login.corp-internal.com Open in urlscan Pro
184.72.234.114  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

36 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request f9636b6339ee5b87 Show response login.corp-internal.com/	37 KB 13 KB	419ms 197ms	Document text/html	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash bcef8e8caa13a877a02a093cdab0c630a5c97b100e2a83a0c435d1128972c635 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers date Fri, 18 Feb 2022 19:24:08 GMT content-type text/html; charset=utf-8 vary Accept-Encoding x-frame-options SAMEORIGIN x-xss-protection 1; mode=block x-content-type-options nosniff x-download-options noopen x-permitted-cross-domain-policies none referrer-policy strict-origin-when-cross-origin etag W/"bcef8e8caa13a877a02a093cdab0c630" cache-control max-age=0, private, must-revalidate x-request-id 20f2da3d-39bb-4fc2-997d-33d0b610875e x-runtime 0.028667 x-host-info lw-prod-us-i-0752b79d338235668 ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 server ThreatSim-Web-Server access-control-allow-origin * content-encoding gzip
GET H/1.1	200 OK	main-vflDy538f.css s3.amazonaws.com/tslp/assets/lp/	302 KB 302 KB	431ms 128ms	Stylesheet text/css	52.216.229.189 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3.amazonaws.com/tslp/assets/lp/main-vflDy538f.css Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.229.189 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1.amazonaws.com Software AmazonS3 / Resource Hash 7c44d16799d95879584260e9b7413b94fa06d881de54544368ce030f3a979166 Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Date Fri, 18 Feb 2022 19:24:10 GMT Last-Modified Thu, 20 Dec 2012 03:59:28 GMT Server AmazonS3 x-amz-request-id MS81TX7QJFFP2DGM ETag "2589feca6057ffd6bbd73ed0f7f3945a" Content-Type text/css x-amz-version-id null Accept-Ranges bytes Content-Length 309270 x-amz-id-2 2wekh6A2UXFX2ukrvPzryXwsb0KrJOWoVqY79KV35RkZTL6gIyy2LyXQGi5tOSshYaEMwAt2Vsk=
GET H/1.1	200 OK	web_sprites-vfl4z5Sy2.css s3.amazonaws.com/tslp/assets/lp/	32 KB 33 KB	442ms 139ms	Stylesheet text/css	52.216.229.189 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3.amazonaws.com/tslp/assets/lp/web_sprites-vfl4z5Sy2.css Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.229.189 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1.amazonaws.com Software AmazonS3 / Resource Hash a8522b2e557ad1601ce48c2c4d8fca88df648927064ad2935db1dd4474b21d64 Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Date Fri, 18 Feb 2022 19:24:10 GMT Last-Modified Thu, 20 Dec 2012 03:56:01 GMT Server AmazonS3 x-amz-request-id MS85194D0TCV4R2A ETag "c999c807b49669246393728ee7f18924" Content-Type text/css x-amz-version-id null Accept-Ranges bytes Content-Length 33182 x-amz-id-2 RLKbI+q9KyDndeStsh4QN0KA2fMHQfXrNyWJi1iM/VE2J4e+l3HuoSKJOIexQNYtU26HkWUOCvw=
GET H/1.1	200 OK	error_bubble-vflaLuKA-.css s3.amazonaws.com/tslp/assets/lp/	822 B 1 KB	435ms 131ms	Stylesheet text/css	52.216.229.189 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3.amazonaws.com/tslp/assets/lp/error_bubble-vflaLuKA-.css Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.229.189 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1.amazonaws.com Software AmazonS3 / Resource Hash 2da895ec17aab9bb6558450685b6294709c8d81d3d65a32eef85deed0c485ab2 Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Date Fri, 18 Feb 2022 19:24:10 GMT Last-Modified Thu, 20 Dec 2012 03:52:01 GMT Server AmazonS3 x-amz-request-id MS840PHASWAHZQ4V ETag "eacf5210933f8ce41470ea3f410734c0" Content-Type text/css x-amz-version-id null Accept-Ranges bytes Content-Length 822 x-amz-id-2 4/YqT8lv8NdjjH+lu4pwCqZJMPucUg8d5Py6ti0KH+Vmnpq5WWz6LZog8vTu/XuFy485YCQLlgw=
GET H/1.1	200 OK	plugin_detect.js Show response tslp.s3.amazonaws.com/detect/	49 KB 49 KB	433ms 125ms	Script text/javascript	52.216.171.107 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tslp.s3.amazonaws.com/detect/plugin_detect.js?guid=636b69ee5b&correlation_id=cca4e219-a623-40db-8930-b95be371220d Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.171.107 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software AmazonS3 / Resource Hash 4bab432979d731f8264bcd9d40422ca7dfcfcb0e0e703288db78bbfa555f853a Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Date Fri, 18 Feb 2022 19:24:10 GMT Last-Modified Wed, 15 Feb 2017 17:56:07 GMT Server AmazonS3 x-amz-request-id MS84TW2AZZ2GJ20A ETag "00a513f07603df01e3b99be00f370754" Content-Type text/javascript x-amz-version-id null Accept-Ranges bytes Content-Length 50085 x-amz-id-2 CDayrkahjBcJpXLokUoV8fyWK3iVABbVT4/KfCFY/m+u1C4BVrC8dKJJXgKUKPOvy/2VSnXhAf4=
GET H/1.1	200 OK	bpd250x250.jpg www.popularenlinea.com/SiteCollectionImages/OG/	23 KB 24 KB	819ms 205ms	Image image/jpeg	201.221.126.31 Banco Popular Dom...
General Check archive.org Show headers Download Go to Show image Full URL https://www.popularenlinea.com/SiteCollectionImages/OG/bpd250x250.jpg Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 201.221.126.31 , Dominican Republic, ASN262247 (Banco Popular Dominicano, DO), Reverse DNS 31.126.221.201.l.static.bpd.com.do Software / Resource Hash ff7378b49edaa8d2de31ab71c8c266b3ce0bdbc5cf2e3e164ef67c84d4807450 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Date Fri, 18 Feb 2022 19:24:09 GMT X-Content-Type-Options nosniff request-id 780722a0-ed8d-80f5-eda1-dc4338b3e2bf ResourceTag rt:A356CA49-AAAD-409A-9ABC-6D3606CCAB28@00000000004 Server-Timing dtSInfo;desc="0", dtRpid;desc="-1346269456" Public-Extension http://schemas.microsoft.com/repl-2 Content-Length 23495 SPIisLatency 0 X-MS-InvokeApp 1; RequireReadOnly SPRequestDuration 23 Last-Modified Tue, 21 Jun 2016 21:31:55 GMT SPRequestGuid 780722a0-ed8d-80f5-eda1-dc4338b3e2bf X-FRAME-OPTIONS SAMEORIGIN ETag "{A356CA49-AAAD-409A-9ABC-6D3606CCAB28},4" Strict-Transport-Security max-age=31536000; includeSubDomains Content-Type image/jpeg Cache-Control private,max-age=0 Accept-Ranges bytes Expires Thu, 03 Feb 2022 19:24:10 GMT
GET H/1.1	200 OK	training.js Show response tslp.s3.amazonaws.com/assets/js/	352 B 773 B	111ms 111ms	Script application/ecmascript	52.216.171.107 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tslp.s3.amazonaws.com/assets/js/training.js Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.171.107 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software AmazonS3 / Resource Hash 8a1170223599205267c6ee3a3072855f1727461d9dd1066bb94f39180f963af9 Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Date Fri, 18 Feb 2022 19:24:10 GMT Last-Modified Thu, 14 Nov 2019 18:45:04 GMT Server AmazonS3 x-amz-request-id MS88KQG9DQ069J24 ETag "029ab28ca3c245dc425e3f3f6599d480" Content-Type application/ecmascript x-amz-version-id oPMJQR4dr8a8GRwpJLphOcsbzTKMfWQa Accept-Ranges bytes Content-Length 352 x-amz-id-2 4st3baapvYdGhXe10+aFc4Di9NANe2GvGrKVSCNNwT74agT0E9Weskjc6omV8lgLS4d8tIHmktE=
GET		alt_pixel_click_636b69ee5b.gif login.corp-internal.com/	0 0
GET H/1.1	200 OK	bugsnag-2.min.js Show response d2wy8f7a9ursnm.cloudfront.net/	6 KB 3 KB	166ms 46ms	Script application/javascript	143.204.42.57 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d2wy8f7a9ursnm.cloudfront.net/bugsnag-2.min.js Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 143.204.42.57 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-42-57.osl50.r.cloudfront.net Software AmazonS3 / Resource Hash 9ff538f72465724fc393ea1f3c03a17233c9b7e1d440d6f8a6d0b3a836c2a9cc Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Date Sat, 12 Feb 2022 04:08:39 GMT Content-Encoding gzip Connection keep-alive Last-Modified Wed, 10 Aug 2016 00:30:49 GMT Server AmazonS3 Age 573331 ETag "6103bb5e4ec6141e19e1100caafc780c" X-Cache Hit from cloudfront Content-Type application/javascript Via 1.1 83a23d85c009b0c0e3626072e9f997fe.cloudfront.net (CloudFront) Cache-Control public, max-age=604800 X-Amz-Cf-Pop OSL50-C1 Accept-Ranges bytes Content-Length 2962 X-Amz-Cf-Id IA5jR_O005qzdgQ5P4lXNGWXGmmW86CdF4n0PesF0QDvbaB0oQtBXQ==
GET H2	200	jquery.min.js Show response login.corp-internal.com/assets/ajax/libs/jquery/1.9.1/	90 KB 32 KB	105ms 104ms	Script application/javascript	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://login.corp-internal.com/assets/ajax/libs/jquery/1.9.1/jquery.min.js Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4 Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:09 GMT content-encoding gzip last-modified Thu, 20 Jan 2022 17:38:40 GMT server ThreatSim-Web-Server vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=315360000, public expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	all.js Show response login.corp-internal.com/assets/	28 KB 7 KB	193ms 192ms	Script application/javascript	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://login.corp-internal.com/assets/all.js?g=636b69ee5b Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash 39b4614f1c87cf0cfd1bc3375642e95825cb2018e0318a36aad766ddb5a8cbe9 Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:09 GMT content-encoding gzip last-modified Tue, 15 Feb 2022 18:14:40 GMT server ThreatSim-Web-Server vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=315360000, public content-length 7191 expires Thu, 31 Dec 2037 23:55:55 GMT
POST H2	200	browser_post Show response login.corp-internal.com/secure/	0 486 B	111ms 111ms	XHR image/gif	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://login.corp-internal.com/secure/browser_post Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers X-NewRelic-ID XQ4GVVFACQAAU1dSDgQCVA== tracestate 1506924@nr=0-1-98147-1307613366-9c58d4184c3ae9a4----1645212249946 traceparent 00-1d3ee017b87440314590d64f62587470-9c58d4184c3ae9a4-01 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 newrelic eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6Ijk4MTQ3IiwiYXAiOiIxMzA3NjEzMzY2IiwiaWQiOiI5YzU4ZDQxODRjM2FlOWE0IiwidHIiOiIxZDNlZTAxN2I4NzQ0MDMxNDU5MGQ2NGY2MjU4NzQ3MCIsInRpIjoxNjQ1MjEyMjQ5OTQ2LCJ0ayI6IjE1MDY5MjQifX0= Content-Type application/x-www-form-urlencoded; charset=UTF-8 Accept */* Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 X-Requested-With XMLHttpRequest Response headers date Fri, 18 Feb 2022 19:24:10 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id 7a4c03ca-0241-48c8-a6d1-551ef2aadfa9 x-runtime 0.011342 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prod-us-i-0b8504a50dc011db0, ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding, Accept content-type image/gif; charset=utf-8 access-control-allow-origin * cache-control no-cache
GET H2	200	trace login.corp-internal.com/	0 466 B	104ms 100ms	Image text/html	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://login.corp-internal.com/trace?id=636b69ee5b&msg=BrowserDetect%20-%20localStorage%20%3D%20true&correlation_id=cca4e219-a623-40db-8930-b95be371220d Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:10 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id fbcdfdf8-8c83-44c5-8b0c-4c7708f224e2 x-runtime 0.002396 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prod-us-i-0a8f8076169285070, ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type text/html access-control-allow-origin * cache-control no-cache
GET H2	200	trace login.corp-internal.com/	0 465 B	106ms 101ms	Image text/html	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://login.corp-internal.com/trace?id=636b69ee5b&msg=BrowserDetect%20-%20sessionStorage%20%3D%20true&correlation_id=cca4e219-a623-40db-8930-b95be371220d Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:10 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id 510ec834-73e2-4734-be67-1aa6f914544e x-runtime 0.002555 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prod-us-i-017ebe02e95e209eb, ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type text/html access-control-allow-origin * cache-control no-cache
GET H2	200	trace login.corp-internal.com/	0 466 B	105ms 100ms	Image text/html	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://login.corp-internal.com/trace?id=636b69ee5b&msg=BrowserDetect%20-%20hasCookies%20%3D%20true&correlation_id=cca4e219-a623-40db-8930-b95be371220d Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:10 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id 33b09604-b338-4445-9368-4cbe88fac9d8 x-runtime 0.002426 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prod-us-i-0a456aca2014e187f, ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type text/html access-control-allow-origin * cache-control no-cache
GET H2	200	trace login.corp-internal.com/	0 466 B	106ms 102ms	Image text/html	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://login.corp-internal.com/trace?id=636b69ee5b&msg=BrowserDetect%20-%20browser%20%3D%20Chrome&correlation_id=cca4e219-a623-40db-8930-b95be371220d Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:10 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id 1b9440b4-352c-4e35-9d80-4552683fa225 x-runtime 0.002624 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prod-us-i-05bba2b1699e69c9a, ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type text/html access-control-allow-origin * cache-control no-cache
GET H2	200	trace login.corp-internal.com/	0 466 B	107ms 102ms	Image text/html	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://login.corp-internal.com/trace?id=636b69ee5b&msg=BrowserDetect%20-%20browser_version%20%3D%2098&correlation_id=cca4e219-a623-40db-8930-b95be371220d Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:10 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id 6c125656-e22a-436a-b0bf-7e6613098a3e x-runtime 0.002451 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prod-us-i-0752b79d338235668, ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type text/html access-control-allow-origin * cache-control no-cache
GET H2	200	trace login.corp-internal.com/	0 466 B	107ms 102ms	Image text/html	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://login.corp-internal.com/trace?id=636b69ee5b&msg=BrowserDetect%20-%20os%20%3D%20Linux&correlation_id=cca4e219-a623-40db-8930-b95be371220d Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:10 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id f517e1de-32b1-43ef-a814-7d9fe74878b4 x-runtime 0.002548 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prod-us-i-08fb3f888c1b35095, ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type text/html access-control-allow-origin * cache-control no-cache
GET H2	200	trace login.corp-internal.com/	0 465 B	106ms 101ms	Image text/html	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://login.corp-internal.com/trace?id=636b69ee5b&msg=BrowserDetect%20-%20os_version%20%3D%2010&correlation_id=cca4e219-a623-40db-8930-b95be371220d Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:10 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id 4a6fbff3-231e-42d7-a89a-22aefc2fdbd9 x-runtime 0.002366 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prod-us-i-0e88e085cec4118de, ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type text/html access-control-allow-origin * cache-control no-cache
GET H2	200	trace login.corp-internal.com/	0 466 B	204ms 200ms	Image text/html	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://login.corp-internal.com/trace?id=636b69ee5b&msg=BrowserDetect%20-%20language%20%3D%20en-US&correlation_id=cca4e219-a623-40db-8930-b95be371220d Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:10 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id e7c41232-7245-4da8-ad0d-cf03cc48a356 x-runtime 0.006227 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prod-us-i-0b8504a50dc011db0, ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type text/html access-control-allow-origin * cache-control no-cache
GET H2	200	trace login.corp-internal.com/	0 466 B	198ms 194ms	Image text/html	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://login.corp-internal.com/trace?id=636b69ee5b&msg=BrowserDetect%20-%20colorDepth%20%3D%2024&correlation_id=cca4e219-a623-40db-8930-b95be371220d Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:10 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id 8a3f6d82-0529-45b6-8a3d-b6f003f7f98a x-runtime 0.002299 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prod-us-i-0a8f8076169285070, ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type text/html access-control-allow-origin * cache-control no-cache
GET H2	200	trace login.corp-internal.com/	0 466 B	198ms 194ms	Image text/html	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://login.corp-internal.com/trace?id=636b69ee5b&msg=BrowserDetect%20-%20width%20%3D%201600&correlation_id=cca4e219-a623-40db-8930-b95be371220d Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:10 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id 45ff8046-7f8f-46da-b5b4-5dbd9ae7af95 x-runtime 0.003170 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prod-us-i-017ebe02e95e209eb, ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type text/html access-control-allow-origin * cache-control no-cache
GET H2	200	trace login.corp-internal.com/	0 465 B	198ms 194ms	Image text/html	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://login.corp-internal.com/trace?id=636b69ee5b&msg=BrowserDetect%20-%20height%20%3D%201200&correlation_id=cca4e219-a623-40db-8930-b95be371220d Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:10 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id 81eb85eb-d956-43ff-900b-1e959b9c5a25 x-runtime 0.003410 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prod-us-i-0a456aca2014e187f, ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type text/html access-control-allow-origin * cache-control no-cache
GET H2	200	trace login.corp-internal.com/	0 466 B	196ms 193ms	Image text/html	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://login.corp-internal.com/trace?id=636b69ee5b&msg=BrowserDetect%20-%20plugin%20Chrome%20PDF%20Plugin&correlation_id=cca4e219-a623-40db-8930-b95be371220d Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:10 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id 89bf7ccc-4109-4224-bb1e-e5b256902250 x-runtime 0.002317 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prod-us-i-05bba2b1699e69c9a, ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type text/html access-control-allow-origin * cache-control no-cache
GET H2	200	trace login.corp-internal.com/	0 466 B	198ms 195ms	Image text/html	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://login.corp-internal.com/trace?id=636b69ee5b&msg=BrowserDetect%20-%20plugin%20Chrome%20PDF%20Viewer&correlation_id=cca4e219-a623-40db-8930-b95be371220d Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:10 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id a634eddf-1d12-42d1-934b-8433abaaa39f x-runtime 0.003359 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prod-us-i-0752b79d338235668, ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type text/html access-control-allow-origin * cache-control no-cache
GET H2	200	trace login.corp-internal.com/	0 466 B	199ms 195ms	Image text/html	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://login.corp-internal.com/trace?id=636b69ee5b&msg=BrowserDetect%20-%20plugin%20Native%20Client&correlation_id=cca4e219-a623-40db-8930-b95be371220d Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:10 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id f5209a89-91d6-4ff0-a2d9-a3751ae92655 x-runtime 0.003181 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prod-us-i-08fb3f888c1b35095, ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type text/html access-control-allow-origin * cache-control no-cache
GET H2	200	trace login.corp-internal.com/	0 465 B	199ms 196ms	Image text/html	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://login.corp-internal.com/trace?id=636b69ee5b&msg=Chrome%20browser%2C%20using%20more%20detailed%20version&correlation_id=cca4e219-a623-40db-8930-b95be371220d Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:10 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id 7e89d37f-056c-4321-8ce0-41b6fef07bf7 x-runtime 0.003804 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prod-us-i-0e88e085cec4118de, ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type text/html access-control-allow-origin * cache-control no-cache
GET H2	200	trace login.corp-internal.com/	0 466 B	200ms 197ms	Image text/html	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://login.corp-internal.com/trace?id=636b69ee5b&msg=Skipping%20java%20detection&correlation_id=cca4e219-a623-40db-8930-b95be371220d Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:10 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id 83485ab3-c722-447a-89cb-f3890fa6319f x-runtime 0.004124 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prod-us-i-0b8504a50dc011db0, ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type text/html access-control-allow-origin * cache-control no-cache
GET H2	200	trace login.corp-internal.com/	0 466 B	200ms 198ms	Image text/html	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://login.corp-internal.com/trace?id=636b69ee5b&msg=Skipping%20flash%20detection&correlation_id=cca4e219-a623-40db-8930-b95be371220d Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:10 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id 85f925c9-4e9c-40c5-b1bc-6268c5032c11 x-runtime 0.001759 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prod-us-i-0a8f8076169285070, ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type text/html access-control-allow-origin * cache-control no-cache
GET H2	200	trace login.corp-internal.com/	0 465 B	199ms 197ms	Image text/html	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://login.corp-internal.com/trace?id=636b69ee5b&msg=Skipping%20pdf%20detection&correlation_id=cca4e219-a623-40db-8930-b95be371220d Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:10 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id 710f1f6e-2b1b-454f-b82e-efb6dc74c2a2 x-runtime 0.003463 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prod-us-i-017ebe02e95e209eb, ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type text/html access-control-allow-origin * cache-control no-cache
GET H2	200	trace login.corp-internal.com/	0 465 B	198ms 196ms	Image text/html	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://login.corp-internal.com/trace?id=636b69ee5b&msg=Skipping%20quicktime%20detection&correlation_id=cca4e219-a623-40db-8930-b95be371220d Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:10 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id f9c93ae3-9c02-4092-afc8-7febe8e51183 x-runtime 0.004079 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prod-us-i-0a456aca2014e187f, ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type text/html access-control-allow-origin * cache-control no-cache
GET H2	200	trace login.corp-internal.com/	0 466 B	200ms 198ms	Image text/html	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://login.corp-internal.com/trace?id=636b69ee5b&msg=Skipping%20RealPlayer%20detection&correlation_id=cca4e219-a623-40db-8930-b95be371220d Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:10 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id bb2170bd-acd2-44b5-aec0-78ac8af6633e x-runtime 0.001995 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prod-us-i-05bba2b1699e69c9a, ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type text/html access-control-allow-origin * cache-control no-cache
GET H2	200	trace login.corp-internal.com/	0 466 B	200ms 198ms	Image text/html	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://login.corp-internal.com/trace?id=636b69ee5b&msg=Skipping%20Silverlight%20detection&correlation_id=cca4e219-a623-40db-8930-b95be371220d Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:10 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id 98234783-f4b2-4b54-ae72-08bcafe9a006 x-runtime 0.003832 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prod-us-i-0752b79d338235668, ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type text/html access-control-allow-origin * cache-control no-cache
GET H2	200	trace login.corp-internal.com/	0 466 B	198ms 196ms	Image text/html	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://login.corp-internal.com/trace?id=636b69ee5b&msg=Skipping%20WindowsMediaPlayer%20detection&correlation_id=cca4e219-a623-40db-8930-b95be371220d Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:10 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id 26943a67-e341-496b-b579-d3e92cd1f467 x-runtime 0.003733 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prod-us-i-08fb3f888c1b35095, ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type text/html access-control-allow-origin * cache-control no-cache
GET H2	200	trace login.corp-internal.com/	0 465 B	200ms 199ms	Image text/html	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://login.corp-internal.com/trace?id=636b69ee5b&msg=redirect_url%20is%20undefined&correlation_id=cca4e219-a623-40db-8930-b95be371220d Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:10 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id 880f1013-90c6-45af-bbc8-458a83145d14 x-runtime 0.003654 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prod-us-i-0e88e085cec4118de, ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type text/html access-control-allow-origin * cache-control no-cache
GET H2	200	trace login.corp-internal.com/	0 466 B	105ms 105ms	Image text/html	184.72.234.114 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://login.corp-internal.com/trace?id=636b69ee5b&msg=browser_post_successful&correlation_id=cca4e219-a623-40db-8930-b95be371220d Requested by Host: login.corp-internal.com URL: https://login.corp-internal.com/f9636b6339ee5b87?l=32 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.234.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-234-114.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://login.corp-internal.com/f9636b6339ee5b87?l=32 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 19:24:10 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id 732fae28-ce6e-49f6-9bdb-0d0d0eccd697 x-runtime 0.004938 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prod-us-i-0b8504a50dc011db0, ; 1d52b10d1170dae92bf8d06556f2dc993d1cc760 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type text/html access-control-allow-origin * cache-control no-cache

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

login.corp-internal.com

URL

https://login.corp-internal.com:49153/alt_pixel_click_636b69ee5b.gif?correlation_id=cca4e219-a623-40db-8930-b95be371220d

46 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| NREUM object| newrelic function| __nr_require object| PluginDetect object| detector boolean| do_not_detect_java boolean| do_not_detect_flash boolean| do_not_detect_pdf boolean| do_not_detect_quicktime boolean| do_not_detect_realplayer boolean| do_not_detect_silverlight boolean| do_not_detect_wmp object| Bugsnag function| $ function| jQuery object| plugin_detector boolean| console_debug string| guid boolean| test_mode string| tracking_id string| correlation_id string| base_post_url object| BrowserDetect object| $_GET undefined| regex undefined| items undefined| last function| log_error function| log_to_console function| log_message boolean| fingerprinted function| strip function| secureSubmitWithGuid function| secureSubmit function| findUsername function| checkPassword function| secureLogAndRedirect function| sendFingerprint function| imageSender function| sendIndividually function| loadAllInfo object| local_addresses function| redirector function| rewriteLinks function| isFormValid

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			login.corp-internal.com/	1969-12-31 23:59:59	Name: EXFILGUID Value: 636b69ee5b
			login.corp-internal.com/	1969-12-31 23:59:59	Name: link_clicked_636b69ee5b Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

d2wy8f7a9ursnm.cloudfront.net
login.corp-internal.com
s3.amazonaws.com
tslp.s3.amazonaws.com
www.popularenlinea.com
login.corp-internal.com
143.204.42.57
184.72.234.114
201.221.126.31
52.216.171.107
52.216.229.189
2da895ec17aab9bb6558450685b6294709c8d81d3d65a32eef85deed0c485ab2
39b4614f1c87cf0cfd1bc3375642e95825cb2018e0318a36aad766ddb5a8cbe9
4bab432979d731f8264bcd9d40422ca7dfcfcb0e0e703288db78bbfa555f853a
7c44d16799d95879584260e9b7413b94fa06d881de54544368ce030f3a979166
8a1170223599205267c6ee3a3072855f1727461d9dd1066bb94f39180f963af9
9ff538f72465724fc393ea1f3c03a17233c9b7e1d440d6f8a6d0b3a836c2a9cc
a8522b2e557ad1601ce48c2c4d8fca88df648927064ad2935db1dd4474b21d64
bcef8e8caa13a877a02a093cdab0c630a5c97b100e2a83a0c435d1128972c635
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ff7378b49edaa8d2de31ab71c8c266b3ce0bdbc5cf2e3e164ef67c84d4807450