claroty.com Open in urlscan Pro
138.197.228.97 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-man...
Submission: On May 01 via api (May 1st 2024, 2:09:48 am UTC) from TR — Scanned from DE

Summary HTTP 87 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 34 IPs in 4 countries across 28 domains to perform 87 HTTP transactions. The main IP is 138.197.228.97, located in North Bergen, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is claroty.com. The Cisco Umbrella rank of the primary domain is 241033.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on February 13th 2024. Valid for: a year.

This is the only time claroty.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
13	138.197.228.97 138.197.228.97	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	152.195.15.58 152.195.15.58	15133 (EDGECAST) (EDGECAST)
4	2606:4700:440... 2606:4700:4400::6812:22e5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.18.142.119 104.18.142.119	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	2606:4700:440... 2606:4700:4400::6812:2844	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:806::2008	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:350... 2a02:26f0:3500:16::215:148d	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	18.66.102.11 18.66.102.11	16509 (AMAZON-02) (AMAZON-02)
1	18.244.18.11 18.244.18.11	16509 (AMAZON-02) (AMAZON-02)
6	104.16.118.43 104.16.118.43	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:8cd1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	2.17.100.193 2.17.100.193	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 2	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c00::9c	15169 (GOOGLE) (GOOGLE)
2	142.250.186.35 142.250.186.35	15169 (GOOGLE) (GOOGLE)
1	23.22.90.252 23.22.90.252	14618 (AMAZON-AES) (AMAZON-AES)
2	2a00:1450:400... 2a00:1450:4001:800::200e	15169 (GOOGLE) (GOOGLE)
1	13.32.27.21 13.32.27.21	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700::68... 2606:4700::6810:6efe	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:afc9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6810:7674	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:80ac	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	104.19.175.188 104.19.175.188	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.66.112.110 18.66.112.110	16509 (AMAZON-02) (AMAZON-02)
1	172.217.18.4 172.217.18.4	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
2	104.18.80.204 104.18.80.204	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:ab0... 2a02:26f0:ab00::214:8e70	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	104.18.37.212 104.18.37.212	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6810:7574	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	13.248.142.121 13.248.142.121	16509 (AMAZON-02) (AMAZON-02)
87	34

13 138.197.228.97 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

claroty.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 152.195.15.58 (United States)

ASN15133 (EDGECAST, US)

cdn.bizible.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:4400::6812:22e5 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.142.119 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hsforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2606:4700:4400::6812:2844 (United States)

ASN13335 (CLOUDFLARENET, US)

kit.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ka-p.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:806::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:16::215:148d (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.102.11 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-102-11.fra56.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.244.18.11 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-244-18-11.fra56.r.cloudfront.net

static.oktopost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.16.118.43 (None, )

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ws-assets.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:8cd1 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2.17.100.193 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-17-100-193.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c00::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.35 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f3.1e100.net

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.22.90.252 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-23-22-90-252.compute-1.amazonaws.com

okt.to	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.21 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-21.fra56.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:6efe (United States)

ASN13335 (CLOUDFLARENET, US)

js.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:afc9 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:7674 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cta-service-cms2.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:80ac (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.19.175.188 (None, )

ASN13335 (CLOUDFLARENET, US)

forms.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.112.110 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-112-110.fra56.r.cloudfront.net

vc.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.18.4 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s22-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.80.204 (None, )

ASN13335 (CLOUDFLARENET, US)

forms-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
perf-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:ab00::214:8e70 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.18.37.212 (None, )

ASN13335 (CLOUDFLARENET, US)

js.zi-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:7574 (United States)

ASN13335 (CLOUDFLARENET, US)

track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.248.142.121 (United States)

ASN16509 (AMAZON-02, US)
PTR: ac3ff6aafb2cddae2.awsglobalaccelerator.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	claroty.com claroty.com — Cisco Umbrella Rank: 241033	347 KB
11	fontawesome.com kit.fontawesome.com — Cisco Umbrella Rank: 1791 ka-p.fontawesome.com — Cisco Umbrella Rank: 3264	26 KB
10	6sc.co j.6sc.co — Cisco Umbrella Rank: 5885 c.6sc.co — Cisco Umbrella Rank: 9001 ipv6.6sc.co — Cisco Umbrella Rank: 6019 b.6sc.co — Cisco Umbrella Rank: 3922	20 KB
6	zoominfo.com ws.zoominfo.com — Cisco Umbrella Rank: 4706 ws-assets.zoominfo.com — Cisco Umbrella Rank: 11694	30 KB
5	hsforms.com forms.hsforms.com — Cisco Umbrella Rank: 4253 forms-na1.hsforms.com — Cisco Umbrella Rank: 6866 perf-na1.hsforms.com — Cisco Umbrella Rank: 4475	8 KB
4	hubspot.com js.hubspot.com — Cisco Umbrella Rank: 4170 cta-service-cms2.hubspot.com — Cisco Umbrella Rank: 4116 track.hubspot.com — Cisco Umbrella Rank: 2416	28 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	350 KB
4	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2206	32 KB
3	zi-scripts.com js.zi-scripts.com — Cisco Umbrella Rank: 6963	4 KB
3	linkedin.com 1 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 328 px4.ads.linkedin.com — Cisco Umbrella Rank: 6223	2 KB
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 9083	327 B
2	hscollectedforms.net js.hscollectedforms.net — Cisco Umbrella Rank: 4528 forms.hscollectedforms.net — Cisco Umbrella Rank: 4688	26 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 31	21 KB
2	google.de www.google.de — Cisco Umbrella Rank: 7278	126 B
2	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 84	402 B
2	google.com region1.analytics.google.com — Cisco Umbrella Rank: 2941 www.google.com — Cisco Umbrella Rank: 2	314 B
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 737 script.hotjar.com — Cisco Umbrella Rank: 933	59 KB
1	gstatic.com fonts.gstatic.com	24 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 33	865 B
1	hotjar.io vc.hotjar.io — Cisco Umbrella Rank: 2774	231 B
1	hsadspixel.net js.hsadspixel.net — Cisco Umbrella Rank: 3146	4 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2216	21 KB
1	okt.to okt.to — Cisco Umbrella Rank: 34932	100 B
1	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 2505	1 KB
1	oktopost.com static.oktopost.com — Cisco Umbrella Rank: 41162	4 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 781	17 KB
1	hsforms.net js.hsforms.net — Cisco Umbrella Rank: 6663	155 KB
1	bizible.com cdn.bizible.com — Cisco Umbrella Rank: 7702	25 KB
87	28

	Domain	Requested by
13	claroty.com	claroty.com
10	ka-p.fontawesome.com	kit.fontawesome.com claroty.com
7	b.6sc.co	claroty.com
5	ws.zoominfo.com	claroty.com js.zi-scripts.com ws-assets.zoominfo.com
4	www.googletagmanager.com	claroty.com www.googletagmanager.com
4	js.hs-banner.com	claroty.com js.hs-scripts.com js.hs-banner.com
3	js.zi-scripts.com	claroty.com js.zi-scripts.com
3	forms.hsforms.com	js.hsforms.net claroty.com
2	epsilon.6sense.com	cdn.bizible.com
2	track.hubspot.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	www.google.de	claroty.com
2	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com
2	px.ads.linkedin.com	1 redirects snap.licdn.com
1	ws-assets.zoominfo.com	js.zi-scripts.com
1	ipv6.6sc.co	cdn.bizible.com
1	c.6sc.co	cdn.bizible.com
1	fonts.gstatic.com	fonts.googleapis.com
1	perf-na1.hsforms.com	claroty.com
1	forms-na1.hsforms.com	claroty.com
1	fonts.googleapis.com	js.hs-banner.com
1	cta-service-cms2.hubspot.com	js.hubspot.com
1	forms.hscollectedforms.net	cdn.bizible.com
1	www.google.com	claroty.com
1	vc.hotjar.io	cdn.bizible.com
1	js.hsadspixel.net	js.hs-scripts.com
1	js.hubspot.com	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	js.hscollectedforms.net	js.hs-scripts.com
1	script.hotjar.com	static.hotjar.com
1	okt.to	static.oktopost.com
1	region1.analytics.google.com	www.googletagmanager.com
1	px4.ads.linkedin.com	claroty.com
1	j.6sc.co	claroty.com
1	js.hs-scripts.com	www.googletagmanager.com
1	static.oktopost.com	claroty.com
1	static.hotjar.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	kit.fontawesome.com	claroty.com
1	js.hsforms.net	claroty.com
1	cdn.bizible.com	claroty.com
87	41

This site contains links to these domains. Also see Links.

Domain
cert-portal.siemens.com
github.com
www.linkedin.com
twitter.com
www.facebook.com
portal.claroty.com
nexusconnect.io
www.youtube.com

Subject Issuer	Validity	Valid
*.claroty.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-13` - `2025-03-14`	a year	crt.sh
io.bizible.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-06-01` - `2024-07-01`	a year	crt.sh
hs-banner.com E1	`2024-04-01` - `2024-06-30`	3 months	crt.sh
hsforms.net GTS CA 1P5	`2024-04-15` - `2024-07-14`	3 months	crt.sh
*.fontawesome.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-04` - `2025-01-03`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
*.hotjar.com Amazon ECDSA 256 M03	`2024-02-07` - `2025-03-08`	a year	crt.sh
*.oktopost.com Amazon RSA 2048 M01	`2023-08-29` - `2024-09-26`	a year	crt.sh
zoominfo.com E1	`2024-04-19` - `2024-07-18`	3 months	crt.sh
hs-scripts.com E1	`2024-04-01` - `2024-06-30`	3 months	crt.sh
6sc.co R3	`2024-04-09` - `2024-07-08`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-01-30` - `2024-07-30`	6 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-04-08` - `2024-07-01`	3 months	crt.sh
*.google.de GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
okt.to R3	`2024-04-17` - `2024-07-16`	3 months	crt.sh
hscollectedforms.net E1	`2024-03-29` - `2024-06-27`	3 months	crt.sh
hs-analytics.net GTS CA 1P5	`2024-04-13` - `2024-07-12`	3 months	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2024-01-06` - `2024-12-31`	a year	crt.sh
hsadspixel.net E1	`2024-04-16` - `2024-07-15`	3 months	crt.sh
hsforms.com GTS CA 1P5	`2024-04-17` - `2024-07-16`	3 months	crt.sh
*.hotjar.io Amazon ECDSA 256 M02	`2024-02-07` - `2025-03-08`	a year	crt.sh
*.google.com GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
zi-scripts.com GTS CA 1P5	`2024-03-29` - `2024-06-27`	3 months	crt.sh
*.6sense.com Amazon RSA 2048 M03	`2024-03-31` - `2025-04-29`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Frame ID: 54D0337025FD9AE530B4931FA518B116
Requests: 82 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Exploiting a Classic Deserialization Vulnerability in Siemens SIMATIC Energy Manager | Claroty

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
kit\.fontawesome\.com/([0-9a-z]+).js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Page Statistics

87
Requests

99 %
HTTPS

50 %
IPv6

28
Domains

41
Subdomains

34
IPs

4
Countries

1202 kB
Transfer

3113 kB
Size

24
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://cert-portal.siemens.com/productcert/html/ssa-655554.html
Title: Siemens’ security advisory

Search URL Search Domain Scan URL

URL: https://github.com/pwntester/ysoserial.net
Title: ysoserial.net tool

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle/?url=https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/post?text=Exploiting%20a%20Classic%20Deserialization%20Vulnerability%20in%20Siemens%20SIMATIC%20Energy%20Manager&url=https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Title: Facebook

Search URL Search Domain Scan URL

URL: https://portal.claroty.com/English/register_email.aspx
Title: Become a Partner

Search URL Search Domain Scan URL

URL: https://portal.claroty.com/English/directory/
Title: Find a Partner

Search URL Search Domain Scan URL

URL: https://portal.claroty.com/
Title: Partner Login

Search URL Search Domain Scan URL

URL: https://nexusconnect.io/podcasts
Title: Podcasts

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/claroty/
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://twitter.com/claroty
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.youtube.com/@claroty20
Title: YouTube

Search URL Search Domain Scan URL

URL: https://www.facebook.com/ClarotyOT/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://portal.claroty.com/English/
Title: Partner Login

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 25

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5168721&time=1714529383525&url=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fexploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5168721&time=1714529383525&url=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fexploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager&e_ipv6=AQKP7vr62mAmgQAAAY8x6jTjxIXIXSwIw8G4CSE_h2o9k9zmnTKxqeNdynuKaSz6

87 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Show response
claroty.com/team82/research/ 78 KB
14 KB 374ms
180ms Document
text/html 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx / Statamic

Resource Hash

89cad6cee63c19be5bc8ee45e7810603e0014734ae6fa4ba3fe7d990bd0abe19

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: no-cache, private
content-encoding: gzip
content-security-policy: frame-ancestors 'self'; upgrade-insecure-requests
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: unsafe-none
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Wed, 01 May 2024 02:09:42 GMT
permissions-policy: accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), battery=(self), camera=(self), cross-origin-isolated=(self), display-capture=(self), document-domain=*, encrypted-media=(self), execution-while-not-rendered=*, execution-while-out-of-viewport=*, fullscreen=*, geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), midi=(self), navigation-override=(self), payment=(self), picture-in-picture=*, publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=*, usb=(self), web-share=(self), xr-spatial-tracking=(self)
referrer-policy: same-origin
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-powered-by: Statamic
x-ratelimit-limit: 30
x-ratelimit-remaining: 29
x-xss-protection: 1; mode=block

GET
H2 200 claroty-DQfYO8Ga.css
claroty.com/build/assets/ 57 KB
11 KB 103ms
101ms Stylesheet
text/css 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://claroty.com/build/assets/claroty-DQfYO8Ga.css

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

6858a0c963e69e6c972028626015eac3077696c9f1b9b089edd0d5fc30f9803e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 01 May 2024 00:23:45 GMT
server: nginx
etag: W/"66318b91-e2c4"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
x-xss-protection: 1; mode=block

GET
H2 200 claroty-3AHVqBhE.js Show response
claroty.com/build/assets/ 207 KB
70 KB 104ms
102ms Script
application/javascript 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://claroty.com/build/assets/claroty-3AHVqBhE.js

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

dc924bdb7298a1d9785ee12b8d0637a528473b8e8bad1be2008c515038b6b7d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Origin: https://claroty.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 01 May 2024 00:23:45 GMT
server: nginx
etag: W/"66318b91-33da7"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
x-xss-protection: 1; mode=block

GET
H2 200 bizible.js Show response
cdn.bizible.com/scripts/ 67 KB
25 KB 123ms
35ms Script
application/x-javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.bizible.com/scripts/bizible.js

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67D4) /

Resource Hash

e949e8a621d6107d8e6885fc0f2f0da166d5d1d48adc6c90440a156a8f0a8c53

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSub
last-modified: Mon, 29 Apr 2024 05:35:34 GMT
server: ECS (frb/67D4)
age: 17659
etag: "ec4df3ef799da1:0"
vary: Accept-Encoding
x-cache: HIT
content-type: application/x-javascript
cache-control: max-age=86400
accept-ranges: bytes
content-length: 25392

GET
H2 200 d44331c910ed5795dcf0803f1f8c018d0b78673e308a02768f49c5dce853cf48.js Show response
js.hs-banner.com/cookie-scanning/20307279/ 19 KB
8 KB 191ms
140ms Script
text/javascript 2606:4700:4400::6812:22e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/cookie-scanning/20307279/d44331c910ed5795dcf0803f1f8c018d0b78673e308a02768f49c5dce853cf48.js
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:22e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 98b750aa4e60391c77b81a1876a8e123b0ff69c57cc9dac1ebd6182ab1aab566

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
x-amz-version-id: A8.UgWK2sfAJgLalcLIOxrgL4F4JdlT1
content-encoding: br
cf-cache-status: REVALIDATED
x-amz-request-id: MMZ4BYQAQ288N60X
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: e046488c-35c1-48aa-af4c-5907f743321e
x-envoy-upstream-service-time: 16
x-amz-id-2: Pjb42740PrbUUPatG7UZS6PJeBeOLfn4p8t3UeNOxgvooibkdOIcqFPPV/M9dHk4tDW+IWPumVo=
x-evy-trace-listener: listener_https
x-request-id: e046488c-35c1-48aa-af4c-5907f743321e
x-evy-trace-route-configuration: listener_https/all
last-modified: Tue, 30 Apr 2024 15:10:33 GMT
server: cloudflare
etag: W/"d2c26b69effb8ec9cefd590e0026f2c7"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
vary: origin, Accept-Encoding
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-78cb6f459b-6w4vh
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 87cc3b246db2913d-FRA
expires: Wed, 01 May 2024 02:14:43 GMT

GET
H2 200 team82-logo-white-BGiCQ9zb.svg
claroty.com/build/assets/ 5 KB
2 KB 203ms
202ms Image
image/svg+xml 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://claroty.com/build/assets/team82-logo-white-BGiCQ9zb.svg

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

ef410da15ef1307792230bc15984643d4fa47ab902d62496ef98a725b1429e51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 01 May 2024 00:23:45 GMT
server: nginx
etag: W/"66318b91-14f8"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-xss-protection: 1; mode=block

GET
H2 200 logo-solid-white-DcRiqKcD.svg
claroty.com/build/assets/ 2 KB
1 KB 203ms
203ms Image
image/svg+xml 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://claroty.com/build/assets/logo-solid-white-DcRiqKcD.svg

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

60bdc532cad265a116b2b590c86a9679ed86fe5a1ac3764e08c521cf6ccb1784

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 01 May 2024 00:23:45 GMT
server: nginx
etag: W/"66318b91-9cb"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-xss-protection: 1; mode=block

GET
H2 200 YXNzZXRzL2ltYWdlNS0xNzEzOTAzODQwLnBuZw==
claroty.com/img/asset/ 48 KB
49 KB 316ms
301ms Image
image/webp 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://claroty.com/img/asset/YXNzZXRzL2ltYWdlNS0xNzEzOTAzODQwLnBuZw==?fm=webp&fit=crop&w=800&h=450&s=318b8e314b584f850c4ab12fcacff836

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

7165e74a0addefc944a67a5fef91eee51116e145cc67f975119a264357f14295

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
content-security-policy: frame-ancestors 'self'; upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-permitted-cross-domain-policies: none
cross-origin-embedder-policy: unsafe-none
cross-origin-resource-policy: cross-origin
content-length: 49126
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 24 Apr 2024 14:02:51 GMT
server: nginx
cross-origin-opener-policy: unsafe-none
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: image/webp
cache-control: max-age=31536000, public
permissions-policy: accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), battery=(self), camera=(self), cross-origin-isolated=(self), display-capture=(self), document-domain=*, encrypted-media=(self), execution-while-not-rendered=*, execution-while-out-of-viewport=*, fullscreen=*, geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), midi=(self), navigation-override=(self), payment=(self), picture-in-picture=*, publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=*, usb=(self), web-share=(self), xr-spatial-tracking=(self)
expires: Thu, 01 May 2025 02:09:43 GMT

GET
H2 200 logo-white-VeF9EwMy.svg
claroty.com/build/assets/ 2 KB
1 KB 117ms
103ms Image
image/svg+xml 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://claroty.com/build/assets/logo-white-VeF9EwMy.svg

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

95cbdd8d48ccc73ee5d0c5aba8bca4485b7fc0b58713923e92b97a325fc68538

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 01 May 2024 00:23:45 GMT
server: nginx
etag: W/"66318b91-9d1"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-xss-protection: 1; mode=block

GET
H3 200 v2.js Show response
js.hsforms.net/forms/embed/ 482 KB
155 KB 85ms
38ms Script
application/javascript 104.18.142.119
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsforms.net/forms/embed/v2.js

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.142.119 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f171db8dc0eb7cec86c84ceac278dbf2fbe33770334635a2703186d14f4828b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
age: 472
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.5064/bundles/project-v2.js&cfRay=87cc2f9f7e7b928f-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"b0047a8901d8ed9f81db3dcb5982114e"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=600, max-age=300
x-hs-target-asset: forms-embed/static-1.5064/bundles/project-v2.js
date: Wed, 01 May 2024 02:09:43 GMT
x-amz-version-id: 4lHA5dnNobe4YqKec9CE2kPtPUzRSBNR
via: 1.1 e21fbbed60133ff896ee44224814dc5c.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: 060fda25-6163-4ec6-9c45-2a1c660e4530
x-cache: Hit from cloudfront
cache-tag: staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 3
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 060fda25-6163-4ec6-9c45-2a1c660e4530
last-modified: Wed, 03 Apr 2024 11:15:05 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0C4nKZ%2BQi7QNPfLEV60zKkS4%2FrEvLd0zvWbfvFSrq%2F5sJBqEBzmHBSD5oFGA6gqdzFve77RQCHH%2BrNbqRaVj%2FHUE3iefr1e00%2FsUIuP2jufv7u%2FyqGj4DDZZ7ZKASt6W"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-6zsl2
cf-ray: 87cc3b25ae9c9b9a-FRA
x-amz-cf-id: MynhNeeFG45rM_gHzcLNE6v-y53-fo_nXeTeUJtIFx5dSlqb77BBXg==

GET
H2 200 da9381b325.js Show response
kit.fontawesome.com/ 12 KB
5 KB 540ms
453ms Script
text/javascript 2606:4700:4400::6812:2844
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kit.fontawesome.com/da9381b325.js
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2844 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d269e745735d0cff621fefc03710777c918f02475e693312e49164ee589105d7

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Origin: https://claroty.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
server: cloudflare
vary: origin, accept-encoding, access-control-request-headers, access-control-request-method
access-control-max-age: 3000
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
content-type: text/javascript
cache-control: max-age=60, public, stale-while-revalidate=30
cf-ray: 87cc3b25e8143809-FRA
access-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-token
x-request-id: F8mhQQu8H-cXzekAPeFi

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 257 KB
89 KB 110ms
51ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MWHFVG2

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9600404b242858220ce49132ebaae202d5c039e1bddd0c80a19c76c92f0bf97b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 90681
x-xss-protection: 0
last-modified: Wed, 01 May 2024 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 01 May 2024 02:09:43 GMT

GET
H2 200 proxima-nova-regular-DqkkgJcb.woff2
claroty.com/build/assets/ 29 KB
29 KB 109ms
105ms Font
font/woff2 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://claroty.com/build/assets/proxima-nova-regular-DqkkgJcb.woff2

Requested by

Host: claroty.com
URL: https://claroty.com/build/assets/claroty-DQfYO8Ga.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

c4d04d2b6a041dde11c80d8332f983a58c1031c663ab4f42230899cb82adf4a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://claroty.com/build/assets/claroty-DQfYO8Ga.css
Origin: https://claroty.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
x-content-type-options: nosniff
last-modified: Wed, 01 May 2024 00:23:45 GMT
server: nginx
etag: "66318b91-747c"
x-frame-options: SAMEORIGIN
content-type: font/woff2
accept-ranges: bytes
content-length: 29820
x-xss-protection: 1; mode=block

GET
H2 200 proxima-nova-semibold-CrIMIJZE.woff2
claroty.com/build/assets/ 29 KB
29 KB 109ms
106ms Font
font/woff2 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://claroty.com/build/assets/proxima-nova-semibold-CrIMIJZE.woff2

Requested by

Host: claroty.com
URL: https://claroty.com/build/assets/claroty-DQfYO8Ga.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

b07871da02311868c31ab6ac5a4e78cc877f118acd854857f6f51519f3ddbbc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://claroty.com/build/assets/claroty-DQfYO8Ga.css
Origin: https://claroty.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
x-content-type-options: nosniff
last-modified: Wed, 01 May 2024 00:23:45 GMT
server: nginx
etag: "66318b91-7444"
x-frame-options: SAMEORIGIN
content-type: font/woff2
accept-ranges: bytes
content-length: 29764
x-xss-protection: 1; mode=block

GET
H2 200 proxima-nova-bold-BEWb3vsP.woff2
claroty.com/build/assets/ 30 KB
30 KB 272ms
268ms Font
font/woff2 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://claroty.com/build/assets/proxima-nova-bold-BEWb3vsP.woff2

Requested by

Host: claroty.com
URL: https://claroty.com/build/assets/claroty-DQfYO8Ga.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

a33128c94dd3c425bc3f4a9ba389a1f3d7a75233e8cb788ea80f8f43a3d68423

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://claroty.com/build/assets/claroty-DQfYO8Ga.css
Origin: https://claroty.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
x-content-type-options: nosniff
last-modified: Wed, 01 May 2024 00:23:45 GMT
server: nginx
etag: "66318b91-77f0"
x-frame-options: SAMEORIGIN
content-type: font/woff2
accept-ranges: bytes
content-length: 30704
x-xss-protection: 1; mode=block

GET
H2 200 proxima-nova-regular-italic-CMAA4I7g.woff2
claroty.com/build/assets/ 31 KB
31 KB 283ms
280ms Font
font/woff2 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://claroty.com/build/assets/proxima-nova-regular-italic-CMAA4I7g.woff2

Requested by

Host: claroty.com
URL: https://claroty.com/build/assets/claroty-DQfYO8Ga.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

19be36b532c3147a005317cbc940c69b7137c7980a462525055393d3cfd20b30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://claroty.com/build/assets/claroty-DQfYO8Ga.css
Origin: https://claroty.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
x-content-type-options: nosniff
last-modified: Wed, 01 May 2024 00:23:45 GMT
server: nginx
etag: "66318b91-7b84"
x-frame-options: SAMEORIGIN
content-type: font/woff2
accept-ranges: bytes
content-length: 31620
x-xss-protection: 1; mode=block

GET
H2 200 YXNzZXRzL2ltYWdlNS0xNzEzOTAzMTExLnBuZw==
claroty.com/img/asset/ 76 KB
77 KB 291ms
291ms Image
image/webp 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://claroty.com/img/asset/YXNzZXRzL2ltYWdlNS0xNzEzOTAzMTExLnBuZw==?fm=webp&fit=crop&s=f6406614c28c99f97c68157a0f904f59

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

311c100c3e176440aefc6a48f418c6fd3c3376a88635139a7cfeecf6e75df43e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
content-security-policy: frame-ancestors 'self'; upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-permitted-cross-domain-policies: none
cross-origin-embedder-policy: unsafe-none
cross-origin-resource-policy: cross-origin
content-length: 78242
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 24 Apr 2024 14:13:25 GMT
server: nginx
cross-origin-opener-policy: unsafe-none
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: image/webp
cache-control: max-age=31536000, public
permissions-policy: accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), battery=(self), camera=(self), cross-origin-isolated=(self), display-capture=(self), document-domain=*, encrypted-media=(self), execution-while-not-rendered=*, execution-while-out-of-viewport=*, fullscreen=*, geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), midi=(self), navigation-override=(self), payment=(self), picture-in-picture=*, publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=*, usb=(self), web-share=(self), xr-spatial-tracking=(self)
expires: Thu, 01 May 2025 02:09:43 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 321 KB
105 KB 45ms
40ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-H6L2YY031Z&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MWHFVG2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

89673dacf492da62609243c2343edc8e06de4aa4f8cb69816e9be4676bc133b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 107614
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 01 May 2024 02:09:43 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 48 KB
17 KB 63ms
7ms Script
application/javascript 2a02:26f0:3500:16::215:148d
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MWHFVG2

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:16::215:148d Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

05dce95eaa2457f1ed9076e0d32b59680b654cf7ca6a4e35f3fe682c78f460b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-edgeconnect-origin-mex-latency: 635
date: Wed, 01 May 2024 02:09:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 30 Apr 2024 10:06:07 GMT
x-cdn: AKAM
x-edgeconnect-midmile-rtt: 0
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=28644
accept-ranges: bytes
content-length: 17038

GET
H2 200 hotjar-3443429.js Show response
static.hotjar.com/c/ 9 KB
4 KB 103ms
52ms Script
application/javascript 18.66.102.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-3443429.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MWHFVG2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.102.11 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-102-11.fra56.r.cloudfront.net

Software

Resource Hash

0ee301bb4dfa8f8612839b80394c8a5e3dc13148e00e45fa8da71e0c5d2df7ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
date: Wed, 01 May 2024 02:09:43 GMT
via: 1.1 666eddda46892ed48d8d771b6142ac24.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
etag: W/0d78127dc6d962ba7d1a4006d9249fed
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
cache-control: max-age=60
cross-origin-resource-policy: cross-origin
x-amz-cf-id: vOOtAzf1Key7oS9svLI5TRNKbxN_3pyl297_3XrQfu0fIrj-b91Mog==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 256 KB
87 KB 45ms
42ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11089250684

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MWHFVG2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

69d7113a84cea3d4ba23dfb384e3490c3fc2e5bb2da306706150c7528f4f41bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 89468
x-xss-protection: 0
last-modified: Wed, 01 May 2024 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 01 May 2024 02:09:43 GMT

GET
H2 200 oktrk.js Show response
static.oktopost.com/ 9 KB
4 KB 69ms
7ms Script
application/javascript 18.244.18.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.oktopost.com/oktrk.js
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.244.18.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-244-18-11.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 09016600a13dd4825b72516765a8da53d1ab896f7582c4619d014e8ee147ea84

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 30 Apr 2024 05:31:53 GMT
content-encoding: gzip
via: 1.1 3caf29bae8aa1020b6ba57a71bbb0880.cloudfront.net (CloudFront)
last-modified: Mon, 27 Jan 2020 09:47:41 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P11
age: 74271
etag: W/"57315c24d6fec75c4d46a8cc3fa6e0d5"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: 9Cfg80YLx_1ZWS7S8lg-f3RooFm6GeRaHT64VxjkAAQd9yPSNn4Apg==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 188 KB
69 KB 66ms
64ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-84224451-1

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MWHFVG2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b3a9850d5212490b6f3011359a7defb4e86e07e35d2a861b4a29decfe731c410

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 70044
x-xss-protection: 0
last-modified: Wed, 01 May 2024 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 01 May 2024 02:09:43 GMT

GET
H3 200 jilEnH5CqVK0j3M3GHR5 Show response
ws.zoominfo.com/pixel/ 0
646 B 228ms
200ms Script
text/javascript 104.16.118.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/jilEnH5CqVK0j3M3GHR5

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: Express
content-type: text/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
content-length: 0
cf-ray: 87cc3b26cfe39f22-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 20307279.js Show response
js.hs-scripts.com/ 2 KB
1 KB 190ms
141ms Script
application/javascript 2606:4700::6810:8cd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/20307279.js?businessUnitId=556099

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MWHFVG2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:8cd1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8a378481141454ad2f21c969a4225d83657df10f8b066d8f27f47e3b208a1915

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 4317f14e-23de-4142-bb35-ac051ff3d38e
x-envoy-upstream-service-time: 4
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 4317f14e-23de-4142-bb35-ac051ff3d38e
last-modified: Wed, 01 May 2024 01:53:05 GMT
server: cloudflare
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-5d47c8d44f-z2d7d
cache-control: public, max-age=90
access-control-allow-credentials: true
cf-ray: 87cc3b26eb769177-FRA
expires: Wed, 01 May 2024 02:11:13 GMT

GET
H2 200 6si.min.js Show response
j.6sc.co/ 65 KB
18 KB 91ms
21ms Script
application/javascript 2.17.100.193
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

95ef911fcf12dfe0a1fb5b17a3b24fa81c6b07b102b435949b06e7e124de51cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 01 May 2024 02:09:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 25 Apr 2024 23:17:01 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "662ae46d-10585"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 17942
expires: Wed, 01 May 2024 02:09:43 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5168721&time=1714529383525&url=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fexploiting-a-classic-deserialization-vulnerability-in-siemens-simat...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5168721&time=1714529383525&url=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fexploiting-a-classic-deserialization-vulnerability-in-siemens-sima...

0
265 B

241ms
164ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5168721&time=1714529383525&url=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fexploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager&e_ipv6=AQKP7vr62mAmgQAAAY8x6jTjxIXIXSwIw8G4CSE_h2o9k9zmnTKxqeNdynuKaSz6
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: C67695C753B343F989ABB6F751F2CE0A Ref B: FRAEDGE1120 Ref C: 2024-05-01T02:09:43Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYXWvriV5biQWISKV39ZQ==

Redirect headers

date: Wed, 01 May 2024 02:09:43 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: DFD86B32157647CA8589725C7746F1D1 Ref B: FRAEDGE1520 Ref C: 2024-05-01T02:09:43Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5168721&time=1714529383525&url=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fexploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager&e_ipv6=AQKP7vr62mAmgQAAAY8x6jTjxIXIXSwIw8G4CSE_h2o9k9zmnTKxqeNdynuKaSz6
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYXWvrefP6nFs15pP3EBw==

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
615 B 239ms
198ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: *
Referer
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: E46CF863134A44FD801B406E0074EBE9 Ref B: FRAEDGE1520 Ref C: 2024-05-01T02:09:43Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
access-control-allow-origin: https://claroty.com
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYXWvres+tWPYWVjDrhSA==

POST
H2 204 collect
region1.analytics.google.com/g/ 0
251 B 73ms
45ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-H6L2YY031Z&gtm=45je44t0v896979362z8847287713za200&_p=1714529383162&_gaz=1&gcd=13l3lPl2l1&npa=1&dma_cps=sypham&dma=1&cid=966332956.1714529384&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.78%7CGoogle%2520Chrome%3B124.0.6367.78%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_s=1&sid=1714529383&sct=1&seg=0&dl=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fexploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager&dt=Exploiting%20a%20Classic%20Deserialization%20Vulnerability%20in%20Siemens%20SIMATIC%20Energy%20Manager%20%7C%20Claroty&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=921
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-H6L2YY031Z&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 01 May 2024 02:09:43 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://claroty.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
251 B 103ms
23ms Ping
text/plain 2a00:1450:400c:c00::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-H6L2YY031Z&cid=966332956.1714529384&gtm=45je44t0v896979362z8847287713za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3lPl2l1&npa=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-H6L2YY031Z&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 01 May 2024 02:09:43 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://claroty.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 78ms
51ms Image
image/gif 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-H6L2YY031Z&cid=966332956.1714529384&gtm=45je44t0v896979362z8847287713za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3lPl2l1&npa=1&z=1637671597

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 01 May 2024 02:09:43 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ping Show response
okt.to/ 0
100 B 348ms
104ms Script
text/javascript 23.22.90.252
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://okt.to/ping?uri=%2Fteam82%2Fresearch%2Fexploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager&aid=00143q1r49z36ol&ts=1714529383593

Requested by

Host: static.oktopost.com
URL: https://static.oktopost.com/oktrk.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.22.90.252 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-23-22-90-252.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
strict-transport-security: max-age=31536000;
content-type: text/javascript;charset=UTF-8

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 69ms
12ms Script
text/javascript 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-84224451-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 01 May 2024 01:41:03 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 1720
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Wed, 01 May 2024 03:41:03 GMT

GET
H2 200 modules.ea82878fb17f83fbe8a6.js Show response
script.hotjar.com/ 221 KB
55 KB 85ms
25ms Script
application/javascript 13.32.27.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.ea82878fb17f83fbe8a6.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-3443429.js?sv=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.27.21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-27-21.fra56.r.cloudfront.net

Software

Resource Hash

009c688b6b2b336eeffafab5ea0ae57b757e4d85c84d736d365f1ef76611d5cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 29 Apr 2024 16:18:06 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 22b9ddafebf39d72780d68dad970d218.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 121897
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 55730
last-modified: Mon, 29 Apr 2024 16:17:48 GMT
etag: "3609047e81f8808d481c085e4a20567a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: yOTqkSwE_dY8Rc7vkMwJUcrctX8c-A01NltoW7hOOZ-8B2EsLRfIHg==

GET
H2 200 collectedforms.js Show response
js.hscollectedforms.net/ 69 KB
25 KB 175ms
125ms Script
application/javascript 2606:4700::6810:6efe
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hscollectedforms.net/collectedforms.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/20307279.js?businessUnitId=556099

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:6efe , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5c76dd89a767afd512ce6c6370424f39a632ebb736c16ac37952fbfd97575448

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Origin: https://claroty.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
x-amz-version-id: _rd02ux3UWoVQsATQDf.p_LxkLPJ6umh
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-amz-cf-pop: IAD12-P3
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: ebb2834d-e3a6-4e3f-8343-8ffbf65be661
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.491/bundles/project.js&cfRay=87cc3b2819091961-FRA
x-cache: Hit from cloudfront
cache-tag: staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
content-encoding: br
x-envoy-upstream-service-time: 1
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: ebb2834d-e3a6-4e3f-8343-8ffbf65be661
last-modified: Wed, 10 Apr 2024 18:06:23 UTC
server: cloudflare
etag: W/"020909a609cf986b4a8a88cfb577a8db"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
x-hs-cache-status: HIT
cache-control: s-maxage=600, max-age=300
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-gxvrq
cf-ray: 87cc3b2819091961-FRA
x-amz-cf-id: OnbqFwpgmXh3HsF2vJtUe4snMlrf9KW1vFF2JcGfI9z3i7Qy1eMwig==
x-hs-target-asset: collected-forms-embed-js/static-1.491/bundles/project.js

GET
H2 200 banner.js Show response
js.hs-banner.com/v2/20307279/ 82 KB
24 KB 298ms
294ms Script
text/javascript 2606:4700:4400::6812:22e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/20307279/banner.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/20307279.js?businessUnitId=556099
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:22e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 56fd6ac00de2e21a09cbd192538fa98e5760d347064942418aa32b146cfa0444

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
x-amz-version-id: HcRbkkXUT._iAsAXuhu0xw7p19klPIVQ
content-encoding: br
cf-cache-status: REVALIDATED
x-amz-request-id: YKNDRJ1QR4KY7N7R
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 0f68fb51-e6ce-48f8-b946-c3f3522ef65a
x-envoy-upstream-service-time: 20
x-amz-id-2: ZvZMogiGVQQv5tukyveaa0cEQPBSFvvCInFNVe35TDZ/JdCw19Jxmk+Dg9/vMtTkC+J7WZyZaoo=
x-evy-trace-listener: listener_https
x-request-id: 0f68fb51-e6ce-48f8-b946-c3f3522ef65a
x-evy-trace-route-configuration: listener_https/all
last-modified: Mon, 15 Apr 2024 15:54:04 GMT
server: cloudflare
etag: W/"879f40e9082bd4c6346f691422ba36c5"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://nexusconnect.io
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6685c9958f-pvzd8
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 87cc3b27df1a913d-FRA
expires: Wed, 01 May 2024 02:14:43 GMT

GET
H2 200 20307279.js Show response
js.hs-analytics.net/analytics/1714529100000/ 67 KB
21 KB 208ms
159ms Script
text/javascript 2606:4700::6811:afc9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1714529100000/20307279.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/20307279.js?businessUnitId=556099
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:afc9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7b73a181d4be4b38c97190012e94e39457a8471bfd777f99f1641d83d4e72133

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
x-amz-version-id: null
content-encoding: br
cf-cache-status: MISS
x-amz-request-id: RBNFPHAJKQGXB38J
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 81da467c-d8af-4e5e-8547-093706475a7e
x-envoy-upstream-service-time: 27
x-amz-id-2: F+rv0dpj2FHMA8Q8RrO2EibGSS0xsypcJColxP0627gN6wBrHYg5CLXC6/p/JZsVvLDv/xgfkRQ=
x-evy-trace-listener: listener_https
x-request-id: 81da467c-d8af-4e5e-8547-093706475a7e
x-evy-trace-route-configuration: listener_https/all
last-modified: Wed, 24 Apr 2024 18:40:15 GMT
server: cloudflare
etag: W/"8a09cc9adeccc2c0a9ad239bc72f7fc7"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-78cb6f459b-8vwdw
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 87cc3b2818353602-FRA
expires: Wed, 01 May 2024 02:14:43 GMT

GET
H2 200 web-interactives-embed.js Show response
js.hubspot.com/ 82 KB
25 KB 185ms
152ms Script
application/javascript 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hubspot.com/web-interactives-embed.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/20307279.js?businessUnitId=556099

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e8903e555bd60b3e66725a7316fa1c399c1c330b6f207dfbf294e287857d526c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Origin: https://claroty.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.1087/bundles/project.js&cfRay=87cc3b28181165d4-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"aca27b624bf30d36e5f4f145ae76704a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-hs-target-asset: web-interactives-embed/static-2.1087/bundles/project.js
date: Wed, 01 May 2024 02:09:43 GMT
x-amz-version-id: iqAR5gkkMAkFd.Z3L05RGWJk1d1nl__E
via: 1.1 7c77abdf1c625c25627fe2a24e660a34.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: EXPIRED
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: b7d82897-c78a-4f2c-8d03-b8077e30d577
x-cache: Hit from cloudfront
cache-tag: staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 0
x-evy-trace-route-configuration: listener_https/all
x-request-id: b7d82897-c78a-4f2c-8d03-b8077e30d577
last-modified: Fri, 26 Apr 2024 11:14:32 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=12NMHKEqzCV%2FCJfJ9FRLigFkDvqi072bEyimb%2FOgTd7hRWR6hPsek%2FP6%2FYYfJGkLhsqNHSGnPiRBIWcWOxTBbPJYTEPWOXvmMirPe4ku1RIiD32AslesHSop4NGiHoZKijhfXLXZQXc8GJAK"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-7rrlj
cf-ray: 87cc3b28181165d4-FRA
x-amz-cf-id: c_5eg6QSC0EbEfTcj-nki3QpwID5eAKg4MuGc3muwVUEEcf17OE4kw==

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 6 KB
4 KB 77ms
30ms Script
application/javascript 2606:4700::6811:80ac
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsadspixel.net/fb.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/20307279.js?businessUnitId=556099

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:80ac , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1c67d8ce90160a6586cfd2c2a936959738f5b1843ebdfbac4325c4d1a9b61224

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
x-amz-version-id: H75lIw.llLd5LbqLQfJpi4qQ6NOhCtlN
via: 1.1 f01dafb3bec9893b47152910d47900a4.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
age: 112
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.551/bundles/pixels-release.js&cfRay=87cc38686aff5b8c-FRA
x-cache: Hit from cloudfront
x-hubspot-correlation-id: 2dcabc10-5ca0-4d44-bb9f-85b203228225
cache-tag: staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
content-encoding: br
x-envoy-upstream-service-time: 1
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 2dcabc10-5ca0-4d44-bb9f-85b203228225
last-modified: Fri, 19 Apr 2024 14:01:51 UTC
server: cloudflare
etag: W/"65a4cdf8f8c613ea8f766101eea8e667"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-6q8hm
cf-ray: 87cc3b284c283635-FRA
x-amz-cf-id: FxwgnIKOfg1mImNP5denKZ16JblxVZ8qBEP3JP2SN9TWDhudiEocqQ==
x-hs-target-asset: adsscriptloaderstatic/static-1.551/bundles/pixels-release.js

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
204 B 28ms
28ms XHR
text/plain 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1814380388&t=pageview&_s=1&dl=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fexploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager&ul=de-de&de=UTF-8&dt=Exploiting%20a%20Classic%20Deserialization%20Vulnerability%20in%20Siemens%20SIMATIC%20Energy%20Manager%20%7C%20Claroty&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=1645274710&gjid=1575776423&cid=966332956.1714529384&tid=UA-84224451-1&_gid=557169623.1714529384&_r=1&gtm=457e44t0za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&jsscut=1&npa=1&z=714121901

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 01 May 2024 02:09:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://claroty.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
151 B 53ms
52ms XHR
text/plain 2a00:1450:400c:c00::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-84224451-1&cid=966332956.1714529384&jid=1645274710&gjid=1575776423&_gid=557169623.1714529384&npa=1&_u=YADAAUAAAAAAACAAI~&z=1286215910

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Wed, 01 May 2024 02:09:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://claroty.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pro.min.js Show response
ka-p.fontawesome.com/releases/v6.5.2/js/ 60 KB
18 KB 45ms
36ms Fetch
application/javascript 2606:4700:4400::6812:2844
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/js/pro.min.js?token=da9381b325
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/da9381b325.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2844 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 24b19f3adb4b93ae4e7c14e7fc2b17ffa34ca6a03518b7b0fc18117b8c9ee214

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:26:27 GMT
server: cloudflare
age: 2350590
etag: "660c23a3-4581"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 87cc3b28c9913809-FRA
content-length: 17793

GET
H3 200 json Show response
forms.hsforms.com/embed/v3/form/20307279/4ec0d86c-87f7-4863-8c01-93bea20ffd85/ 11 KB
4 KB 199ms
155ms XHR
application/json 104.19.175.188
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hsforms.com/embed/v3/form/20307279/4ec0d86c-87f7-4863-8c01-93bea20ffd85/json?hs_static_app=forms-embed&hs_static_app_version=1.5064&X-HubSpot-Static-App-Info=forms-embed-1.5064

Requested by

Host: js.hsforms.net
URL: https://js.hsforms.net/forms/embed/v2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.175.188 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8bdf6c5644f0beca06c84c2a3b02f6079f5981b995a3a1d33fd66f0999c4d545

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept: application/json, text/plain, */*
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-origin-hublet: na1
date: Wed, 01 May 2024 02:09:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: a3fcacaa-c5fc-4cc9-8d17-8eacfacd38c6
x-envoy-upstream-service-time: 25
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: a3fcacaa-c5fc-4cc9-8d17-8eacfacd38c6
server: cloudflare
vary: origin
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-allow-origin: https://claroty.com
x-evy-trace-virtual-host: all
access-control-expose-headers: X-Origin-Hublet
access-control-max-age: 180
access-control-allow-credentials: false
cache-control: max-age=0, no-cache, no-store
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 87cc3b291cb53631-FRA
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-9fd6b4b-47s2n

GET
H2 204 3443429 Show response
vc.hotjar.io/sessions/ 0
231 B 121ms
36ms XHR
text/plain 18.66.112.110
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vc.hotjar.io/sessions/3443429?s=0.25&r=0.13113413429971899
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.112.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-112-110.fra56.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: *
date: Wed, 01 May 2024 02:09:43 GMT
cache-control: no-store
via: 1.1 0afa2d721972ae312ad1dd54e47c43ca.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
x-amz-cf-id: jGlbSH7henMKDTXsJpm4H34PkY5LY_sdeTvu1AFxAOo4Xc1nwAsdVg==
x-cache: Miss from cloudfront

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 105ms
25ms Image
image/gif 172.217.18.4
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-84224451-1&cid=966332956.1714529384&jid=1645274710&npa=1&_u=YADAAUAAAAAAACAAI~&z=1933852867

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.4 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 01 May 2024 02:09:43 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 40ms
36ms Image
image/gif 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-84224451-1&cid=966332956.1714529384&jid=1645274710&npa=1&_u=YADAAUAAAAAAACAAI~&z=1933852867

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 01 May 2024 02:09:43 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 json Show response
forms.hscollectedforms.net/collected-forms/v1/config/ 116 B
431 B 137ms
123ms XHR
application/json 2606:4700::6810:6efe
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=20307279&utk=

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:6efe , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

943ded0a2adddb140465921e9f3a050f1fb064974efebe3ef311e9e75b6a2fa5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept: application/json, text/plain, */*
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 4a6c071f-d273-4bc1-9505-537cc10316b5
x-envoy-upstream-service-time: 7
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 4a6c071f-d273-4bc1-9505-537cc10316b5
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://claroty.com
x-evy-trace-virtual-host: all
cache-control: max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-z4v48
access-control-max-age: 180
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 87cc3b2929821961-FRA

GET
H2 200 plus.svg Show response
ka-p.fontawesome.com/releases/v6.5.2/svgs/regular/ 429 B
374 B 36ms
32ms Fetch
image/svg+xml 2606:4700:4400::6812:2844
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/svgs/regular/plus.svg?token=da9381b325
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2844 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c33c3b4654450ad9afe9d9cb1da4e2ad8f2b601218d4015da547331079865976

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:33:19 GMT
server: cloudflare
age: 2349280
etag: W/"660c253f-1ad"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 87cc3b2929d53809-FRA

GET
H2 200 linkedin.svg Show response
ka-p.fontawesome.com/releases/v6.5.2/svgs/brands/ 672 B
531 B 34ms
30ms Fetch
image/svg+xml 2606:4700:4400::6812:2844
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/svgs/brands/linkedin.svg?token=da9381b325
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2844 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 655460488a4e86be0c0adbd0af8f537bcc1f077f261f3e95ff8e213af3b33e39

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:26:33 GMT
server: cloudflare
age: 2350589
etag: W/"660c23a9-2a0"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 87cc3b2929d63809-FRA

GET
H2 200 square-x-twitter.svg Show response
ka-p.fontawesome.com/releases/v6.5.2/svgs/brands/ 510 B
446 B 40ms
36ms Fetch
image/svg+xml 2606:4700:4400::6812:2844
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/svgs/brands/square-x-twitter.svg?token=da9381b325
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2844 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4d9d9af17df221748b0e58108771b9aa312a7b1caa789e60ccf9167a0e10f420

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:26:36 GMT
server: cloudflare
age: 2350589
etag: W/"660c23ac-1fe"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 87cc3b2929d73809-FRA

GET
H2 200 facebook.svg Show response
ka-p.fontawesome.com/releases/v6.5.2/svgs/brands/ 516 B
450 B 37ms
33ms Fetch
image/svg+xml 2606:4700:4400::6812:2844
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/svgs/brands/facebook.svg?token=da9381b325
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2844 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 43b962bc3ef0ddc52398c669a6344d1d78954017cd297f5f95654f71a16cd8e9

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:26:31 GMT
server: cloudflare
age: 2350589
etag: W/"660c23a7-204"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 87cc3b2929d83809-FRA

GET
H2 200 envelope.svg Show response
ka-p.fontawesome.com/releases/v6.5.2/svgs/regular/ 567 B
463 B 39ms
35ms Fetch
image/svg+xml 2606:4700:4400::6812:2844
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/svgs/regular/envelope.svg?token=da9381b325
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2844 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0ede3ffda856f66ed7d3685f59716dfec3a38aedf5701ad54125d8b8889ba572

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:32:52 GMT
server: cloudflare
age: 325375
etag: W/"660c2524-237"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 87cc3b2929d93809-FRA

GET
H2 200 youtube.svg Show response
ka-p.fontawesome.com/releases/v6.5.2/svgs/brands/ 718 B
505 B 37ms
34ms Fetch
image/svg+xml 2606:4700:4400::6812:2844
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/svgs/brands/youtube.svg?token=da9381b325
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2844 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e02675c0b58e43a34fbc81fed80ec2798deb5ddae78a16f9dd5e0e82e84b598a

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:26:47 GMT
server: cloudflare
age: 2350589
etag: W/"660c23b7-2ce"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 87cc3b2929da3809-FRA

GET
H2 200 xmark-large.svg Show response
ka-p.fontawesome.com/releases/v6.5.2/svgs/regular/ 478 B
397 B 41ms
38ms Fetch
image/svg+xml 2606:4700:4400::6812:2844
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/svgs/regular/xmark-large.svg?token=da9381b325
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2844 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 962c60f1e79f0ca16e7142d53a2eae2ec60d33071a306d010e25cfc262a652c4

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:34:54 GMT
server: cloudflare
age: 2350589
etag: W/"660c259e-1de"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 87cc3b2929dc3809-FRA

GET
H2 200 angle-down.svg Show response
ka-p.fontawesome.com/releases/v6.5.2/svgs/solid/ 416 B
368 B 38ms
37ms Fetch
image/svg+xml 2606:4700:4400::6812:2844
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/svgs/solid/angle-down.svg?token=da9381b325
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2844 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 17cfde48999dcfe173e106d30c3f9f329e6558a1db1fc032876589ec516945f3

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:45:58 GMT
server: cloudflare
age: 2350589
etag: W/"660c2836-1a0"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 87cc3b2929de3809-FRA

GET
H2 200 search.svg Show response
ka-p.fontawesome.com/releases/v6.5.2/svgs/regular/ 483 B
408 B 40ms
39ms Fetch
image/svg+xml 2606:4700:4400::6812:2844
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/svgs/regular/search.svg?token=da9381b325
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2844 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 13f3849bcb0803d10f69b84c0c9be9b935ec89306a9e370365629fbe1eb20e37

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:43 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:33:23 GMT
server: cloudflare
age: 2350589
etag: W/"660c2543-1e3"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 87cc3b2929df3809-FRA

GET
H2 200 combinedConfigs Show response
cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/ 433 B
1 KB 146ms
134ms Fetch
application/json 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=20307279&currentUrl=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fexploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager

Requested by

Host: js.hubspot.com
URL: https://js.hubspot.com/web-interactives-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b4bf8910a202b24bd61be26e28eaa8c5f83a48d78999b2693a9cbdf4c9910cf1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 26e6d255-0606-4915-aa8a-d600ec06acd5
content-encoding: br
x-envoy-upstream-service-time: 9
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 26e6d255-0606-4915-aa8a-d600ec06acd5
server: cloudflare
vary: origin
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-allow-origin: https://claroty.com
x-evy-trace-virtual-host: all
access-control-max-age: 180
access-control-allow-credentials: true
cache-control: max-age=0, no-cache, no-store
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XdFI4J%2BCyEK4vaOg80%2F3a8A5P0l4aL6PHkH7gL62yrHn%2FS5hcU4YF4G2ni6CrqpdrnJRYWflXbuPZ0pobFCMnu9kitSYp2%2FUZ7QGeg1NJs%2F7vBjHqWglXaA5Y87qZp5JkdEkYslLiIhgRorYwHKYHUmUgQM6dripgag%3D"}],"group":"cf-nel","max_age":604800}
x-robots-tag: noindex, follow
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 87cc3b2968c865d4-FRA
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-9fd6b4b-vs9qc

OPTIONS
H2 200 view
js.hs-banner.com/v2/activity/ 0
0 319ms
278ms Preflight
application/octet-stream 2606:4700:4400::6812:22e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/activity/view
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:22e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://claroty.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
access-control-allow-origin: https://claroty.com
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
access-control-max-age: 604800
cf-cache-status: DYNAMIC
cf-ray: 87cc3b2a0afe9765-FRA
content-length: 0
content-type: application/octet-stream
date: Wed, 01 May 2024 02:09:44 GMT
server: cloudflare
timing-allow-origin: *
vary: origin
x-envoy-upstream-service-time: 0
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-78cb6f459b-mnhbz
x-evy-trace-virtual-host: all
x-hubspot-correlation-id: 2d269ab9-667e-4c8f-8abb-3d73ec5ce5f5
x-request-id: 2d269ab9-667e-4c8f-8abb-3d73ec5ce5f5

GET
H2 200 css2
fonts.googleapis.com/ 2 KB
865 B 72ms
29ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Lato:ital,wght@0,400;0,700;1,400&display=swap

Requested by

Host: js.hs-banner.com
URL: https://js.hs-banner.com/v2/20307279/banner.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fba31c2cd9699431dba47604216525f9bcc0cb1d5980fbae9b19c8b86454d2fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Wed, 01 May 2024 02:09:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 01 May 2024 01:15:24 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 01 May 2024 02:09:44 GMT

POST
H2 204 view
js.hs-banner.com/v2/activity/ 0
0 129ms
129ms Fetch 2606:4700:4400::6812:22e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-banner.com/v2/activity/view

Requested by

Host: js.hs-banner.com
URL: https://js.hs-banner.com/v2/20307279/banner.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:22e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 01 May 2024 02:09:44 GMT
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator, envoyset-translator
x-hubspot-correlation-id: 632104ca-f521-4991-9c5f-4fdc5ca10181
x-envoy-upstream-service-time: 25
x-evy-trace-route-configuration: listener_http/all, listener_https/all
x-evy-trace-listener: listener_http, listener_https
x-request-id: 632104ca-f521-4991-9c5f-4fdc5ca10181
server: cloudflare
vary: origin
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-evy-trace-virtual-host: all, all
x-evy-trace-served-by-pod: iad02/private-hubapi-td/envoy-proxy-5f998ff6dc-zxq29, iad02/analytics-js-proxy-td/envoy-proxy-78cb6f459b-fjl8n
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
access-control-allow-origin: https://claroty.com
access-control-allow-credentials: true
access-control-max-age: 604800
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 87cc3b2bcc2c9765-FRA

GET
H3 200 counters.gif
forms.hsforms.com/embed/v3/ 35 B
883 B 143ms
122ms Image
image/gif 104.19.175.188
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.175.188 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: d5f3213e-a3b0-40da-9182-c5b36190f859
x-envoy-upstream-service-time: 5
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: d5f3213e-a3b0-40da-9182-c5b36190f859
server: cloudflare
vary: origin
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-9fd6b4b-bjzx5
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 87cc3b2a38ea9100-FRA

GET
H3 200 counters.gif
forms.hsforms.com/embed/v3/ 35 B
848 B 130ms
124ms Image
image/gif 104.19.175.188
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.175.188 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: d48f3f75-c8c8-4b29-a546-9b99b5761a07
x-envoy-upstream-service-time: 8
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: d48f3f75-c8c8-4b29-a546-9b99b5761a07
server: cloudflare
vary: origin
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-9fd6b4b-47s2n
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 87cc3b2a38e99100-FRA

GET
H3 200 counters.gif
forms-na1.hsforms.com/embed/v3/ 35 B
848 B 156ms
128ms Image
image/gif 104.18.80.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.80.204 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: f5a3ec7b-1235-49f3-b374-a3c582417876
x-envoy-upstream-service-time: 15
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: f5a3ec7b-1235-49f3-b374-a3c582417876
server: cloudflare
vary: origin
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-9fd6b4b-844hl
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 87cc3b2a69d903e4-FRA

GET
H3 200 counters.gif
perf-na1.hsforms.com/embed/v3/ 35 B
926 B 153ms
121ms Image
image/gif 104.18.80.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.80.204 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 8a9a5c68-3e42-4be9-85d0-1d9055f70299
x-envoy-upstream-service-time: 2
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 8a9a5c68-3e42-4be9-85d0-1d9055f70299
last-modified: Wed, 01 May 2024 02:09:44 GMT
server: cloudflare
vary: origin, Accept-Encoding
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-9fd6b4b-cq4g8
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
accept-ranges: bytes
x-robots-tag: none
cf-ray: 87cc3b2a79df03e4-FRA

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
24 KB 46ms
11ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Lato:ital,wght@0,400;0,700;1,400&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fonts.googleapis.com/
Origin: https://claroty.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 30 Apr 2024 08:02:21 GMT
x-content-type-options: nosniff
age: 65243
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23580
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 30 Apr 2025 08:02:21 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
190 B 31ms
23ms XHR
text/html 2.17.100.193
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-193.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:44 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://claroty.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 14 B
296 B 78ms
12ms XHR
text/html 2a02:26f0:ab00::214:8e70
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:ab00::214:8e70 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 73580a6ba6705b61499bf9b4661f1b50c4f78e8c72b65ce30df43546e7f58e6f

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 01 May 2024 02:09:44 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://claroty.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2a01:4a0:2b::5
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1714529384240_34901612_89267701_25_863_13_29_219";dur=1
content-length: 14
expires: Wed, 01 May 2024 02:09:44 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 121ms
113ms Image
image/gif 2.17.100.193
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=1a8619a294ad37fe81fcb7766ed37dc1&svisitor=null&visitor=8f795a1f-e594-44c8-8b0f-fe2d8cca1c32&session=cda14059-72ba-462b-8443-021ea213042d&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2001%20May%202024%2002%3A09%3A43%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Team82%20disclosed%20to%20Siemens%20a%20deserialization%20vulnerability%20found%20in%20its%20SIMATIC%20Energy%20Manager%20(EnMPro)%20productThe%20vulnerability%2C%20CVE-2022-23450%2C%20was%20assessed%20a%20CVSS%20v3%20score%20of%2010.0%2C%20the%20highest%20criticality%20score%20possible%3B%20given%20the%20severity%20of%20the%20vulnerability%2C%20Team82%20has%20chosen%20to%20delay%20disclosing%20any%20technical%20d...%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Exploiting%20a%20Classic%20Deserialization%20Vulnerability%20in%20Siemens%20SIMATIC%20Energy%20Manager%20%7C%20Claroty%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fexploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager&pageViewId=48501f8e-fccc-4d09-8ac6-6b27626f524f&v=1.1.18

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 01 May 2024 02:09:44 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 01 May 2024 02:09:44 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 122ms
114ms Image
image/gif 2.17.100.193
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=1a8619a294ad37fe81fcb7766ed37dc1&svisitor=null&visitor=8f795a1f-e594-44c8-8b0f-fe2d8cca1c32&session=cda14059-72ba-462b-8443-021ea213042d&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2001%20May%202024%2002%3A09%3A43%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%221a8619a294ad37fe81fcb7766ed37dc1%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2001%20May%202024%2002%3A09%3A43%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2001%20May%202024%2002%3A09%3A43%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2001%20May%202024%2002%3A09%3A43%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2001%20May%202024%2002%3A09%3A43%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22Ask-your-CSM-for-a-token%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2001%20May%202024%2002%3A09%3A43%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Team82%20disclosed%20to%20Siemens%20a%20deserialization%20vulnerability%20found%20in%20its%20SIMATIC%20Energy%20Manager%20(EnMPro)%20productThe%20vulnerability%2C%20CVE-2022-23450%2C%20was%20assessed%20a%20CVSS%20v3%20score%20of%2010.0%2C%20the%20highest%20criticality%20score%20possible%3B%20given%20the%20severity%20of%20the%20vulnerability%2C%20Team82%20has%20chosen%20to%20delay%20disclosing%20any%20technical%20d...%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Exploiting%20a%20Classic%20Deserialization%20Vulnerability%20in%20Siemens%20SIMATIC%20Energy%20Manager%20%7C%20Claroty%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fexploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager&pageViewId=48501f8e-fccc-4d09-8ac6-6b27626f524f&v=1.1.18

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 01 May 2024 02:09:44 GMT
x-content-type-options: nosniff
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 01 May 2024 02:09:44 GMT

GET
H3 200 zi-tag.js Show response
js.zi-scripts.com/ 9 KB
3 KB 69ms
34ms Script
application/javascript 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/zi-tag.js
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7914b5c306a51678e7d777317f64c95d31437c47344063ec422c6bb2b4d9d718

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:44 GMT
x-amz-version-id: dVMibCEMTCuxskBoUeMfPfbdoSsUE0a9
content-encoding: gzip
cf-cache-status: DYNAMIC
via: 1.1 f8f9f25f837c0ce4e62b6d917642b56a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 72397
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 17 Apr 2024 10:26:25 GMT
server: cloudflare
etag: W/"20a410e0e98a302abb9e907a2c7e0d10"
vary: Accept-Encoding
content-type: application/javascript
cf-ray: 87cc3b2b7f31bbc7-FRA
x-amz-cf-id: 2JNPoKnwlTJhX4EymOnAMCHLqxGkptKRoI7bkeerh0vijPRCuZLmSw==

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
752 B 194ms
140ms Image
image/gif 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=de-de&bfp=2492303821&v=1.1&a=20307279&rcu=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fexploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager&pu=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fexploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager&t=Exploiting+a+Classic+Deserialization+Vulnerability+in+Siemens+SIMATIC+Energy+Manager+%7C+Claroty&cts=1714529384205&rv=1&vi=fa13265435e63c138d603beff136243e&nc=true&ce=false&cc=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 0b025dfd-6373-456d-a6a3-e16ceb99549d
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 12
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 0b025dfd-6373-456d-a6a3-e16ceb99549d
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pwEHifhsWvOKYvcekALZh8qK0TyjpCN9uYEH8mhExLYxgMp9WG5GnZHNCNlM2xb8%2BN%2By8bSwCfba8t9thUzAnX7MMA8q7p1eVSmd%2F14uYp1q8GCy9X5ANSTNrDjInCeKcan0xZv3zEyJD5y%2BGttv"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-76d96f8b5d-dvtwx
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 87cc3b2bad353834-FRA
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
1 KB 184ms
133ms Image
image/gif 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=15&fi=4ec0d86c-87f7-4863-8c01-93bea20ffd85&fci=ef769f1a-ee2c-417a-86dc-c1c43ec348a4&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=de-de&bfp=2492303821&v=1.1&a=20307279&rcu=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fexploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager&pu=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fexploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager&t=Exploiting+a+Classic+Deserialization+Vulnerability+in+Siemens+SIMATIC+Energy+Manager+%7C+Claroty&cts=1714529384206&rv=1&vi=fa13265435e63c138d603beff136243e&nc=true&ce=false&cc=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 510fe192-60a7-4aab-b9f8-c034c00bfada
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 7
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 510fe192-60a7-4aab-b9f8-c034c00bfada
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jWI7qpn0adVlC6XOPyYwXsjvp0ZtVH2jyh%2FWVKYubRwjhWmgsHtHizRAqu%2BX6RAA%2BALv6EEUbZ%2BZ%2Frl2IQPvr7y9pibXf02fKk5xw2F2DbfhK%2B8eGFc1msKa%2BObf9rJ9nV72S%2BWMqBFBlCZ4CpWX"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-76d96f8b5d-rvp98
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 87cc3b2bad343834-FRA
x-robots-tag: none

GET
H2 200 favicon.svg
claroty.com/img/ 1 KB
909 B 91ms
91ms Other
image/svg+xml 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://claroty.com/img/favicon.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

95401ddb551c7b54e882e38efaf5e19905478635b8f0566f71f4ba8aa40f9e1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 16 Mar 2023 23:39:46 GMT
server: nginx
etag: W/"6413a8c2-51b"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-xss-protection: 1; mode=block

GET
H3 200 getSubscriptions Show response
js.zi-scripts.com/unified/v1/master/ 195 B
556 B 479ms
478ms Fetch
application/json 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: b7562ea661a7229efcf432395eb9154fd9f42af68de27553b983c4f37285aa36

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
Authorization: Bearer f677a162dd1677780802
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/json
Referer
visited_url: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager

Response headers

date: Wed, 01 May 2024 02:09:44 GMT
via: 1.1 5519a8cb450b567e8b7111ae986a9b4c.cloudfront.net (CloudFront)
content-encoding: gzip
cf-cache-status: DYNAMIC
x-amz-cf-pop: FRA56-P4
x-powered-by: Express
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400
apigw-requestid: XEagbgghPHcEMcw=
server: cloudflare
etag: W/"c3-Mr2Uz7ip/sVDkjg9d2LT0h3+Dtw"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cf-ray: 87cc3b2d2f18bb65-FRA
x-amz-cf-id: f73hsQlYpnRLAiVKSnMbeINt-TcGnZAtRETx9lZS9N6-PityONawfA==

OPTIONS
H3 204 getSubscriptions
js.zi-scripts.com/unified/v1/master/ 0
0 232ms
204ms Preflight 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,visited_url
Access-Control-Request-Method: GET
Origin: https://claroty.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *
access-control-max-age: 0
alt-svc: h3=":443"; ma=86400
apigw-requestid: XEagWgs9PHcEMTQ=
cf-cache-status: DYNAMIC
cf-ray: 87cc3b2bee46bb65-FRA
date: Wed, 01 May 2024 02:09:44 GMT
server: cloudflare
vary: Access-Control-Request-Headers
via: 1.1 5519a8cb450b567e8b7111ae986a9b4c.cloudfront.net (CloudFront)
x-amz-cf-id: IRHZLXCrwtt-FB_SJ0Flbx87VE56e-ePCfJpUBBJkrKdYUw6wweIog==
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
x-powered-by: Express

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 108ms
108ms Image
image/gif 2.17.100.193
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=1a8619a294ad37fe81fcb7766ed37dc1&svisitor=null&visitor=8f795a1f-e594-44c8-8b0f-fe2d8cca1c32&session=cda14059-72ba-462b-8443-021ea213042d&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A2b%3A%3A5%22%7D&isIframe=false&m=%7B%22description%22%3A%22Team82%20disclosed%20to%20Siemens%20a%20deserialization%20vulnerability%20found%20in%20its%20SIMATIC%20Energy%20Manager%20(EnMPro)%20productThe%20vulnerability%2C%20CVE-2022-23450%2C%20was%20assessed%20a%20CVSS%20v3%20score%20of%2010.0%2C%20the%20highest%20criticality%20score%20possible%3B%20given%20the%20severity%20of%20the%20vulnerability%2C%20Team82%20has%20chosen%20to%20delay%20disclosing%20any%20technical%20d...%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Exploiting%20a%20Classic%20Deserialization%20Vulnerability%20in%20Siemens%20SIMATIC%20Energy%20Manager%20%7C%20Claroty%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fexploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager&pageViewId=48501f8e-fccc-4d09-8ac6-6b27626f524f&v=1.1.18

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 01 May 2024 02:09:44 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 01 May 2024 02:09:44 GMT

GET
H2 401 details Show response
epsilon.6sense.com/v3/company/ 42 B
327 B 207ms
141ms XHR
application/json 13.248.142.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.142.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software: nginx /
Resource Hash: 7d23a3cba9c9e734b155c86294109c51ccd1b340b990dda6616427ba39b988db

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
Authorization: Token Ask-your-CSM-for-a-token
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
X-6s-CustomID: WebTag1.0 1a8619a294ad37fe81fcb7766ed37dc1
Referer
sec-ch-ua-platform: "Win32"

Response headers

x-trace-id: 6797958952027065171
date: Wed, 01 May 2024 02:09:44 GMT
server: nginx
vary: Origin
content-type: application/json
x-6si-region: eu-central-1a
access-control-allow-origin: https://claroty.com
access-control-expose-headers: X-6si-Region
access-control-allow-credentials: true
timing-allow-origin: https://6sense.com, https://www.ssga.com
content-length: 42

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ 0
0 61ms
12ms Preflight 13.248.142.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.142.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://claroty.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://claroty.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
date: Wed, 01 May 2024 02:09:44 GMT
server: nginx
timing-allow-origin: https://6sense.com, https://www.ssga.com
x-6si-region: eu-central-1a
x-trace-id: 7905343614612592997

OPTIONS
H3 200 /
ws.zoominfo.com/pixel/jilEnH5CqVK0j3M3GHR5/ 0
0 172ms
150ms Preflight
text/html 104.16.118.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/jilEnH5CqVK0j3M3GHR5/?iszitag=true

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: _vtok,_zitok,content-type,visited-url
Access-Control-Request-Method: GET
Origin: https://claroty.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
access-control-allow-origin: https://claroty.com
allow: GET,HEAD
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 87cc3b305ba79729-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 01 May 2024 02:09:45 GMT
server: cloudflare
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

GET
H3 200 formcomplete.js Show response
ws-assets.zoominfo.com/ 89 KB
27 KB 64ms
55ms Script
application/javascript 104.16.118.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ws-assets.zoominfo.com/formcomplete.js
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d6346e978f8214288a06312ff6006113d1ef96be66755c67b00d4b24490edd4

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:45 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
age: 2868
x-guploader-uploadid: ABPtcPrGKYXPf_YuxVa1rZkzIM0aXN3g_2PPPoM-gyX2Yop7UuTDc43Eo0YaDxz6TgGumAMvwsF_vd1V7g
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 17 Apr 2024 11:22:28 GMT
server: cloudflare
etag: W/"d3b4774a46d8fd50ce9d458b28ae8ef3"
x-goog-hash: crc32c=Su6fug==, md5=07R3SkbY/VDOnUWLKK6O8w==
x-goog-generation: 1713352947933858
content-type: application/javascript
cache-control: public, max-age=3600
x-goog-stored-content-length: 91541
cf-ray: 87cc3b304d439f22-FRA
expires: Wed, 01 May 2024 02:21:57 GMT

GET
H3 200 / Show response
ws.zoominfo.com/pixel/jilEnH5CqVK0j3M3GHR5/ 3 KB
2 KB 224ms
223ms Fetch
text/javascript 104.16.118.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/jilEnH5CqVK0j3M3GHR5/?iszitag=true

Requested by

Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

a60ff8d42047e66f142ec61cad6b862b7ee9e861d55dfae8ae7888f7348655e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/javascript
visited-url: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
Referer: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager
_vtok: ODEuOTUuNS40MA==
_zitok: 98ac628ea35e965bd3a11714529384
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 google
server: cloudflare
x-powered-by: Express
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: https://claroty.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
alt-svc: h3=":443"; ma=86400
cf-ray: 87cc3b314e2f9f22-FRA

POST
H3 200 forms Show response
ws.zoominfo.com/formcomplete-v2/ 782 B
749 B 179ms
178ms Fetch
application/json 104.16.118.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/formcomplete-v2/forms

Requested by

Host: ws-assets.zoominfo.com
URL: https://ws-assets.zoominfo.com/formcomplete.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

5bf40fd813caa5ad6ca1784528f7486ac90e46c97705072e2c54b1831d5746bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
Authorization: bearer 48a696505cb61dcf5003fbd6445383
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/json
Referer
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 02:09:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 google
x-powered-by: Express
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"30e-K2uMheKcD+P17AdcegLXECaJ0To"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://claroty.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,Authorization, visitorId, _zitok
cf-ray: 87cc3b31be6e9f22-FRA

OPTIONS
H3 200 forms
ws.zoominfo.com/formcomplete-v2/ 0
0 164ms
164ms Preflight
text/html 104.16.118.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/formcomplete-v2/forms

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://claroty.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,Authorization,visitorId,_zitok
access-control-allow-origin: https://claroty.com
allow: POST
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 87cc3b30bbdc9729-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 01 May 2024 02:09:45 GMT
server: cloudflare
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 111ms
111ms Image
image/gif 2.17.100.193
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=1a8619a294ad37fe81fcb7766ed37dc1&svisitor=null&visitor=8f795a1f-e594-44c8-8b0f-fe2d8cca1c32&session=cda14059-72ba-462b-8443-021ea213042d&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2001%20May%202024%2002%3A09%3A45%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2001%20May%202024%2002%3A09%3A43%20GMT%22%2C%22timeSpent%22%3A%221570%22%2C%22totalTimeSpent%22%3A%221570%22%7D&isIframe=false&m=%7B%22description%22%3A%22Team82%20disclosed%20to%20Siemens%20a%20deserialization%20vulnerability%20found%20in%20its%20SIMATIC%20Energy%20Manager%20(EnMPro)%20productThe%20vulnerability%2C%20CVE-2022-23450%2C%20was%20assessed%20a%20CVSS%20v3%20score%20of%2010.0%2C%20the%20highest%20criticality%20score%20possible%3B%20given%20the%20severity%20of%20the%20vulnerability%2C%20Team82%20has%20chosen%20to%20delay%20disclosing%20any%20technical%20d...%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Exploiting%20a%20Classic%20Deserialization%20Vulnerability%20in%20Siemens%20SIMATIC%20Energy%20Manager%20%7C%20Claroty%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fexploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager&pageViewId=48501f8e-fccc-4d09-8ac6-6b27626f524f&v=1.1.18

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 01 May 2024 02:09:45 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 01 May 2024 02:09:45 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 103ms
102ms Image
image/gif 2.17.100.193
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=1a8619a294ad37fe81fcb7766ed37dc1&svisitor=null&visitor=8f795a1f-e594-44c8-8b0f-fe2d8cca1c32&session=cda14059-72ba-462b-8443-021ea213042d&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2001%20May%202024%2002%3A09%3A46%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2001%20May%202024%2002%3A09%3A45%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222571%22%7D&isIframe=false&m=%7B%22description%22%3A%22Team82%20disclosed%20to%20Siemens%20a%20deserialization%20vulnerability%20found%20in%20its%20SIMATIC%20Energy%20Manager%20(EnMPro)%20productThe%20vulnerability%2C%20CVE-2022-23450%2C%20was%20assessed%20a%20CVSS%20v3%20score%20of%2010.0%2C%20the%20highest%20criticality%20score%20possible%3B%20given%20the%20severity%20of%20the%20vulnerability%2C%20Team82%20has%20chosen%20to%20delay%20disclosing%20any%20technical%20d...%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Exploiting%20a%20Classic%20Deserialization%20Vulnerability%20in%20Siemens%20SIMATIC%20Energy%20Manager%20%7C%20Claroty%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fexploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager&pageViewId=48501f8e-fccc-4d09-8ac6-6b27626f524f&v=1.1.18

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 01 May 2024 02:09:46 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 01 May 2024 02:09:46 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 102ms
102ms Image
image/gif 2.17.100.193
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=1a8619a294ad37fe81fcb7766ed37dc1&svisitor=null&visitor=8f795a1f-e594-44c8-8b0f-fe2d8cca1c32&session=cda14059-72ba-462b-8443-021ea213042d&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2001%20May%202024%2002%3A09%3A47%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2001%20May%202024%2002%3A09%3A46%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223572%22%7D&isIframe=false&m=%7B%22description%22%3A%22Team82%20disclosed%20to%20Siemens%20a%20deserialization%20vulnerability%20found%20in%20its%20SIMATIC%20Energy%20Manager%20(EnMPro)%20productThe%20vulnerability%2C%20CVE-2022-23450%2C%20was%20assessed%20a%20CVSS%20v3%20score%20of%2010.0%2C%20the%20highest%20criticality%20score%20possible%3B%20given%20the%20severity%20of%20the%20vulnerability%2C%20Team82%20has%20chosen%20to%20delay%20disclosing%20any%20technical%20d...%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Exploiting%20a%20Classic%20Deserialization%20Vulnerability%20in%20Siemens%20SIMATIC%20Energy%20Manager%20%7C%20Claroty%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fexploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager&pageViewId=48501f8e-fccc-4d09-8ac6-6b27626f524f&v=1.1.18

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 01 May 2024 02:09:47 GMT
x-content-type-options: nosniff
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 01 May 2024 02:09:47 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 110ms
109ms Image
image/gif 2.17.100.193
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=1a8619a294ad37fe81fcb7766ed37dc1&svisitor=null&visitor=8f795a1f-e594-44c8-8b0f-fe2d8cca1c32&session=cda14059-72ba-462b-8443-021ea213042d&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2001%20May%202024%2002%3A09%3A48%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2001%20May%202024%2002%3A09%3A47%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%224572%22%7D&isIframe=false&m=%7B%22description%22%3A%22Team82%20disclosed%20to%20Siemens%20a%20deserialization%20vulnerability%20found%20in%20its%20SIMATIC%20Energy%20Manager%20(EnMPro)%20productThe%20vulnerability%2C%20CVE-2022-23450%2C%20was%20assessed%20a%20CVSS%20v3%20score%20of%2010.0%2C%20the%20highest%20criticality%20score%20possible%3B%20given%20the%20severity%20of%20the%20vulnerability%2C%20Team82%20has%20chosen%20to%20delay%20disclosing%20any%20technical%20d...%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Exploiting%20a%20Classic%20Deserialization%20Vulnerability%20in%20Siemens%20SIMATIC%20Energy%20Manager%20%7C%20Claroty%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fexploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager&pageViewId=48501f8e-fccc-4d09-8ac6-6b27626f524f&v=1.1.18

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 01 May 2024 02:09:48 GMT
x-content-type-options: nosniff
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 01 May 2024 02:09:48 GMT

Verdicts & Comments Add Verdict or Comment

74 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

24 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
claroty.com/	1970-01-20 20:15:36	Name: XSRF-TOKEN Value: eyJpdiI6IjMzUkQyV2FhZVZGcGp0eVVoUlZvbnc9PSIsInZhbHVlIjoiS1ZtanlDUFFkRFBCUmMyOTloMkJJN0VqN09SclhZSVY0TSt4d3J6em9OWnVNQzNMZVp1ZzJPOFIzQ3VJOGp6MW9NSy8rK1AveG9QQWY2djIrMkQ0TndnTFRFVENCeXdwdVJxUDNraThuWGQxekdsc2phYWh0cG1OdGlmTVkyb3oiLCJtYWMiOiIzNjI5YzllODJkMTU0NDcyMzVjZjZjYmQ0NzNjN2Q0YTdlZWFmNzIxZDYyZjE2YWIwZGE1ZDIzNTI1ZTlhYjJhIiwidGFnIjoiIn0%3D
claroty.com/	1970-01-20 20:15:36	Name: claroty_session Value: eyJpdiI6ImRhS2lac21Jcm5GNGVoK0hUYllheVE9PSIsInZhbHVlIjoiVFNZRkFZOTVjSG9SR2ZiMFpqVWFvTThmNEZIYkhZU3R1VW5taEJpOVNWdkxrUTNKYUVuR1ZLdThLVXhQSFNEWnNiUEtjRlJVc1l5b0dFYjRFRjE2UHQ2UmtBdG84bW03OUM5MjB1eTJ4VXIvL1kvcGVxelMvMTFPdlFmbmNGckUiLCJtYWMiOiJkMzkzNzExYTEwOTMyYjE5NzFkOGUxYTE0ZmNjYTNmOWEwMTViZDQ3YTEzYzBiOGU3Njk0NjZjOGQ2MDEzMmM4IiwidGFnIjoiIn0%3D
.hsforms.net/	1970-01-20 20:15:31	Name: __cf_bm Value: 47ED8B5kDDelfTQlImMg65fkOyDfHV1BDs2yb_0ofvk-1714529383-1.0.1.1-ERrYItZAUFSOGIN34HSY7Pix3J_Z8HfKIQg.56iSPzyaWnYVABXCKGf83WfCGvwQSa2_xJ8z88IoqkhbkEZACg
.claroty.com/	1970-01-21 05:01:05	Name: _biz_uid Value: 7aaacf3ee8fe4fc38b04dd62fd2483a6
.claroty.com/	1970-01-21 05:01:05	Name: _biz_nA Value: 1
.claroty.com/	1970-01-21 05:01:05	Name: _biz_pendingA Value: %5B%22ipv%3F_biz_r%3D%26_biz_h%3D-1906410348%26_biz_u%3D7aaacf3ee8fe4fc38b04dd62fd2483a6%26_biz_l%3Dhttps%253A%252F%252Fclaroty.com%252Fteam82%252Fresearch%252Fexploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager%26_biz_t%3D1714529383391%26_biz_i%3DExploiting%2520a%2520Classic%2520Deserialization%2520Vulnerability%2520in%2520Siemens%2520SIMATIC%2520Energy%2520Manager%2520%257C%2520Claroty%26_biz_n%3D0%26rnd%3D535865%22%5D
.claroty.com/	1970-01-20 22:25:05	Name: _gcl_au Value: 1.1.573496239.1714529383
.zoominfo.com/	1970-01-20 20:15:31	Name: __cf_bm Value: 8yvu2SoAUvslPqWToBozAeOfaI9wul_yzUrlatx8b5s-1714529383-1.0.1.1-x12ChNFMi67BhawgC0yd8z2ZW15nKykE_Nkag2ukLpffACc86M1UESCktURkTAGrdrVwaB3OhAdLzDF0wYZxqg
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: kghsObUPuErVv8ll_sCgNrpr7ZBWANhx_tnsfJtBrCE-1714529383660-0.0.1.1-604800000
.claroty.com/	1970-01-21 05:51:29	Name: _ga Value: GA1.2.966332956.1714529384
.claroty.com/	1970-01-20 20:16:55	Name: _gid Value: GA1.2.557169623.1714529384
.claroty.com/	1970-01-20 20:15:29	Name: _gat_gtag_UA_84224451_1 Value: 1
.linkedin.com/	1970-01-21 05:01:05	Name: bcookie Value: "v=2&72dfcc70-ef1b-42cd-8e1f-f869ab0e17c7"
.linkedin.com/	1970-01-21 00:34:41	Name: li_gc Value: MTswOzE3MTQ1MjkzODM7MjswMjEvmmUHzkBT191lN7X3Ha+8hzuSC2UWRgqV2OEwtG7syA==
.linkedin.com/	1970-01-20 20:16:55	Name: lidc Value: "b=OGST03:s=O:r=O:a=O:p=O:g=3206:u=1:x=1:i=1714529383:t=1714615783:v=2:sig=AQH4azO4GiATcOgl-ridpwvPw8jlFXoK"
.claroty.com/	1970-01-21 05:01:05	Name: _hjSessionUser_3443429 Value: eyJpZCI6ImNjNmE0MjZjLTRhZWUtNTY4MC1iNzlkLTRmNWY0NzlhN2FjZCIsImNyZWF0ZWQiOjE3MTQ1MjkzODM4MTYsImV4aXN0aW5nIjpmYWxzZX0=
.claroty.com/	1970-01-20 20:15:31	Name: _hjSession_3443429 Value: eyJpZCI6ImZmMmRkMjNhLTgwY2QtNDcyMC04ZDRkLTU3YzY0Mjg1YzVhYSIsImMiOjE3MTQ1MjkzODM4MTcsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=
.hsforms.com/	1970-01-20 20:15:31	Name: __cf_bm Value: 8mPsGfJmQD0oyY43tItoRIS0GFvyGIZgrfjNbh49SHQ-1714529384-1.0.1.1-yRlf0gsdNJT3T8rwx1Mc4r2CxlwmzvPyQ.hogKpCnCMMY2OE4Od7CPxHt_mb_9GxCqKS0cuc90oXBXuYwupGLg
.hsforms.com/	1969-12-31 23:59:59	Name: _cfuvid Value: k5PgoWdRRhK5BlJZ1Pcg60gL6pHIhqHXrsS8lqTWwOE-1714529384191-0.0.1.1-604800000
claroty.com/	1970-01-21 05:51:29	Name: _gd_visitor Value: 8f795a1f-e594-44c8-8b0f-fe2d8cca1c32
claroty.com/	1970-01-20 20:15:43	Name: _gd_session Value: cda14059-72ba-462b-8443-021ea213042d
.hubspot.com/	1970-01-20 20:15:31	Name: __cf_bm Value: Y8DRkSqCyJm2ZGcGpHWa8SN1.lNRHqOJJcIViqxPNvA-1714529384-1.0.1.1-xKPNGmQer0bKkw5vjAtPHxNvzZlHCGrIXGl8QdsoyLQX99VdxadcofQYsizgqedI2QsKq7iz_yaIpeDfO9m2rA
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: mSSuD7VstHIw4FDWndfHpnoj1Xf7wbgr_XlxTtyoEB8-1714529384385-0.0.1.1-604800000
.claroty.com/	1970-01-21 05:01:05	Name: _zitok Value: 98ac628ea35e965bd3a11714529384

38 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'ambient-light-sensor'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'battery'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'document-domain'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'execution-while-not-rendered'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'execution-while-out-of-viewport'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'navigation-override'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'web-share'.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
network	error	URL: https://epsilon.6sense.com/v3/company/details Message: Failed to load resource: the server responded with a status of 401 ()
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/exploiting-a-classic-deserialization-vulnerability-in-siemens-simatic-energy-manager Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

b.6sc.co
c.6sc.co
cdn.bizible.com
claroty.com
cta-service-cms2.hubspot.com
epsilon.6sense.com
fonts.googleapis.com
fonts.gstatic.com
forms-na1.hsforms.com
forms.hscollectedforms.net
forms.hsforms.com
ipv6.6sc.co
j.6sc.co
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsadspixel.net
js.hscollectedforms.net
js.hsforms.net
js.hubspot.com
js.zi-scripts.com
ka-p.fontawesome.com
kit.fontawesome.com
okt.to
perf-na1.hsforms.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
script.hotjar.com
snap.licdn.com
static.hotjar.com
static.oktopost.com
stats.g.doubleclick.net
track.hubspot.com
vc.hotjar.io
ws-assets.zoominfo.com
ws.zoominfo.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
104.16.118.43
104.18.142.119
104.18.37.212
104.18.80.204
104.19.175.188
13.107.42.14
13.248.142.121
13.32.27.21
138.197.228.97
142.250.186.35
152.195.15.58
172.217.18.4
18.244.18.11
18.66.102.11
18.66.112.110
2.17.100.193
2001:4860:4802:32::36
23.22.90.252
2606:4700:4400::6812:22e5
2606:4700:4400::6812:2844
2606:4700::6810:6efe
2606:4700::6810:7574
2606:4700::6810:7674
2606:4700::6810:8cd1
2606:4700::6811:80ac
2606:4700::6811:afc9
2620:1ec:21::14
2a00:1450:4001:800::200e
2a00:1450:4001:806::2008
2a00:1450:4001:812::2003
2a00:1450:4001:82a::200a
2a00:1450:400c:c00::9c
2a02:26f0:3500:16::215:148d
2a02:26f0:ab00::214:8e70
009c688b6b2b336eeffafab5ea0ae57b757e4d85c84d736d365f1ef76611d5cc
05dce95eaa2457f1ed9076e0d32b59680b654cf7ca6a4e35f3fe682c78f460b0
09016600a13dd4825b72516765a8da53d1ab896f7582c4619d014e8ee147ea84
0ede3ffda856f66ed7d3685f59716dfec3a38aedf5701ad54125d8b8889ba572
0ee301bb4dfa8f8612839b80394c8a5e3dc13148e00e45fa8da71e0c5d2df7ad
13f3849bcb0803d10f69b84c0c9be9b935ec89306a9e370365629fbe1eb20e37
17cfde48999dcfe173e106d30c3f9f329e6558a1db1fc032876589ec516945f3
19be36b532c3147a005317cbc940c69b7137c7980a462525055393d3cfd20b30
1c67d8ce90160a6586cfd2c2a936959738f5b1843ebdfbac4325c4d1a9b61224
24b19f3adb4b93ae4e7c14e7fc2b17ffa34ca6a03518b7b0fc18117b8c9ee214
311c100c3e176440aefc6a48f418c6fd3c3376a88635139a7cfeecf6e75df43e
43b962bc3ef0ddc52398c669a6344d1d78954017cd297f5f95654f71a16cd8e9
4d9d9af17df221748b0e58108771b9aa312a7b1caa789e60ccf9167a0e10f420
56fd6ac00de2e21a09cbd192538fa98e5760d347064942418aa32b146cfa0444
5bf40fd813caa5ad6ca1784528f7486ac90e46c97705072e2c54b1831d5746bb
5c76dd89a767afd512ce6c6370424f39a632ebb736c16ac37952fbfd97575448
5d6346e978f8214288a06312ff6006113d1ef96be66755c67b00d4b24490edd4
60bdc532cad265a116b2b590c86a9679ed86fe5a1ac3764e08c521cf6ccb1784
655460488a4e86be0c0adbd0af8f537bcc1f077f261f3e95ff8e213af3b33e39
6858a0c963e69e6c972028626015eac3077696c9f1b9b089edd0d5fc30f9803e
69d7113a84cea3d4ba23dfb384e3490c3fc2e5bb2da306706150c7528f4f41bf
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
7165e74a0addefc944a67a5fef91eee51116e145cc67f975119a264357f14295
73580a6ba6705b61499bf9b4661f1b50c4f78e8c72b65ce30df43546e7f58e6f
7914b5c306a51678e7d777317f64c95d31437c47344063ec422c6bb2b4d9d718
7b73a181d4be4b38c97190012e94e39457a8471bfd777f99f1641d83d4e72133
7d23a3cba9c9e734b155c86294109c51ccd1b340b990dda6616427ba39b988db
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
89673dacf492da62609243c2343edc8e06de4aa4f8cb69816e9be4676bc133b9
89cad6cee63c19be5bc8ee45e7810603e0014734ae6fa4ba3fe7d990bd0abe19
8a378481141454ad2f21c969a4225d83657df10f8b066d8f27f47e3b208a1915
8bdf6c5644f0beca06c84c2a3b02f6079f5981b995a3a1d33fd66f0999c4d545
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
943ded0a2adddb140465921e9f3a050f1fb064974efebe3ef311e9e75b6a2fa5
95401ddb551c7b54e882e38efaf5e19905478635b8f0566f71f4ba8aa40f9e1a
95cbdd8d48ccc73ee5d0c5aba8bca4485b7fc0b58713923e92b97a325fc68538
95ef911fcf12dfe0a1fb5b17a3b24fa81c6b07b102b435949b06e7e124de51cb
9600404b242858220ce49132ebaae202d5c039e1bddd0c80a19c76c92f0bf97b
962c60f1e79f0ca16e7142d53a2eae2ec60d33071a306d010e25cfc262a652c4
98b750aa4e60391c77b81a1876a8e123b0ff69c57cc9dac1ebd6182ab1aab566
a33128c94dd3c425bc3f4a9ba389a1f3d7a75233e8cb788ea80f8f43a3d68423
a60ff8d42047e66f142ec61cad6b862b7ee9e861d55dfae8ae7888f7348655e1
b07871da02311868c31ab6ac5a4e78cc877f118acd854857f6f51519f3ddbbc9
b3a9850d5212490b6f3011359a7defb4e86e07e35d2a861b4a29decfe731c410
b4bf8910a202b24bd61be26e28eaa8c5f83a48d78999b2693a9cbdf4c9910cf1
b7562ea661a7229efcf432395eb9154fd9f42af68de27553b983c4f37285aa36
c33c3b4654450ad9afe9d9cb1da4e2ad8f2b601218d4015da547331079865976
c4d04d2b6a041dde11c80d8332f983a58c1031c663ab4f42230899cb82adf4a7
d269e745735d0cff621fefc03710777c918f02475e693312e49164ee589105d7
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dc924bdb7298a1d9785ee12b8d0637a528473b8e8bad1be2008c515038b6b7d9
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e02675c0b58e43a34fbc81fed80ec2798deb5ddae78a16f9dd5e0e82e84b598a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8903e555bd60b3e66725a7316fa1c399c1c330b6f207dfbf294e287857d526c
e949e8a621d6107d8e6885fc0f2f0da166d5d1d48adc6c90440a156a8f0a8c53
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef410da15ef1307792230bc15984643d4fa47ab902d62496ef98a725b1429e51
f171db8dc0eb7cec86c84ceac278dbf2fbe33770334635a2703186d14f4828b2
fba31c2cd9699431dba47604216525f9bcc0cb1d5980fbae9b19c8b86454d2fc
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

claroty.com Open in urlscan Pro 138.197.228.97 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

87 Requests

99 %HTTPS

50 %IPv6

28 Domains

41 Subdomains

34 IPs

4 Countries

1202 kBTransfer

3113 kBSize

24 Cookies

14 Outgoing links

Redirected requests

87 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

claroty.com Open in urlscan Pro
138.197.228.97 Public Scan

Screenshot
Live screenshot

Full Image

87
Requests

99 %
HTTPS

50 %
IPv6

28
Domains

41
Subdomains

34
IPs

4
Countries

1202 kB
Transfer

3113 kB
Size

24
Cookies

87 HTTP transactions
0 data transactions