ms	Script application/x-javascript	104.75.88.194 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.3.js?utv=ut4.46.202110141708 Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.75.88.194 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-75-88-194.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash b5ecef87ef7289c4b546da05e7c0726e9fb557486ac91706fc477c7a617629a3 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 05:31:41 GMT content-encoding gzip last-modified Fri, 16 Jul 2021 15:31:27 GMT server AkamaiNetStorage etag "a84da8128747ee3521fe1899eeb11559:1626449487.562285" vary Accept-Encoding content-type application/x-javascript cache-control max-age=1296000 accept-ranges bytes content-length 7015 expires Thu, 04 Nov 2021 05:31:41 GMT
GET H2	200	utag.28.js Show response tags.tiqcdn.com/utag/cisco/duo/prod/	2 KB 1 KB	283ms 283ms	Script application/x-javascript	104.75.88.194 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.28.js?utv=ut4.46.202106171628 Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.75.88.194 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-75-88-194.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash c72062a60866c674a25f2a5b5d8344e9509c7381a6472f2a484325ac14597ee8 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 05:31:41 GMT content-encoding gzip last-modified Thu, 17 Jun 2021 16:28:49 GMT server AkamaiNetStorage etag "097dc543fb3caec1bac670f2bd520652:1623947329.572906" vary Accept-Encoding content-type application/x-javascript cache-control max-age=1296000 accept-ranges bytes content-length 999 expires Thu, 04 Nov 2021 05:31:41 GMT
GET H2	404	data.json Show response duo.com/site/themes/duo/json-bodymovin/d-logo-light/	48 KB 12 KB	169ms 169ms	XHR text/html	143.204.98.6 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://duo.com/site/themes/duo/json-bodymovin/d-logo-light/data.json Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.6 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-6.fra50.r.cloudfront.net Software Duo/1.0 / Resource Hash 8f8e2f04bc1eea3a4e183f2fdaec7969f9ef3ebe7cfcc4285f1d352937cd2a0c Request headers :path /site/themes/duo/json-bodymovin/d-logo-light/data.json pragma no-cache cookie _gcl_au=1.1.626796007.1634707901; _ga=GA1.2.1747793963.1634707901; _gid=GA1.2.723177448.1634707901; _biz_uid=f2dafd389e6940b9c1cad0f72200b27b; _biz_sid=1a7033; _gat_UA-20141016-1=1; _dc_gtm_UA-20141016-1=1; _mkto_trk=id:074-UQX-410&token:_mch-duo.com-1634707900668-36963; __qca=P0-761926959-1634707900642; _cs_c=1; _cs_id=82928de6-7d5e-a4ec-e25b-faced8c5a3f6.1634707900.1.1634707900.1634707900.1627413105.1668871900732; _cs_s=1.0.0.1634709700733; _fbp=fb.1.1634707900755.1977959718; utag_main=v_id:017c9c2f0993001986dddc474a3003072004d06a00b08$_sn:1$_se:1$_ss:1$_st:1634709700820$ses_id:1634707900820%3Bexp-session$_pn:1%3Bexp-session$vapi_domain:duo.com; AMCVS_B8D07FF4520E94C10A490D4C%40AdobeOrg=1; AMCV_B8D07FF4520E94C10A490D4C%40AdobeOrg=281789898%7CMCIDTS%7C18921%7CMCMID%7C75814106805939959082749674889644808470%7CMCAAMLH-1635312700%7C6%7CMCAAMB-1635312700%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1634715101s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C4.1.0; _biz_nA=3; _biz_pendingA=%5B%22m%2Fipv%3F_biz_r%3D%26_biz_h%3D-1906410348%26_biz_u%3Df2dafd389e6940b9c1cad0f72200b27b%26_biz_s%3D1a7033%26_biz_l%3Dhttps%253A%252F%252Fduo.com%252Fdecipher%252Ftelecom-firms-compromised-in-lightbasin-cyberattacks%26_biz_t%3D1634707900637%26_biz_i%3DTelecom%2520Firms%2520Compromised%2520in%2520LightBasin%2520Cyberattacks%2520%257C%2520Decipher%26_biz_n%3D0%26a%3Dduo.com%26rnd%3D216210%22%2C%22m%2Fu%3FmapType%3Dmkto%26mapValue%3Did%253A074-UQX-410%2526token%253A_mch-duo.com-1634707900668-36963%26_biz_u%3Df2dafd389e6940b9c1cad0f72200b27b%26_biz_s%3D1a7033%26_biz_l%3Dhttps%253A%252F%252Fduo.com%252Fdecipher%252Ftelecom-firms-compromised-in-lightbasin-cyberattacks%26_biz_t%3D1634707901253%26_biz_i%3DTelecom%2520Firms%2520Compromised%2520in%2520LightBasin%2520Cyberattacks%2520%257C%2520Decipher%26_biz_n%3D1%26a%3Dduo.com%26rnd%3D158455%22%2C%22m%2Fu%3FmapType%3Decid%26mapValue%3DB8D07FF4520E94C10A490D4C%2540AdobeOrg_75814106805939959082749674889644808470%26_biz_u%3Df2dafd389e6940b9c1cad0f72200b27b%26_biz_s%3D1a7033%26_biz_l%3Dhttps%253A%252F%252Fduo.com%252Fdecipher%252Ftelecom-firms-compromised-in-lightbasin-cyberattacks%26_biz_t%3D1634707901254%26_biz_i%3DTelecom%2520Firms%2520Compromised%2520in%2520LightBasin%2520Cyberattacks%2520%257C%2520Decipher%26_biz_n%3D2%26a%3Dduo.com%26rnd%3D835544%22%5D; _biz_flagsA=%7B%22Version%22%3A1%2C%22Mkto%22%3A%221%22%2C%22Ecid%22%3A%22-2073551993%22%7D accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode cors accept */* cache-control no-cache sec-fetch-dest empty :authority duo.com referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 05:31:41 GMT content-encoding gzip server Duo/1.0 x-amz-cf-pop FRA50-C1 etag W/"61255104-bf39" vary Accept-Encoding x-cache Error from cloudfront content-type text/html; charset=utf-8 via 1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront) content-length 11938 x-amz-cf-id ncsMSQE5iqVVgAn_bmWcadw8hwgovPGZ9HACnBZ8pwGpUzKHKwU9qQ==
GET H2	204	0 bat.bing.com/action/	0 174 B	41ms 41ms	Image text/plain	204.79.197.200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=4006052&Ver=2&mid=1c56e367-9ae9-46e5-a09f-6221e63763e7&sid=013fa8e0316711ecb5c97568ce9bb50b&vid=013fdd30316711ec97e6590dfad5321f&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Telecom%20Firms%20Compromised%20in%20LightBasin%20Cyberattacks%20%7C%20Decipher&p=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&r=&lt=1198&evt=pageLoad&msclkid=N&sv=1&rn=297783 Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 204.79.197.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS a-0001.a-msedge.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers access-control-allow-origin * pragma no-cache date Wed, 20 Oct 2021 05:31:40 GMT cache-control no-cache, must-revalidate x-msedge-ref Ref A: 70BD48B2C8C445A39ECE5CC1FEAB2BC4 Ref B: PRG01EDGE0807 Ref C: 2021-10-20T05:31:41Z x-cache CONFIG_NOCACHE expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	xdc.js Show response cdn.bizible.com/	116 B 523 B	118ms 118ms	Script text/javascript	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/xdc.js?_biz_u=f2dafd389e6940b9c1cad0f72200b27b&_biz_h=-1906410348&cdn_o=a&jsVer=4.21.06.25&a=duo.com Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6711) / Resource Hash 60cab38910495ba78f3d294733005f0b410cca2b7426e86d0cf6109a845c0e11 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 05:31:40 GMT content-encoding gzip server ECS (frb/6711) etag 16720D13 vary Accept-Encoding p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" cache-control private, must-revalidate, max-age=21600 content-type text/javascript; charset=utf-8 content-length 218
POST H3	200	/ Show response www.facebook.com/tr/ Frame 4EEC	0 15 B	7ms 7ms	Document text/plain	185.60.216.35 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H3 Security QUIC, , AES_128_GCM Server 185.60.216.35 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS edge-star-mini-shv-01-frx5.facebook.com Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers :method POST :authority www.facebook.com :scheme https :path /tr/ content-length 2586 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 origin https://duo.com content-type application/x-www-form-urlencoded user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 Origin https://duo.com Content-Type application/x-www-form-urlencoded User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Response headers content-type text/plain access-control-allow-origin https://duo.com access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin content-length 0 server proxygen-bolt alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 priority u=3,i date Wed, 20 Oct 2021 05:31:41 GMT
GET H/1.1	200 OK	ibs:dpid=771&dpuuid=CAESEGRJQmLDr2sAXa7-Jqi4Gkw&google_cver=1 dpm.demdex.net/ Frame C21B Redirect Chain https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=Njk2OTA1Mjk3MTcyNzMzOTc4MTM0MzQzNzE0Njk5NDA4MTgwNzE= https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=Njk2OTA1Mjk3MTcyNzMzOTc4MTM0MzQzNzE0Njk5NDA4MTgwNzE=&google_tc= https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEGRJQmLDr2sAXa7-Jqi4Gkw&google_cver=1?gdpr=0&gdpr_consent=	42 B 945 B	33ms 32ms	Image image/gif	18.200.208.216 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEGRJQmLDr2sAXa7-Jqi4Gkw&google_cver=1?gdpr=0&gdpr_consent= Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.200.208.216 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-200-208-216.eu-west-1.compute.amazonaws.com Software / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://cisco.demdex.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers DCS dcs-prod-irl1-2-v019-0440bd2ad.edge-irl1.demdex.com UNKNOWN Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains content-encoding gzip X-Content-Type-Options nosniff X-TID uc++3xv7SAk= P3P policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Cache-Control no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Connection keep-alive Content-Type image/gif Content-Length 59 Expires Thu, 01 Jan 1970 00:00:00 UTC Redirect headers pragma no-cache date Wed, 20 Oct 2021 05:31:41 GMT server HTTP server (unknown) p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" location https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEGRJQmLDr2sAXa7-Jqi4Gkw&google_cver=1?gdpr=0&gdpr_consent= cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 314 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H3	200	/ Show response www.facebook.com/tr/ Frame 47CD	0 15 B	7ms 7ms	Document text/plain	185.60.216.35 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H3 Security QUIC, , AES_128_GCM Server 185.60.216.35 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS edge-star-mini-shv-01-frx5.facebook.com Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers :method POST :authority www.facebook.com :scheme https :path /tr/ content-length 2586 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 origin https://duo.com content-type application/x-www-form-urlencoded user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 Origin https://duo.com Content-Type application/x-www-form-urlencoded User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Response headers content-type text/plain access-control-allow-origin https://duo.com access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin content-length 0 server proxygen-bolt alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 priority u=3,i date Wed, 20 Oct 2021 05:31:41 GMT
GET H2	200	u cdn.bizible.com/m/	43 B 121 B	8ms 7ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/m/u?mapType=mkto&mapValue=id%3A074-UQX-410%26token%3A_mch-duo.com-1634707900668-36963&_biz_u=f2dafd389e6940b9c1cad0f72200b27b&_biz_s=1a7033&_biz_l=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&_biz_t=1634707901253&_biz_i=Telecom%20Firms%20Compromised%20in%20LightBasin%20Cyberattacks%20%7C%20Decipher&_biz_n=1&a=duo.com&rnd=158455&cdn_o=a&_biz_z=1634707901529 Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6776) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 20 Oct 2021 05:31:41 GMT last-modified Thu, 14 Oct 2021 23:58:36 GMT server ECS (frb/6776) age 451985 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" cache-control no-cache, no-store accept-ranges bytes content-type Image/GIF content-length 43 expires -1
GET H2	200	u cdn.bizible.com/m/	43 B 85 B	10ms 10ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/m/u?mapType=ecid&mapValue=B8D07FF4520E94C10A490D4C%40AdobeOrg_75814106805939959082749674889644808470&_biz_u=f2dafd389e6940b9c1cad0f72200b27b&_biz_s=1a7033&_biz_l=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&_biz_t=1634707901254&_biz_i=Telecom%20Firms%20Compromised%20in%20LightBasin%20Cyberattacks%20%7C%20Decipher&_biz_n=2&a=duo.com&rnd=835544&cdn_o=a&_biz_z=1634707901529 Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6776) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 20 Oct 2021 05:31:41 GMT last-modified Thu, 14 Oct 2021 23:58:36 GMT server ECS (frb/6776) age 451985 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" cache-control no-cache, no-store accept-ranges bytes content-type Image/GIF content-length 43 expires -1
GET H/1.1	200 OK	ntpagetag.gif cisco-tags.cisco.com/tag/	85 B 598 B	627ms 124ms	Image image/gif	72.163.10.10 CISCOSYSTEMS
General Check archive.org Show headers Download Go to Show image Full URL https://cisco-tags.cisco.com/tag/ntpagetag.gif?js=1&ts=1634707901540.480&lc=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&rs=1600x1200&cd=24&ln=en&tz=GMT&jv=0&utag_main_v_id=017c9c2f0993001986dddc474a3003072004d06a00b08&meta.viewport=width%3Ddevice-width%2C%20initial-scale%3D1.0%2C%20user-scalable%3Dyes&title=telecom%20firms%20compromised%20in%20lightbasin%20cyberattacks%20%7C%20decipher&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&tag=ut4.46.202110141708&entitlement=undefined&locale=en-us&meta.country=us&meta.locale=us&breakpoint=unavailable&content_type=no%20contenttype&linktrack=linkpage&loc=http%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&cookie_length=1000&meta.iapath=no%20iapath&hier1=no%20iapath&meta.wm_reporting_category=no%20iapath&sa_source=meta.iapath&t_profile=cisco.duo&t_load=ctm&suite=cisco-complete&returnVisit=false&cookies=true&localstorage=true&dnt=false&_ga=GA1.2.1747793963.1634707901&conversion=event1&adobeVersions=AppMeasurement%3Dna%2CVisitorJS%3Dna%2CMbox%3Dna&meta.msapplication-tilecolor=%23000000&meta.msapplication-config=%2Fassets%2Fimg%2Fdecipher%2Ffavicons%2Fbrowserconfig.xml&meta.theme-color=%23ffffff&meta.robots=index%2Cfollow%2Carchive&meta.fb:app_id=2090208394329663&meta.og:site_name=decipher&meta.og:type=website&meta.og:url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&meta.twitter:card=summary_large_image&meta.twitter:site=%40deciphersec&meta.twitter:creator=%40deciphersec&meta.og:title=telecom%20firms%20compromised%20in%20lightbasin%20cyberattacks&meta.twitter:title=telecom%20firms%20compromised%20in%20lightbasin%20cyberattacks&meta.description=a%20well-known%20attack%20group%20has%20compromised%20at%20least%2013%20telecommunications%20organizations%20since%202019%2C%20relying%20on%20custom%20toolsets%20and%20a%20novel%20c2%20persistence%20method.&meta.og:description=a%20well-known%20attack%20group%20has%20compromised%20at%20least%2013%20telecommunications%20organizations%20since%202019%2C%20relying%20on%20custom%20toolsets%20and%20a%20novel%20c2%20persistence%20method.&meta.twitter:description=a%20well-known%20attack%20group%20has%20compromised%20at%20least%2013%20telecommunications%20organizations%20since%202019%2C%20relying%20on%20custom%20toolsets%20and%20a%20novel%20c2%20persistence%20method.&meta.twitter:image=https%3A%2F%2Fduo.com%2Fassets%2Fimg%2Fseo-images%2Fglobal-network-decipher.jpg&meta.og:image=https%3A%2F%2Fduo.com%2Fassets%2Fimg%2Fseo-images%2Fglobal-network-decipher.jpg&meta.og:image:width=1200&meta.og:image:height=630&meta.bitly-verification=040b99f315c6&meta.google-site-verification=svd8ahbyylsc2wljqdzwij1d2tnu8-u3fbldciehxdu&meta.twitter:widgets:csp=on&meta.msvalidate.01=27fb624dbd3f07315a4bf69f5d649c68&ets=1634707901541.337 Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 72.163.10.10 Richardson, United States, ASN109 (CISCOSYSTEMS, US), Reverse DNS cisco-tags.cisco.com Software Apache/2.2 / Resource Hash b96b64444f7d52c39b5716fe4d3e8d0433c67fb79731a4400188835d97b74bce Security Headers Name Value Content-Security-Policy script-src 'self'; object-src 'self' Strict-Transport-Security max-age=31536000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Wed, 20 Oct 2021 05:31:42 GMT X-Content-Type-Options nosniff Last-Modified Fri, 12 Jun 2009 13:25:52 GMT Server Apache/2.2 ETag "55" X-Frame-Options SAMEORIGIN Content-Type image/gif Access-Control-Allow-Origin * Connection Keep-Alive Content-Security-Policy script-src 'self'; object-src 'self' Strict-Transport-Security max-age=31536000; includeSubdomains; Accept-Ranges bytes Keep-Alive timeout=2, max=1000 Content-Length 85 X-XSS-Protection 1; mode=block
GET H3	200	gtm.js Show response www.googletagmanager.com/	268 KB 78 KB	43ms 29ms	Script application/javascript	142.250.185.136 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D&l=dataLayer Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.136 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s50-in-f8.1e100.net Software Google Tag Manager / Resource Hash f2f3855761e0a0749686fb8bf8226adeef615e2158d8506f99427f08ac4140af Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 05:31:41 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 80064 x-xss-protection 0 last-modified Wed, 20 Oct 2021 03:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 20 Oct 2021 05:31:41 GMT
GET H2	200	utag.v.js Show response tags.tiqcdn.com/utag/tiqapp/	2 B 202 B	53ms 52ms	Script application/x-javascript	104.75.88.194 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=cisco/duo/202110141708&cb=1634707901574 Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.75.88.194 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-75-88-194.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 05:31:41 GMT last-modified Thu, 14 Apr 2016 16:57:51 GMT server AkamaiNetStorage etag "7bc0ee636b3b83484fc3b9348863bd22:1460653071" content-type application/x-javascript cache-control max-age=600 accept-ranges bytes content-length 2 expires Wed, 20 Oct 2021 05:41:41 GMT
GET H2	204	dvar c.contentsquare.net/	0 319 B	28ms 28ms	Image text/plain	52.208.183.15 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://c.contentsquare.net/dvar?v=11.4.3&pid=5637&uu=82928de6-7d5e-a4ec-e25b-faced8c5a3f6&sn=1&pn=1&dv=N4IgxgzgsghgLmAFgSwHYHMDSBTAniALhAAYA6AJgFZKB2AZgEYHKA2ATkoA4672B9BizoAWGsRptizGuRABfIAA&r=567878 Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.208.183.15 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-208-183-15.eu-west-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 20 Oct 2021 05:31:41 GMT access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin * cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 content-disposition inline timing-allow-origin * access-control-allow-headers Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With expires Sun, 24 Oct 1982 23:00:00 GMT
GET H2	200	adsct analytics.twitter.com/i/ Frame C21B	43 B 581 B	134ms 118ms	Image image/gif	104.244.42.3 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://analytics.twitter.com/i/adsct?p_user_id=69690529717273397813434371469940818071&p_id=38594 Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.3 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=631138519 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://cisco.demdex.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 05:31:41 GMT content-encoding gzip x-content-type-options nosniff status 200 OK x-twitter-response-tags BouncerCompliant content-length 65 x-xss-protection 0 pragma no-cache last-modified Wed, 20 Oct 2021 05:31:41 GMT server tsa_o x-frame-options SAMEORIGIN strict-transport-security max-age=631138519 content-type image/gif;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash e87b641e717b974ad1bed687d4bea60c949fd64475962b0e01c2b463c732b33a x-transaction b4f54894e25a7cf4 expires Tue, 31 Mar 1981 05:00:00 GMT
GET H2	200	s14149389850200 Show response smetrics.cisco.com/b/ss/cisco-complete/10/JS-2.12.0/	729 B 959 B	42ms 42ms	Script application/x-javascript	15.236.176.210 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://smetrics.cisco.com/b/ss/cisco-complete/10/JS-2.12.0/s14149389850200?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=20%2F9%2F2021%205%3A31%3A41%203%200&d.&nsid=0&jsonv=1&.d&sdid=6F3CEB133C4DDA2D-03901B7C4468ACF1&mid=75814106805939959082749674889644808470&aamlh=6&ce=UTF-8&ns=cisco&pageName=duo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&g=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&cc=USD&events=event1&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c1=telecom%20firms%20compromised%20in%20lightbasin%20cyberattacks%20%7C%20decipher&h1=duo.com%3Adecipher%3Atelecom-firms-compromised-in-lightbasin-cyberattacks&c2=undefined%3Ano%20iapath%3Atelecom-firms-compromised-in-lightbasin-cyberattacks&c3=duo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&h3=no%20iapath&c10=9%3A31%20PM%7CTuesday&v10=9%3A31%20PM%7CTuesday&v25=duo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&v26=no%20contenttype&c28=no%20iapath&v28=no%20iapath&c33=en-us&v33=en-us&c41=duo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&c46=ut4.46.202110141708&v48=undefined&c50=cisco-complete&c51=unavailable&c53=no%20contenttype&c59=017c9c2f0993001986dddc474a3003072004d06a00b08&v63=unavailable&v77=AppMeasurement%3D2.12.0%2CVisitorJS%3D4.1.0%2CMbox%3Dna&v78=dnt%3Dfalse%2Ccookies%3Dtrue%2Clocalstorage%3Dtrue&v92=0.2557311569583369_1634707901572&v98=cisco.duo&v106=75814106805939959082749674889644808470&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&AQE=1 Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.5.js?utv=ut4.46.202110141708 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 15.236.176.210 Paris, France, ASN16509 (AMAZON-02, US), Reverse DNS ec2-15-236-176-210.eu-west-3.compute.amazonaws.com Software jag / Resource Hash 484c054ad13a0564e0cb10ce1192b0892d2618d98a3679c83542f3479cd8a689 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers x-aam-tid 2Bwd9qncQyY= date Wed, 20 Oct 2021 05:31:41 GMT x-content-type-options nosniff x-c main-1540.I13d07b.M0-522 p3p CP="This is not a P3P policy" vary * content-length 729 x-xss-protection 1; mode=block dcs dcs-prod-irl1-1-v019-09f7953bb.edge-irl1.demdex.com UNKNOWN pragma no-cache last-modified Thu, 21 Oct 2021 05:31:41 GMT server jag xserver anedge-b4c7fdd79-55rbf etag 3510508488266645504-4619879091094783924 strict-transport-security max-age=31536000; includeSubDomains content-type application/x-javascript;charset=utf-8 access-control-allow-origin * cache-control no-cache, no-store, max-age=0, no-transform, private expires Tue, 19 Oct 2021 05:31:41 GMT
GET H2	204	usermatch.gif beacon.krxd.net/ Frame C21B Redirect Chain https://usermatch.krxd.net/um/v2?partner=adobe&id=69690529717273397813434371469940818071 https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=69690529717273397813434371469940818071	0 338 B	99ms 32ms	Image text/plain	54.77.164.82 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=69690529717273397813434371469940818071 Requested by Host: duo.com URL: https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.77.164.82 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-77-164-82.eu-west-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://cisco.demdex.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 05:31:42 GMT cache-control private, no-cache, no-store x-request-time D=34 t=1634707902 x-served-by beacon-n020-dub-prod.krxd.net p3p policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" Redirect headers location https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=69690529717273397813434371469940818071 date Wed, 20 Oct 2021 05:31:41 GMT x-cache-hits 0 x-age 0 content-length 0 x-cache MISS x-served-by usermatch-a009-ash-prod.krxd.net
GET H/1.1	200 OK	getuidj Show response secure.adnxs.com/	11 B 683 B	22ms 6ms	XHR application/json	37.252.172.36 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.172.36 , Ascension Island, ASN29990 (ASN-APPNEX, US), Reverse DNS 692.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.17.9 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Pragma no-cache Date Wed, 20 Oct 2021 05:31:42 GMT X-Proxy-Origin 216.131.114.97; 216.131.114.97; 692.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com AN-X-Request-Uuid 6dc731d4-d8d7-4d36-ad4f-018e11c6afd5 Server nginx/1.17.9 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://duo.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 11 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H/1.1	200 OK	/ Show response c.6sc.co/	47 B 363 B	38ms 6ms	XHR text/plain	104.89.35.64 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.89.35.64 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-89-35-64.deploy.static.akamaitechnologies.com Software / Resource Hash f3981b10f3018508a8dc9caa6ba4c735eb0ad20cd8d8be88fb298a47ab27c516 Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Wed, 20 Oct 2021 05:31:42 GMT Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type text/plain Access-Control-Allow-Origin https://duo.com Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Content-Length 47
GET H3	200	collect www.google-analytics.com/	35 B 55 B	142ms 142ms	Image image/gif	142.250.186.174 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j93&a=330059425&t=event&ni=1&_s=1&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&ul=en-us&de=UTF-8&dt=Telecom%20Firms%20Compromised%20in%20LightBasin%20Cyberattacks%20%7C%20Decipher&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=undefined&ea=undefined&_u=aHDAAAADQAAAAG~&jid=&gjid=&cid=1747793963.1634707901&tid=UA-20141016-1&_gid=723177448.1634707901&gtm=2wgai0MFPB9D&cd2=1747793963.1634707901&z=1589396146 Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.174 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f14.1e100.net Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Tue, 19 Oct 2021 14:24:45 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 54417 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	326ms 304ms	Image image/gif	104.89.35.64 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=null&session=cd6532d6-0518-4272-8457-df5be1faf03a&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2020%20Oct%202021%2005%3A31%3A40%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20well-known%20attack%20group%20has%20compromised%20at%20least%2013%20telecommunications%20organizations%20since%202019%2C%20relying%20on%20custom%20toolsets%20and%20a%20novel%20C2%20persistence%20method.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Telecom%20Firms%20Compromised%20in%20LightBasin%20Cyberattacks%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&pageViewId=61c1012e-3c70-4e4b-8904-3a8e8f7b909e&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.89.35.64 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-89-35-64.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Wed, 20 Oct 2021 05:31:42 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	303ms 303ms	Image image/gif	104.89.35.64 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=5de17b5c2a4f0000bca96f613102000017930000&session=cd6532d6-0518-4272-8457-df5be1faf03a&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2020%20Oct%202021%2005%3A31%3A43%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2020%20Oct%202021%2005%3A31%3A40%20GMT%22%2C%22timeSpent%22%3A%222539%22%2C%22totalTimeSpent%22%3A%222539%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20well-known%20attack%20group%20has%20compromised%20at%20least%2013%20telecommunications%20organizations%20since%202019%2C%20relying%20on%20custom%20toolsets%20and%20a%20novel%20C2%20persistence%20method.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Telecom%20Firms%20Compromised%20in%20LightBasin%20Cyberattacks%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&pageViewId=61c1012e-3c70-4e4b-8904-3a8e8f7b909e&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.89.35.64 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-89-35-64.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Wed, 20 Oct 2021 05:31:43 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	305ms 305ms	Image image/gif	104.89.35.64 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=5de17b5c2a4f0000bca96f613102000017930000&session=cd6532d6-0518-4272-8457-df5be1faf03a&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2020%20Oct%202021%2005%3A31%3A44%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2020%20Oct%202021%2005%3A31%3A43%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223540%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20well-known%20attack%20group%20has%20compromised%20at%20least%2013%20telecommunications%20organizations%20since%202019%2C%20relying%20on%20custom%20toolsets%20and%20a%20novel%20C2%20persistence%20method.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Telecom%20Firms%20Compromised%20in%20LightBasin%20Cyberattacks%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&pageViewId=61c1012e-3c70-4e4b-8904-3a8e8f7b909e&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.89.35.64 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-89-35-64.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Wed, 20 Oct 2021 05:31:44 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	304ms 304ms	Image image/gif	104.89.35.64 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=5de17b5c2a4f0000bca96f613102000017930000&session=cd6532d6-0518-4272-8457-df5be1faf03a&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2020%20Oct%202021%2005%3A31%3A45%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2020%20Oct%202021%2005%3A31%3A44%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%224544%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20well-known%20attack%20group%20has%20compromised%20at%20least%2013%20telecommunications%20organizations%20since%202019%2C%20relying%20on%20custom%20toolsets%20and%20a%20novel%20C2%20persistence%20method.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Telecom%20Firms%20Compromised%20in%20LightBasin%20Cyberattacks%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftelecom-firms-compromised-in-lightbasin-cyberattacks&pageViewId=61c1012e-3c70-4e4b-8904-3a8e8f7b909e&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.89.35.64 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-89-35-64.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://duo.com/decipher/telecom-firms-compromised-in-lightbasin-cyberattacks User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Wed, 20 Oct 2021 05:31:45 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT