blog.huntresslabs.com Open in urlscan Pro
52.4.225.124 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
Effective URL:
https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
Submission: On January 22 via api (January 22nd 2020, 7:13:05 pm UTC) from US

Summary HTTP 68 Redirects Links 35 Behaviour Indicators

Summary

This website contacted 13 IPs in 3 countries across 10 domains to perform 68 HTTP transactions. The main IP is 52.4.225.124, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is blog.huntresslabs.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on December 30th 2019. Valid for: a year.

This is the only time blog.huntresslabs.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 6	52.4.225.124 52.4.225.124	14618 (AMAZON-AES) (AMAZON-AES)
1 1	2606:4700::68... 2606:4700::6810:7b7f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:6c0... 2a02:26f0:6c00:183::13b8	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
29	2606:4700::68... 2606:4700::6810:7691	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:814::200e	15169 (GOOGLE) (GOOGLE)
10	104.16.89.50 104.16.89.50	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.222.149.161 52.222.149.161	16509 (AMAZON-02) (AMAZON-02)
1	52.222.155.29 52.222.155.29	16509 (AMAZON-02) (AMAZON-02)
2	52.203.142.184 52.203.142.184	14618 (AMAZON-AES) (AMAZON-AES)
1	2600:9000:204... 2600:9000:2047:6000:19:9934:6a80:93a1	16509 (AMAZON-02) (AMAZON-02)
4	2600:9000:204... 2600:9000:2047:e000:11:f728:3040:93a1	16509 (AMAZON-02) (AMAZON-02)
10	34.196.15.163 34.196.15.163	14618 (AMAZON-AES) (AMAZON-AES)
2	34.206.28.113 34.206.28.113	14618 (AMAZON-AES) (AMAZON-AES)
68	13

6 52.4.225.124 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-4-225-124.compute-1.amazonaws.com

blog.huntresslabs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:7b7f (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:183::13b8 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

cdn.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

29 2606:4700::6810:7691 (United States)

ASN13335 (CLOUDFLARENET, US)

glyph.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
miro.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn-client.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:814::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 104.16.89.50 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.embedly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.149.161 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-149-161.fra53.r.cloudfront.net

d1z2jf7jlzjs58.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.155.29 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-155-29.fra53.r.cloudfront.net

cdn.branch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.203.142.184 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-203-142-184.compute-1.amazonaws.com

srv-2020-01-22-19.pixel.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2047:6000:19:9934:6a80:93a1 (United States)

ASN16509 (AMAZON-02, US)

app.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:2047:e000:11:f728:3040:93a1 (United States)

ASN16509 (AMAZON-02, US)

api2.branch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 34.196.15.163 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-196-15-163.compute-1.amazonaws.com

collector-medium.lightstep.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.206.28.113 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-206-28-113.compute-1.amazonaws.com

errors.client.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
30	medium.com 1 redirects medium.com glyph.medium.com miro.medium.com cdn-client.medium.com	721 KB
10	lightstep.com collector-medium.lightstep.com	2 KB
10	embedly.com cdn.embedly.com
6	huntresslabs.com 1 redirects blog.huntresslabs.com	31 KB
5	branch.io cdn.branch.io api2.branch.io	24 KB
3	optimizely.com cdn.optimizely.com errors.client.optimizely.com	81 KB
2	parsely.com srv-2020-01-22-19.pixel.parsely.com	765 B
2	google-analytics.com www.google-analytics.com	18 KB
1	app.link app.link	720 B
1	cloudfront.net d1z2jf7jlzjs58.cloudfront.net	17 KB
68	10

	Domain	Requested by
13	miro.medium.com	blog.huntresslabs.com
10	collector-medium.lightstep.com	cdn-client.medium.com blog.huntresslabs.com
10	cdn.embedly.com	blog.huntresslabs.com cdn-client.medium.com
10	cdn-client.medium.com	blog.huntresslabs.com cdn-client.medium.com
6	glyph.medium.com	blog.huntresslabs.com
6	blog.huntresslabs.com	1 redirects cdn-client.medium.com
4	api2.branch.io	cdn-client.medium.com
2	errors.client.optimizely.com	cdn-client.medium.com
2	srv-2020-01-22-19.pixel.parsely.com	d1z2jf7jlzjs58.cloudfront.net
2	www.google-analytics.com	blog.huntresslabs.com
1	app.link	cdn.branch.io
1	cdn.branch.io	blog.huntresslabs.com
1	d1z2jf7jlzjs58.cloudfront.net	cdn-client.medium.com
1	cdn.optimizely.com	blog.huntresslabs.com
1	medium.com	1 redirects
68	15

This site contains links to these domains. Also see Links.

Domain
medium.com
huntresslabs.com
www.hackerone.com
www.bishopfox.com
www.reddit.com
cve.mitre.org
www.youtube.com
docs.connectwise.com
help.medium.com

Subject Issuer	Validity	Valid
blog.huntresslabs.com Sectigo RSA Domain Validation Secure Server CA	`2019-12-30` - `2020-12-29`	a year	crt.sh
cdn.optimizely.com DigiCert ECC Secure Server CA	`2018-11-24` - `2020-02-23`	a year	crt.sh
*.medium.com DigiCert SHA2 Secure Server CA	`2018-07-31` - `2020-09-09`	2 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2019-12-20` - `2020-03-13`	3 months	crt.sh
*.embedly.com Sectigo RSA Domain Validation Secure Server CA	`2019-09-11` - `2021-09-16`	2 years	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2019-07-17` - `2020-07-05`	a year	crt.sh
*.branch.io DigiCert SHA2 Secure Server CA	`2018-12-05` - `2020-12-08`	2 years	crt.sh
*.pixel.parsely.com Let's Encrypt Authority X3	`2019-12-02` - `2020-03-01`	3 months	crt.sh
appipv4.link Amazon	`2019-08-19` - `2020-09-19`	a year	crt.sh
*.lightstep.com Let's Encrypt Authority X3	`2019-11-26` - `2020-02-24`	3 months	crt.sh
errors.client.optimizely.com DigiCert SHA2 High Assurance Server CA	`2018-09-24` - `2020-09-28`	2 years	crt.sh

This page contains 11 frames:

Primary Page: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
Frame ID: 1B7F2FFDBD56C9216EDB491B843A3257
Requests: 62 HTTP requests in this frame

Frame: https://cdn.embedly.com/widgets/media.html?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DJ5mAsSHKg4o&src=https%3A%2F%2Fwww.youtube.com%2Fembed%2FJ5mAsSHKg4o&type=text%2Fhtml&key=a19fcc184b9711e1b4764040d3dc5c07&schema=youtube
Frame ID: E3E6AB3ABA49B213448E010017726FEE
Requests: 1 HTTP requests in this frame

Frame: https://cdn.embedly.com/widgets/media.html?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DJsWMkfvZSy4&src=https%3A%2F%2Fwww.youtube.com%2Fembed%2FJsWMkfvZSy4&type=text%2Fhtml&key=a19fcc184b9711e1b4764040d3dc5c07&schema=youtube
Frame ID: 2A625F015D999818B54AF303D0A04D26
Requests: 1 HTTP requests in this frame

Frame: https://cdn.embedly.com/widgets/media.html?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3Dg3z6noTDU78&src=https%3A%2F%2Fwww.youtube.com%2Fembed%2Fg3z6noTDU78&type=text%2Fhtml&key=a19fcc184b9711e1b4764040d3dc5c07&schema=youtube
Frame ID: 69AD23A79B311668F036FD05E7768199
Requests: 1 HTTP requests in this frame

Frame: https://cdn.embedly.com/widgets/media.html?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DgnDvusAnR90&src=https%3A%2F%2Fwww.youtube.com%2Fembed%2FgnDvusAnR90&type=text%2Fhtml&key=a19fcc184b9711e1b4764040d3dc5c07&schema=youtube
Frame ID: B0812D6BDACDE6711565AB0FBCF2180B
Requests: 1 HTTP requests in this frame

Frame: https://cdn.embedly.com/widgets/media.html?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3D8oDqQVzFTZo&src=https%3A%2F%2Fwww.youtube.com%2Fembed%2F8oDqQVzFTZo&type=text%2Fhtml&key=a19fcc184b9711e1b4764040d3dc5c07&schema=youtube
Frame ID: 9EB233C3ADAC52731D3E5310AEED2206
Requests: 1 HTTP requests in this frame

Frame: https://cdn.embedly.com/widgets/media.html?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DJ5mAsSHKg4o&src=https%3A%2F%2Fwww.youtube.com%2Fembed%2FJ5mAsSHKg4o&type=text%2Fhtml&key=a19fcc184b9711e1b4764040d3dc5c07&schema=youtube
Frame ID: 8D6B9CC2F08CE617DDAAD169FEF65431
Requests: 1 HTTP requests in this frame

Frame: https://cdn.embedly.com/widgets/media.html?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DJsWMkfvZSy4&src=https%3A%2F%2Fwww.youtube.com%2Fembed%2FJsWMkfvZSy4&type=text%2Fhtml&key=a19fcc184b9711e1b4764040d3dc5c07&schema=youtube
Frame ID: 0E3F37CBE5D10F8ADB8DC0067D292B2B
Requests: 1 HTTP requests in this frame

Frame: https://cdn.embedly.com/widgets/media.html?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3Dg3z6noTDU78&src=https%3A%2F%2Fwww.youtube.com%2Fembed%2Fg3z6noTDU78&type=text%2Fhtml&key=a19fcc184b9711e1b4764040d3dc5c07&schema=youtube
Frame ID: E9A4902456C9172A9781C748CD6BCC55
Requests: 1 HTTP requests in this frame

Frame: https://cdn.embedly.com/widgets/media.html?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DgnDvusAnR90&src=https%3A%2F%2Fwww.youtube.com%2Fembed%2FgnDvusAnR90&type=text%2Fhtml&key=a19fcc184b9711e1b4764040d3dc5c07&schema=youtube
Frame ID: 21911CF55115335C4100D62EFE1AB219
Requests: 1 HTTP requests in this frame

Frame: https://cdn.embedly.com/widgets/media.html?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3D8oDqQVzFTZo&src=https%3A%2F%2Fwww.youtube.com%2Fembed%2F8oDqQVzFTZo&type=text%2Fhtml&key=a19fcc184b9711e1b4764040d3dc5c07&schema=youtube
Frame ID: 3B7268F100AE544595C5FCFF2075282B
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34 HTTP 302
https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fblog.huntresslabs.com%2Fvalidati... HTTP 302
https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab... Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

68
Requests

100 %
HTTPS

46 %
IPv6

10
Domains

15
Subdomains

13
IPs

3
Countries

921 kB
Transfer

2666 kB
Size

8
Cookies

35 Outgoing links

These are links going to different origins than the main page.

URL: https://medium.com/?source=post_page-----9155eec36a34----------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Fblog.huntresslabs.com%2Fvalidating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34&source=post_page-----9155eec36a34---------------------nav_reg-
Title: Sign in

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.huntresslabs.com%2Fvalidating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34&source=post_page-----9155eec36a34---------------------nav_reg-
Title: Get started

Search URL Search Domain Scan URL

URL: https://huntresslabs.com/?source=post_page-----9155eec36a34----------------------
Title: Company

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.huntresslabs.com%2Fvalidating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34&source=-e522509ca8e0-------------------------follow_byline-
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/p/9155eec36a34/share/twitter?source=post_actions_header---------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/p/9155eec36a34/share/facebook?source=post_actions_header---------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.huntresslabs.com%2Fvalidating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34&source=post_actions_header--------------------------bookmark_sidebar-

Search URL Search Domain Scan URL

URL: https://www.hackerone.com/blog/What-Vulnerability-Disclosure-Policy-and-Why-You-Need-One
Title: vulnerability disclosure model

Search URL Search Domain Scan URL

URL: https://www.bishopfox.com/
Title: Bishop Fox

Search URL Search Domain Scan URL

URL: https://www.reddit.com/r/msp
Title: r/MSP

Search URL Search Domain Scan URL

URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16512
Title: CVE-2019-16512

Search URL Search Domain Scan URL

URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16517
Title: CVE-2019-16517

Search URL Search Domain Scan URL

URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16513
Title: CVE-2019-16513

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=uhWyzSzcdgs
Title: Tradecraft Tuesday

Search URL Search Domain Scan URL

URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16516
Title: CVE-2019-16516

Search URL Search Domain Scan URL

URL: https://docs.connectwise.com/ConnectWise_Control_Documentation/Release_notes/Release_notes_archive#ConnectWise_Control_2019.5
Title: release notes

Search URL Search Domain Scan URL

URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16514
Title: CVE-2019-16514

Search URL Search Domain Scan URL

URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16515
Title: CVE-2019-16515

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.huntresslabs.com%2Fvalidating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34&source=post_sidebar--------------------------follow_sidebar-
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.huntresslabs.com%2Fvalidating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34&source=post_sidebar-----9155eec36a34---------------------clap_sidebar-

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.huntresslabs.com%2Fvalidating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34&source=post_actions_footer-----9155eec36a34---------------------clap_footer-

Search URL Search Domain Scan URL

URL: https://medium.com/p/9155eec36a34/share/twitter?source=post_actions_footer---------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/p/9155eec36a34/share/facebook?source=post_actions_footer---------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.huntresslabs.com%2Fvalidating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34&source=post_actions_footer--------------------------bookmark_sidebar-

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.huntresslabs.com%2Fvalidating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34&source=follow_footer-e522509ca8e0-------------------------follow_footer-
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.huntresslabs.com%2Fvalidating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34&source=follow_footer--------------------------follow_footer-
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/p/9155eec36a34/responses/show?source=follow_footer--------------------------follow_footer-
Title: Write the first response

Search URL Search Domain Scan URL

URL: https://medium.com/about?autoplay=1&source=post_page-----9155eec36a34----------------------
Title: Discover Medium

Search URL Search Domain Scan URL

URL: https://medium.com/topics?source=post_page-----9155eec36a34----------------------
Title: Make Medium yours

Search URL Search Domain Scan URL

URL: https://medium.com/membership?source=post_page-----9155eec36a34----------------------
Title: Become a member

Search URL Search Domain Scan URL

URL: https://help.medium.com/?source=post_page-----9155eec36a34----------------------
Title: Help

Search URL Search Domain Scan URL

URL: https://medium.com/policy/9db0094a1e0f?source=post_page-----9155eec36a34----------------------
Title: Legal

Search URL Search Domain Scan URL

URL: https://medium.com/policy/f03bf92035c9
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34 HTTP 302
https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fblog.huntresslabs.com%2Fvalidating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34 HTTP 302
https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

68 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34 Show response
blog.huntresslabs.com/
Redirect Chain

https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fblog.huntresslabs.com%2Fvalidating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

157 KB
30 KB

838ms
838ms

Document
text/html

52.4.225.124
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.225.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-225-124.compute-1.amazonaws.com

Software

nginx /

Resource Hash

d1e7d63ccfbfa90f7c0d499e602cb230bbdbdbf321ab5c4e2f6baefd5b524dc0

Security Headers

Name	Value
X-Frame-Options	allow-from medium.com

Request headers

:method: GET
:authority: blog.huntresslabs.com
:scheme: https
:path: /validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
sec-fetch-mode: navigate
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User: ?1

Response headers

status: 200
server: nginx
date: Wed, 22 Jan 2020 19:12:47 GMT
content-type: text/html; charset=utf-8
set-cookie: optimizelyEndUserId=lo_svSViQq7vIIK; path=/; expires=Thu, 21 Jan 2021 19:12:46 GMT; secure uid=lo_svSViQq7vIIK; path=/; expires=Thu, 21 Jan 2021 19:12:46 GMT; secure; httponly sid=1:kKgHBSzdwVED0jvT8KzL0ZGjhevFhi3zKg0HwoTUWhTMmC/EiCi/kRzdhLRzyB52; path=/; expires=Thu, 21 Jan 2021 19:12:46 GMT; secure; httponly
sepia-upstream: production
x-frame-options: allow-from medium.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
medium-fulfilled-by: lite/master-20200122-163420-8d82bbd01e, rito/master-20200121-211710-eec99b13e3, tutu/medium-39771
etag: W/"275b8-laP20q9tAd+xuLs6p8sHPvgwnQg"
vary: Accept-Encoding
content-encoding: gzip
x-envoy-upstream-service-time: 601

Redirect headers

status: 302
date: Wed, 22 Jan 2020 19:12:46 GMT
content-type: application/octet-stream
set-cookie: __cfduid=d5f54b69cded495d062fdef45926cf8871579720366; expires=Fri, 21-Feb-20 19:12:46 GMT; path=/; domain=.medium.com; HttpOnly; SameSite=Lax uid=lo_svSViQq7vIIK; Expires=Thu, 21-Jan-21 19:12:46 GMT; Domain=.medium.com; Path=/; Secure; HttpOnly optimizelyEndUserId=lo_svSViQq7vIIK; path=/; expires=Thu, 21 Jan 2021 19:12:46 GMT; domain=.medium.com; secure sid=1:Ev4qQbCehjm0oLsIJ/vgRlOtf4FAWAFYTfbyccf6zXhX55OfYhC6gyXybwZA41HV; path=/; expires=Thu, 21 Jan 2021 19:12:46 GMT; domain=.medium.com; secure; httponly __cfruid=5c2ddbacb1ad82d502620709d12b3e7b0a346d5c-1579720366; path=/; domain=.medium.com; HttpOnly; Secure; SameSite=None
content-security-policy: default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://getpocket.com https://medium.com https://*.medium.com https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://*.lightstep.com https://*.branch.io 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
x-frame-options: sameorigin
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
x-powered-by: Medium
x-obvious-tid: 1579720366489:c926e6371bb6
x-obvious-info: 39761-c4f5868,c4f58684111
link: <https://medium.com/humans.txt>; rel="humans"
cache-control: no-cache, no-store, max-age=0, must-revalidate
expires: Thu, 09 Sep 1999 09:09:09 GMT
pragma: no-cache
location: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server: cloudflare
cf-ray: 5593d7620b78978a-FRA

GET
H2 200 16180790160.js Show response
cdn.optimizely.com/js/ 262 KB
81 KB 21ms
21ms Script
text/javascript 2a02:26f0:6c00:183::13b8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.optimizely.com/js/16180790160.js

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00:183::13b8 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

14122ac70338e22941e96d9b3ccb9bacedf93621af29cb5b4a01f20060367947

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

x-amz-meta-pci_enabled: False
x-amz-version-id: YWNXVMhVW2pCJ6V4ze3us9ThNRZ_u8RQ
content-encoding: gzip
x-amz-request-id: 709C2DAE8006AC6C
status: 200
access-control-max-age: 86400
date: Wed, 22 Jan 2020 19:12:47 GMT
x-amz-replication-status: COMPLETED
server-timing: cdn;desc="AkamaiION";dur=0,rtt;desc="4";dur=0,cdnip;desc="2a02:26f0:6c00:183::13b8";dur=0,cdnmap;desc="";dur=0,proto;desc="h2";dur=0
strict-transport-security: max-age=15768000
content-length: 81875
x-amz-id-2: db7wh4kCiph2FB4wt6CJHgc14kVGKKbDra3LP0hVnq9Ep7eZvEtvDn7pTcdhBg2EQzsMFC8+mTU=
last-modified: Fri, 17 Jan 2020 18:51:50 GMT
server: AmazonS3
etag: "71e6ee43edace25c9505168d0385097d"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: x-amz-meta-revision
cache-control: max-age=120
x-amz-meta-revision: 805
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: *

GET
H2 200 m2.css
glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/ 44 KB
29 KB 79ms
43ms Stylesheet
text/css 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

087a4c7aa118304c5ce85d5917d95a49b3c93204ef3500752dfde52595e4eac6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 22 Jan 2020 19:12:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2771
status: 200
access-control-max-age: 86400
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: text/css
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 5593d768ce40972a-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Wed, 22 Jan 2020 23:12:47 GMT

GET
H2 200 1*5p9fa3-8SsS1Q6SL86JtMw.jpeg
miro.medium.com/fit/c/96/96/ 4 KB
5 KB 47ms
28ms Image
image/jpeg 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/96/96/1*5p9fa3-8SsS1Q6SL86JtMw.jpeg

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

d89de618fb1b7b1bd0285cfaec0117e52477765486db9903ea6b54000f67e795

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 22 Jan 2020 19:12:47 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 9273
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3203-7aaf868
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 4580
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 5593d768bf82c2e0-FRA
expires: Fri, 21 Feb 2020 19:12:47 GMT

GET
H2 200 1*a0kTTrvjfhEoO6XxErJa5A.png
miro.medium.com/max/60/ 3 KB
3 KB 29ms
28ms Image
image/png 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*a0kTTrvjfhEoO6XxErJa5A.png?q=20

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

2c7143c3891c4c95a5563db6c7adca7edb86ce8d50ae77f696ac2b89433bf488

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 22 Jan 2020 19:12:47 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 8134
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3217-8161a0a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 2601
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 5593d7690892c2e0-FRA
expires: Fri, 21 Feb 2020 19:12:47 GMT

GET
H2 200 1*VJk6hfcDU65m86UvnanlYA.png
miro.medium.com/max/60/ 2 KB
2 KB 23ms
23ms Image
image/png 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*VJk6hfcDU65m86UvnanlYA.png?q=20

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

1c6f488cd9fe1b1e890ef37ac5a603654b2ef90d10ed588ebea9559e8e2051f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 22 Jan 2020 19:12:47 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 8134
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3217-8161a0a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 1547
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 5593d7690894c2e0-FRA
expires: Fri, 21 Feb 2020 19:12:47 GMT

GET
H2 200 1*Vtn6PgwAtA9W8tue7AWOZQ.png
miro.medium.com/max/60/ 1 KB
1 KB 28ms
27ms Image
image/png 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*Vtn6PgwAtA9W8tue7AWOZQ.png?q=20

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

b8cb1c1ead50abbb12a03b3bcb857c496115fa1987903ff10c428cf4c6148202

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 22 Jan 2020 19:12:47 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 8134
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3217-8161a0a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 1032
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 5593d76918c7c2e0-FRA
expires: Fri, 21 Feb 2020 19:12:47 GMT

GET
H2 200 1*5p9fa3-8SsS1Q6SL86JtMw.jpeg
miro.medium.com/fit/c/160/160/ 9 KB
9 KB 28ms
27ms Image
image/jpeg 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/160/160/1*5p9fa3-8SsS1Q6SL86JtMw.jpeg

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

920b288dc2dfa2b6e197fc04dd36620f3eb00968352015887a53fc9a12e95037

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 22 Jan 2020 19:12:47 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 9273
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3217-8161a0a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 8997
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 5593d76918c8c2e0-FRA
expires: Fri, 21 Feb 2020 19:12:47 GMT

GET
H2 200 1*f8S1wju71jruLWJ696yWtg.png
miro.medium.com/fit/c/160/160/ 22 KB
22 KB 43ms
42ms Image
image/png 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/160/160/1*f8S1wju71jruLWJ696yWtg.png

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

343b89a6c58ff9c12872df411be730370993e622936e181f94ea516aa0d0b4b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 22 Jan 2020 19:12:47 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 9273
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3217-8161a0a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 22404
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 5593d76918cac2e0-FRA
expires: Fri, 21 Feb 2020 19:12:47 GMT

GET
H2 200 manifest.52042b21.js Show response
cdn-client.medium.com/lite/static/js/ 4 KB
2 KB 25ms
22ms Script
application/javascript 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/manifest.52042b21.js

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9e61f0b2a6590757f19f4c9f305af89b4e6521e1cf2d5b79f2b14becf9c73de3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 22 Jan 2020 19:12:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 8726
cf-ray: 5593d76918e0c2e0-FRA
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: 4D64D429AAA8308B
x-amz-id-2: DCyQKNLx1Z+bzlisT9P8D3opsBwCo1uhNz1Rq/N9REAan4lFeU+nmmRombMOZmB9HFLrezcCZ+M=
last-modified: Wed, 22 Jan 2020 16:41:17 GMT
server: cloudflare
etag: W/"54172ee33219f35ea0949e10564e63a7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: 89xcdVxCoDkVA2H3nFGf9K4EKMwWSXNa
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Thu, 21 Jan 2021 19:12:47 GMT

GET
H2 200 vendors~main.a133fb80.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 757 KB
198 KB 43ms
41ms Script
application/javascript 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b79eb86973be4f5f4f0e13240d44fb3159feb6faf712f0182ad2b96acb1eee7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 22 Jan 2020 19:12:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 949501
cf-ray: 5593d76918d9c2e0-FRA
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: FB030BE5E21C5FAC
x-amz-id-2: u0Z03VoYgI5CiPwINr0zGoLACItlAwIh5tkDrpV28x6SMp19F7Z8cLNashqHOyfBWlI671SHW8g=
last-modified: Wed, 08 Jan 2020 22:18:08 GMT
server: cloudflare
etag: W/"20d4b9213c56b87279628c2a70dc16fc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: _CxpRTIbxXS3UIsnGI_SaWk1BSxRkH6x
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Thu, 21 Jan 2021 19:12:47 GMT

GET
H2 200 main.a30a5a3f.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 446 KB
102 KB 39ms
37ms Script
application/javascript 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/main.a30a5a3f.chunk.js

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

712b8612b91836e2616f580efa550f1ffb02a2cde6a7d283c6e72fc2c90aacf5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 22 Jan 2020 19:12:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 64727
cf-ray: 5593d76918dcc2e0-FRA
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: 2A7533E92672D2AE
x-amz-id-2: j2zhnVZuoWD8Jq5cIKSUfj3oUn1Rv8UbCWPQeo6yhJiRish5YkhsaraHwoQo4qCy3AS9s1T5IJo=
last-modified: Wed, 22 Jan 2020 01:07:46 GMT
server: cloudflare
etag: W/"bfda1eadf57f9464f4805291b9b2a570"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: _.aweb919erQquxz_4O6f_za1XCrCO1e
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Thu, 21 Jan 2021 19:12:47 GMT

GET
H2 200 vendors~screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~scre~3e410f11.d2f0cb5c.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 38 KB
16 KB 31ms
30ms Script
application/javascript 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/vendors~screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~scre~3e410f11.d2f0cb5c.chunk.js

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ec658154249e4a8085e4db08af846b60a435a18504352bb8f002d889e70ece2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 22 Jan 2020 19:12:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 507615
cf-ray: 5593d76918dec2e0-FRA
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: 29F3D495C30F835E
x-amz-id-2: MvWcRT51ZvS5o6QdG0DhPHf3r/WRxyq7WGy+W7T/kThgEmeUqKQ66Yf1JrrPffgWAPWRpwtf324=
last-modified: Thu, 05 Dec 2019 21:58:46 GMT
server: cloudflare
etag: W/"8b9fec58d0bdfd692d5c65e3b37f33bf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: sJq85UZn_PUcguJu9c1aJgvrnhAD7C9I
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Thu, 21 Jan 2021 19:12:47 GMT

GET
H2 200 screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~screen.post~~4767c889.4d21fc30.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 21 KB
6 KB 29ms
28ms Script
application/javascript 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~screen.post~~4767c889.4d21fc30.chunk.js

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d0a78ec5c8405f41bd3d8f99b2dd29582c71654239481045a0bea702ecf9f45

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 22 Jan 2020 19:12:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 687661
cf-ray: 5593d76918d4c2e0-FRA
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: 0EB0643EF47DCCCE
x-amz-id-2: QDgQ4To/E5pXcnIXUkrpQOsDo2bo+HqLVsyrC7jjSDiAdoIR5k6QLja4H34fpT1SvJn7GBZuC1I=
last-modified: Tue, 14 Jan 2020 20:02:34 GMT
server: cloudflare
etag: W/"b13a54db4ed422cb7219d4dcfbe4104e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: 8iFF5XfocnZ823LtrhoEznyziPaL7YP9
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Thu, 21 Jan 2021 19:12:47 GMT

GET
H2 200 screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~screen.post~~73c4bb05.0f4ca7ad.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 119 KB
31 KB 27ms
26ms Script
application/javascript 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~screen.post~~73c4bb05.0f4ca7ad.chunk.js

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a30e9cc321fd5973225b187d57053c1407cd873883fe2e77271136904947176e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 22 Jan 2020 19:12:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 11906
cf-ray: 5593d76918cfc2e0-FRA
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: CEFA18CC8B4E0882
x-amz-id-2: OCbZ+9RKaE+lCuSGv6hpUKwWZx7160uOefMR6T4dXvdAnHjx5C1tS/KF0q3/P5JLto00d68CJBw=
last-modified: Wed, 22 Jan 2020 15:37:07 GMT
server: cloudflare
etag: W/"b7fb95587902a672732a97f45a3911f1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: 8FX4pUMlZzmKqBIcRd73OV5ON7nAmW26
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Thu, 21 Jan 2021 19:12:47 GMT

GET
H2 200 screen.post~screen.post.amp~screen.profile~screen.sequence.library~screen.sequence.post~screen.stori~aba94ffa.bf92b718.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 50 KB
15 KB 19ms
19ms Script
application/javascript 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/screen.post~screen.post.amp~screen.profile~screen.sequence.library~screen.sequence.post~screen.stori~aba94ffa.bf92b718.chunk.js

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9a9ff83692d5ab575cd14a5fc28d2713a75f8de6cab95265efc8893c55152d8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 22 Jan 2020 19:12:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 64727
cf-ray: 5593d7693956c2e0-FRA
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: FB68D31764DA9BAC
x-amz-id-2: alisPwAJEebx3Z1JqZO3GdPg4kYPLwb7Q/Lj2S2AwAIUByJtYwDqxQDl7TCqYDwYtyD3PQSLI/k=
last-modified: Wed, 22 Jan 2020 01:07:55 GMT
server: cloudflare
etag: W/"71004c07b4c22d77a7d134eef83b51fe"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: giA.zEezdyffAtS1ZHOa0uzY6RXRCaEC
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Thu, 21 Jan 2021 19:12:47 GMT

GET
H2 200 screen.post.62e4dba5.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 272 KB
62 KB 27ms
27ms Script
application/javascript 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/screen.post.62e4dba5.chunk.js

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

97a399f5816c0bbd9b7af9e3359eb25882e587e5d15de5f54f931ab49a1954ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 22 Jan 2020 19:12:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 8726
cf-ray: 5593d7694972c2e0-FRA
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: 1675150B085C4301
x-amz-id-2: cldC0/bmx4MFkKK8ABbr3/bd0r6d+79m31Mnz67z9dxttmaQv/nzXlnN/yWqWO1FVm7HSpBI4R0=
last-modified: Wed, 22 Jan 2020 16:41:21 GMT
server: cloudflare
etag: W/"9ce66364a6f67342e2c1d0d25fa70483"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: D60vOfsIyGJjCtoRGckXQ5TfCGpHDxNg
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Thu, 21 Jan 2021 19:12:47 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:814::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 19 Aug 2019 17:22:41 GMT
server: Golfe2
age: 2354
date: Wed, 22 Jan 2020 18:33:33 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 17803
expires: Wed, 22 Jan 2020 20:33:33 GMT

GET
H/1.1 200
OK Cookie set media.html
cdn.embedly.com/widgets/ Frame E3E6 0
0 102ms
28ms Document
text/html 104.16.89.50
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.embedly.com/widgets/media.html?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DJ5mAsSHKg4o&src=https%3A%2F%2Fwww.youtube.com%2Fembed%2FJ5mAsSHKg4o&type=text%2Fhtml&key=a19fcc184b9711e1b4764040d3dc5c07&schema=youtube
Requested by: Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.89.50 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Host: cdn.embedly.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Response headers

Date: Wed, 22 Jan 2020 19:12:47 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d26c60aaf83f41da6369295bdbb4852c81579720367; expires=Fri, 21-Feb-20 19:12:47 GMT; path=/; domain=.embedly.com; HttpOnly; SameSite=Lax
x-amz-id-2: oGHqkeD6sOqRO5B736L76Tpx0B2oSKHXonbwjmLKRf9LXSMUrEK3JnxaNKzUuWjRUXIeA/OfDx0=
x-amz-request-id: B7A52655DB142303
Last-Modified: Thu, 31 Oct 2019 19:31:11 GMT
Cache-Control: public, max-age=300
x-amz-version-id: VTRBoX4s561i5YJtWTkPuO_iPoXIkWqG
CF-Cache-Status: HIT
Expires: Wed, 22 Jan 2020 19:17:47 GMT
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 5593d7699ffec795-AMS
Content-Encoding: gzip

GET
H/1.1 200
OK Cookie set media.html
cdn.embedly.com/widgets/ Frame 2A62 0
0 101ms
27ms Document
text/html 104.16.89.50
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.embedly.com/widgets/media.html?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DJsWMkfvZSy4&src=https%3A%2F%2Fwww.youtube.com%2Fembed%2FJsWMkfvZSy4&type=text%2Fhtml&key=a19fcc184b9711e1b4764040d3dc5c07&schema=youtube
Requested by: Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.89.50 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Host: cdn.embedly.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Response headers

Date: Wed, 22 Jan 2020 19:12:47 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=db47941eb99cc5c853ada8e72e761d7641579720367; expires=Fri, 21-Feb-20 19:12:47 GMT; path=/; domain=.embedly.com; HttpOnly; SameSite=Lax
x-amz-id-2: oGHqkeD6sOqRO5B736L76Tpx0B2oSKHXonbwjmLKRf9LXSMUrEK3JnxaNKzUuWjRUXIeA/OfDx0=
x-amz-request-id: B7A52655DB142303
Last-Modified: Thu, 31 Oct 2019 19:31:11 GMT
Cache-Control: public, max-age=300
x-amz-version-id: VTRBoX4s561i5YJtWTkPuO_iPoXIkWqG
CF-Cache-Status: HIT
Expires: Wed, 22 Jan 2020 19:17:47 GMT
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 5593d769980fc837-AMS
Content-Encoding: gzip

GET
H/1.1 200
OK Cookie set media.html
cdn.embedly.com/widgets/ Frame 69AD 0
0 105ms
30ms Document
text/html 104.16.89.50
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.embedly.com/widgets/media.html?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3Dg3z6noTDU78&src=https%3A%2F%2Fwww.youtube.com%2Fembed%2Fg3z6noTDU78&type=text%2Fhtml&key=a19fcc184b9711e1b4764040d3dc5c07&schema=youtube
Requested by: Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.89.50 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Host: cdn.embedly.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Response headers

Date: Wed, 22 Jan 2020 19:12:47 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=de65fd1a5a6e189c454b0109d7d12dc971579720367; expires=Fri, 21-Feb-20 19:12:47 GMT; path=/; domain=.embedly.com; HttpOnly; SameSite=Lax
x-amz-id-2: oGHqkeD6sOqRO5B736L76Tpx0B2oSKHXonbwjmLKRf9LXSMUrEK3JnxaNKzUuWjRUXIeA/OfDx0=
x-amz-request-id: B7A52655DB142303
Last-Modified: Thu, 31 Oct 2019 19:31:11 GMT
Cache-Control: public, max-age=300
x-amz-version-id: VTRBoX4s561i5YJtWTkPuO_iPoXIkWqG
CF-Cache-Status: HIT
Expires: Wed, 22 Jan 2020 19:17:47 GMT
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 5593d769abf19c03-AMS
Content-Encoding: gzip

GET
H/1.1 200
OK Cookie set media.html
cdn.embedly.com/widgets/ Frame B081 0
0 113ms
38ms Document
text/html 104.16.89.50
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.embedly.com/widgets/media.html?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DgnDvusAnR90&src=https%3A%2F%2Fwww.youtube.com%2Fembed%2FgnDvusAnR90&type=text%2Fhtml&key=a19fcc184b9711e1b4764040d3dc5c07&schema=youtube
Requested by: Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.89.50 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Host: cdn.embedly.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Response headers

Date: Wed, 22 Jan 2020 19:12:47 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d74ebf3aaade43d993449e5ef26fea3ba1579720367; expires=Fri, 21-Feb-20 19:12:47 GMT; path=/; domain=.embedly.com; HttpOnly; SameSite=Lax
x-amz-id-2: oGHqkeD6sOqRO5B736L76Tpx0B2oSKHXonbwjmLKRf9LXSMUrEK3JnxaNKzUuWjRUXIeA/OfDx0=
x-amz-request-id: B7A52655DB142303
Last-Modified: Thu, 31 Oct 2019 19:31:11 GMT
Cache-Control: public, max-age=300
x-amz-version-id: VTRBoX4s561i5YJtWTkPuO_iPoXIkWqG
CF-Cache-Status: HIT
Expires: Wed, 22 Jan 2020 19:17:47 GMT
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 5593d769adab2b98-AMS
Content-Encoding: gzip

GET
H/1.1 200
OK Cookie set media.html
cdn.embedly.com/widgets/ Frame 9EB2 0
0 132ms
54ms Document
text/html 104.16.89.50
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.embedly.com/widgets/media.html?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3D8oDqQVzFTZo&src=https%3A%2F%2Fwww.youtube.com%2Fembed%2F8oDqQVzFTZo&type=text%2Fhtml&key=a19fcc184b9711e1b4764040d3dc5c07&schema=youtube
Requested by: Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.89.50 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Host: cdn.embedly.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Response headers

Date: Wed, 22 Jan 2020 19:12:47 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=dc5f86b51297928e613a2bce0da4ce4641579720367; expires=Fri, 21-Feb-20 19:12:47 GMT; path=/; domain=.embedly.com; HttpOnly; SameSite=Lax
x-amz-id-2: oGHqkeD6sOqRO5B736L76Tpx0B2oSKHXonbwjmLKRf9LXSMUrEK3JnxaNKzUuWjRUXIeA/OfDx0=
x-amz-request-id: B7A52655DB142303
Last-Modified: Thu, 31 Oct 2019 19:31:11 GMT
Cache-Control: public, max-age=300
x-amz-version-id: VTRBoX4s561i5YJtWTkPuO_iPoXIkWqG
CF-Cache-Status: HIT
Expires: Wed, 22 Jan 2020 19:17:47 GMT
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 5593d769aa1bd8c1-AMS
Content-Encoding: gzip

GET
DATA 200
OK truncated
/ 156 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4c0cc04185396c9a83cfda3644c23327d7d8ff9247157c438575b83713894173

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 9 KB
9 KB Font
font/opentype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 99c5448d6c84fc71d6805e2485727db250113edcaea123a064f8c26ce95947d8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Origin: https://blog.huntresslabs.com

Response headers

Content-Type: font/opentype

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
font/opentype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1ed6a034a5055a869c7c25765ee1f2844a27a54e83e8a857d77b3f1cd83dd3

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Origin: https://blog.huntresslabs.com

Response headers

Content-Type: font/opentype

GET
H2 200 fell-400-normal.woff
glyph.medium.com/font/78ce731/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 14 KB
15 KB 49ms
32ms Font
application/font-woff 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/78ce731/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/fell-400-normal.woff

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f57137897a4e676f0d2199b79def1a95b253a1a938dff9d8ba10519f3beb2b08

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://blog.huntresslabs.com

Response headers

date: Wed, 22 Jan 2020 19:12:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 128
status: 200
access-control-max-age: 86400
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 5593d76948f3975a-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Thu, 21 Jan 2021 19:12:47 GMT

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
font/opentype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a3d669b687929b3aa777fdd2c400c2b8c6b794978536a64d7e1f71edcf8037e8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Origin: https://blog.huntresslabs.com

Response headers

Content-Type: font/opentype

GET
H2 200 charter-400-italic.woff
glyph.medium.com/font/81d2bf1/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 10 KB
11 KB 53ms
36ms Font
application/font-woff 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/81d2bf1/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/charter-400-italic.woff

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f0b9a9e4ea994c106a4fc595828ca1332b2cd0435d5d159d26d1773344d97367

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://blog.huntresslabs.com

Response headers

date: Wed, 22 Jan 2020 19:12:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 128
status: 200
access-control-max-age: 86400
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 5593d76948f8975a-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Thu, 21 Jan 2021 19:12:47 GMT

GET
H2 200 marat-sans-300-italic.woff
glyph.medium.com/font/24e0824/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 10 KB
10 KB 60ms
43ms Font
application/font-woff 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/24e0824/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/marat-sans-300-italic.woff

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84a548a3f01f6d92045be9ae44e89520ed11505928139d831749385a36aee74c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://blog.huntresslabs.com

Response headers

date: Wed, 22 Jan 2020 19:12:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 128
status: 200
access-control-max-age: 86400
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 5593d76948f6975a-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Thu, 21 Jan 2021 19:12:47 GMT

GET
H2 200 marat-sans-400-normal.woff
glyph.medium.com/font/d8659c9/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/ 14 KB
14 KB 47ms
38ms Font
application/font-woff 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/d8659c9/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/marat-sans-400-normal.woff

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

12fe85ec038af8c41ba830412520589dbd125d417913c10a57838ac92ab96192

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://blog.huntresslabs.com

Response headers

date: Wed, 22 Jan 2020 19:12:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 128
status: 200
access-control-max-age: 86400
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 5593d76948fa975a-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Thu, 21 Jan 2021 19:12:47 GMT

GET
H2 200 charter-400-normal.woff
glyph.medium.com/font/be78681/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/ 19 KB
19 KB 36ms
33ms Font
application/font-woff 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/be78681/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/charter-400-normal.woff

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc72a2ca45067a3d17fed4cd8776fec5dca3b9ecd7300e107f9256a86a0c8b2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://blog.huntresslabs.com

Response headers

date: Wed, 22 Jan 2020 19:12:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 128
status: 200
access-control-max-age: 86400
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 5593d76948f5975a-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Thu, 21 Jan 2021 19:12:47 GMT

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
101 B 13ms
13ms Image
image/gif 2a00:1450:4001:814::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j79&a=2078480096&t=pageview&_s=1&dl=https%3A%2F%2Fblog.huntresslabs.com%2Fvalidating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34%3Fgi%3Dab63b7045d06&ul=en-us&de=UTF-8&dt=Validating%20the%20Bishop%20Fox%20Findings%20in%20ConnectWise%20Control&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAEAB~&jid=274700889&gjid=1397272945&cid=1280669512.1579720368&tid=UA-24232453-2&_gid=1206903569.1579720368&_r=1&z=1490094995

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Jan 2020 19:12:47 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 graphql Show response
blog.huntresslabs.com/_/ 23 B
289 B 151ms
151ms Fetch
application/json 52.4.225.124
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.huntresslabs.com/_/graphql
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.4.225.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-225-124.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 200b0d8fe8fe88aa3678c4a7b0bc5dcd391a7fac8d091103acd20f15a0244c00

Request headers

apollographql-client-name: lite
Medium-Frontend-Route: post
Origin: https://blog.huntresslabs.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Graphql-Operation: InteractivePostBodyQuery
content-type: application/json
accept: */*
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
Medium-Frontend-App: lite/master-20200122-163420-8d82bbd01e
apollographql-client-version: master-20200122-163420-8d82bbd01e

Response headers

date: Wed, 22 Jan 2020 19:12:48 GMT
sepia-upstream: production
server: nginx
etag: W/"17-jFAB8lIUHV6I3JuU9U/ODIAxxmw"
status: 200
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: rito/master-20200121-211710-eec99b13e3, tutu/medium-39772
x-envoy-upstream-service-time: 39
content-length: 23
x-request-received-at: 1579720368077

POST
H2 200 client-ready
blog.huntresslabs.com/_/lite/performance/ 2 B
0 110ms
110ms Fetch
text/plain 52.4.225.124
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.huntresslabs.com/_/lite/performance/client-ready

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.a30a5a3f.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.225.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-225-124.compute-1.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	allow-from medium.com

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
Origin: https://blog.huntresslabs.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 22 Jan 2020 19:12:48 GMT
sepia-upstream: production
server: nginx
x-frame-options: allow-from medium.com
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
status: 200
cache-control: no-cache, no-store, max-age=0, must-revalidate
x-envoy-upstream-service-time: 1
medium-fulfilled-by: lite/master-20200122-163420-8d82bbd01e
content-length: 2

GET
H2 200 vendors~tracing.6badc2b7.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 62 KB
16 KB 33ms
20ms Script
application/javascript 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/vendors~tracing.6badc2b7.chunk.js

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/manifest.52042b21.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cf286b2a4add532c3cdef294dc5407b149042bcad1544c884def577790d0e515

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 22 Jan 2020 19:12:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 163059
cf-ray: 5593d76d8e46c2e0-FRA
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: B4C0A507B7346689
x-amz-id-2: jKk0Z6Ewm+3kOQ5J13vmIN9cuDiiMCEjR4MrLi1k1E0WUl4JIFrkJ93xwGGftwDm9PwgE0u5ELc=
last-modified: Fri, 20 Dec 2019 19:02:36 GMT
server: cloudflare
etag: W/"aaf7e39d80f407d31957292cb916fccb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: SCYmmygTDmaf02dfBEPSsZKrrumZjm_D
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Thu, 21 Jan 2021 19:12:48 GMT

GET
H2 200 tracing.61367508.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 2 KB
1 KB 41ms
28ms Script
application/javascript 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/tracing.61367508.chunk.js

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/manifest.52042b21.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ab22cfbee907f4027d8ab50ae662112d445d32a98a4d36152695b0a3ec148377

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 22 Jan 2020 19:12:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 756951
cf-ray: 5593d76daeabc2e0-FRA
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: BE6B7F2DD9832129
x-amz-id-2: rcngygqAcZXPmlKeEMWAJzc1jhMaaBoYNomV6ouZe+4o9NH2gghpmUypLttiv/utW0wY6RTc1ds=
last-modified: Tue, 14 Jan 2020 00:48:30 GMT
server: cloudflare
etag: W/"c0b5ac519b4f0dbbab772e332a5eabff"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: UhJC7_KAg7P9_mOWHiSkV7ZnSzes2OYV
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Thu, 21 Jan 2021 19:12:48 GMT

GET
H/1.1 200
OK p.js Show response
d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/ 41 KB
17 KB 93ms
23ms Script
application/x-javascript 52.222.149.161
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/p.js
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.a30a5a3f.chunk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.149.161 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-149-161.fra53.r.cloudfront.net
Software: nginx /
Resource Hash: 58711bafae315df048e1bc0c36ae1dfd017810b34fd9b4b021f774694397baad

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Wed, 22 Jan 2020 18:19:23 GMT
Content-Encoding: gzip
Age: 3203
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Pragma: public
Last-Modified: Mon, 07 Oct 2019 18:17:48 GMT
Server: nginx
ETag: "5d9b814c-a469"
Content-Type: application/x-javascript
Via: 1.1 4d1cbe225c5d30aa78ec9a6fa1ba4211.cloudfront.net (CloudFront)
Cache-Control: max-age=86400, public
X-Amz-Cf-Pop: FRA53
X-Amz-Cf-Id: mVrrU6vW3dtpairNjTksspy_8oRwaOCcpwG4ALSqfJE4w8xwgSogxA==
Expires: Thu, 23 Jan 2020 18:19:23 GMT

GET
H/1.1 200
OK Cookie set media.html
cdn.embedly.com/widgets/ Frame 8D6B 0
0 31ms
31ms Document
text/html 104.16.89.50
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.embedly.com/widgets/media.html?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DJ5mAsSHKg4o&src=https%3A%2F%2Fwww.youtube.com%2Fembed%2FJ5mAsSHKg4o&type=text%2Fhtml&key=a19fcc184b9711e1b4764040d3dc5c07&schema=youtube
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.89.50 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Host: cdn.embedly.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34

Response headers

Date: Wed, 22 Jan 2020 19:12:48 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d09066d6ed82acd811f835429147d898b1579720368; expires=Fri, 21-Feb-20 19:12:48 GMT; path=/; domain=.embedly.com; HttpOnly; SameSite=Lax
x-amz-id-2: oGHqkeD6sOqRO5B736L76Tpx0B2oSKHXonbwjmLKRf9LXSMUrEK3JnxaNKzUuWjRUXIeA/OfDx0=
x-amz-request-id: B7A52655DB142303
Last-Modified: Thu, 31 Oct 2019 19:31:11 GMT
Cache-Control: public, max-age=300
x-amz-version-id: VTRBoX4s561i5YJtWTkPuO_iPoXIkWqG
CF-Cache-Status: HIT
Expires: Wed, 22 Jan 2020 19:17:48 GMT
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 5593d7708823d8c1-AMS
Content-Encoding: gzip

GET
H/1.1 200
OK Cookie set media.html
cdn.embedly.com/widgets/ Frame 0E3F 0
0 29ms
28ms Document
text/html 104.16.89.50
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.embedly.com/widgets/media.html?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DJsWMkfvZSy4&src=https%3A%2F%2Fwww.youtube.com%2Fembed%2FJsWMkfvZSy4&type=text%2Fhtml&key=a19fcc184b9711e1b4764040d3dc5c07&schema=youtube
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.89.50 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Host: cdn.embedly.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34

Response headers

Date: Wed, 22 Jan 2020 19:12:48 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d7b2d26acae1010cfe6e0c34eea58ce1c1579720368; expires=Fri, 21-Feb-20 19:12:48 GMT; path=/; domain=.embedly.com; HttpOnly; SameSite=Lax
x-amz-id-2: oGHqkeD6sOqRO5B736L76Tpx0B2oSKHXonbwjmLKRf9LXSMUrEK3JnxaNKzUuWjRUXIeA/OfDx0=
x-amz-request-id: B7A52655DB142303
Last-Modified: Thu, 31 Oct 2019 19:31:11 GMT
Cache-Control: public, max-age=300
x-amz-version-id: VTRBoX4s561i5YJtWTkPuO_iPoXIkWqG
CF-Cache-Status: HIT
Expires: Wed, 22 Jan 2020 19:17:48 GMT
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 5593d7709a0f2b98-AMS
Content-Encoding: gzip

GET
H/1.1 200
OK Cookie set media.html
cdn.embedly.com/widgets/ Frame E9A4 0
0 28ms
28ms Document
text/html 104.16.89.50
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.embedly.com/widgets/media.html?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3Dg3z6noTDU78&src=https%3A%2F%2Fwww.youtube.com%2Fembed%2Fg3z6noTDU78&type=text%2Fhtml&key=a19fcc184b9711e1b4764040d3dc5c07&schema=youtube
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.89.50 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Host: cdn.embedly.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34

Response headers

Date: Wed, 22 Jan 2020 19:12:48 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=dfe896b7ac454e62c84e58a26a56481371579720368; expires=Fri, 21-Feb-20 19:12:48 GMT; path=/; domain=.embedly.com; HttpOnly; SameSite=Lax
x-amz-id-2: oGHqkeD6sOqRO5B736L76Tpx0B2oSKHXonbwjmLKRf9LXSMUrEK3JnxaNKzUuWjRUXIeA/OfDx0=
x-amz-request-id: B7A52655DB142303
Last-Modified: Thu, 31 Oct 2019 19:31:11 GMT
Cache-Control: public, max-age=300
x-amz-version-id: VTRBoX4s561i5YJtWTkPuO_iPoXIkWqG
CF-Cache-Status: HIT
Expires: Wed, 22 Jan 2020 19:17:48 GMT
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 5593d7709c529c03-AMS
Content-Encoding: gzip

GET
H/1.1 200
OK Cookie set media.html
cdn.embedly.com/widgets/ Frame 2191 0
0 31ms
31ms Document
text/html 104.16.89.50
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.embedly.com/widgets/media.html?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DgnDvusAnR90&src=https%3A%2F%2Fwww.youtube.com%2Fembed%2FgnDvusAnR90&type=text%2Fhtml&key=a19fcc184b9711e1b4764040d3dc5c07&schema=youtube
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.89.50 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Host: cdn.embedly.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34

Response headers

Date: Wed, 22 Jan 2020 19:12:48 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d39b3f5f5bf1b95624486c6391ea863b71579720368; expires=Fri, 21-Feb-20 19:12:48 GMT; path=/; domain=.embedly.com; HttpOnly; SameSite=Lax
x-amz-id-2: oGHqkeD6sOqRO5B736L76Tpx0B2oSKHXonbwjmLKRf9LXSMUrEK3JnxaNKzUuWjRUXIeA/OfDx0=
x-amz-request-id: B7A52655DB142303
Last-Modified: Thu, 31 Oct 2019 19:31:11 GMT
Cache-Control: public, max-age=300
x-amz-version-id: VTRBoX4s561i5YJtWTkPuO_iPoXIkWqG
CF-Cache-Status: HIT
Expires: Wed, 22 Jan 2020 19:17:48 GMT
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 5593d7709d0ec795-AMS
Content-Encoding: gzip

GET
H/1.1 200
OK Cookie set media.html
cdn.embedly.com/widgets/ Frame 3B72 0
0 27ms
27ms Document
text/html 104.16.89.50
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.embedly.com/widgets/media.html?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3D8oDqQVzFTZo&src=https%3A%2F%2Fwww.youtube.com%2Fembed%2F8oDqQVzFTZo&type=text%2Fhtml&key=a19fcc184b9711e1b4764040d3dc5c07&schema=youtube
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.89.50 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Host: cdn.embedly.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34

Response headers

Date: Wed, 22 Jan 2020 19:12:48 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=dab30bf6571e5eb27672e2eb02ca6d0e01579720368; expires=Fri, 21-Feb-20 19:12:48 GMT; path=/; domain=.embedly.com; HttpOnly; SameSite=Lax
x-amz-id-2: oGHqkeD6sOqRO5B736L76Tpx0B2oSKHXonbwjmLKRf9LXSMUrEK3JnxaNKzUuWjRUXIeA/OfDx0=
x-amz-request-id: B7A52655DB142303
Last-Modified: Thu, 31 Oct 2019 19:31:11 GMT
Cache-Control: public, max-age=300
x-amz-version-id: VTRBoX4s561i5YJtWTkPuO_iPoXIkWqG
CF-Cache-Status: HIT
Expires: Wed, 22 Jan 2020 19:17:48 GMT
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 5593d7709cb2c837-AMS
Content-Encoding: gzip

GET
H2 200 1*5p9fa3-8SsS1Q6SL86JtMw.jpeg
miro.medium.com/fit/c/48/48/ 2 KB
2 KB 64ms
63ms Image
image/jpeg 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/48/48/1*5p9fa3-8SsS1Q6SL86JtMw.jpeg

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

fa85a251c253ef157df5b63bca1286383492aca6edab3933e031b607326f95d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 22 Jan 2020 19:12:48 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 126
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3209-f49543a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 1930
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 5593d7718a83c2e0-FRA
expires: Fri, 21 Feb 2020 19:12:48 GMT

GET
H2 200 1*a0kTTrvjfhEoO6XxErJa5A.png
miro.medium.com/max/30/ 887 B
1 KB 163ms
163ms Image
image/png 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/30/1*a0kTTrvjfhEoO6XxErJa5A.png?q=20

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

fef2eb5b7ae950bea823cef4f315a30cc435bb7725ef9d750cdacf0115383899

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 22 Jan 2020 19:12:49 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3217-8161a0a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 887
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 5593d7718a89c2e0-FRA
expires: Fri, 21 Feb 2020 19:12:49 GMT

GET
H2 200 1*VJk6hfcDU65m86UvnanlYA.png
miro.medium.com/max/30/ 475 B
544 B 115ms
115ms Image
image/png 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/30/1*VJk6hfcDU65m86UvnanlYA.png?q=20

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

d0822619e34c6c4ce38c34bb3811e80548f46233e354b7a402dec9a243b152eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 22 Jan 2020 19:12:48 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3217-8161a0a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 475
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 5593d7718a8cc2e0-FRA
expires: Fri, 21 Feb 2020 19:12:48 GMT

GET
H2 200 1*Vtn6PgwAtA9W8tue7AWOZQ.png
miro.medium.com/max/30/ 399 B
514 B 124ms
124ms Image
image/png 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/30/1*Vtn6PgwAtA9W8tue7AWOZQ.png?q=20

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

2b7fef67b497e0555303da2ee9d375ad3f00dd4a6ac92c7128f98a0b9c502867

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 22 Jan 2020 19:12:49 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3217-8161a0a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 399
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 5593d7718a8fc2e0-FRA
expires: Fri, 21 Feb 2020 19:12:49 GMT

GET
H2 200 1*5p9fa3-8SsS1Q6SL86JtMw.jpeg
miro.medium.com/fit/c/80/80/ 3 KB
4 KB 35ms
34ms Image
image/jpeg 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/80/80/1*5p9fa3-8SsS1Q6SL86JtMw.jpeg

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

0f71b6b261c1af1760bae411afc51482b33e374e8922ced93fe27ccfcd12f443

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 22 Jan 2020 19:12:48 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 126
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3209-f49543a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 3552
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 5593d7719a95c2e0-FRA
expires: Fri, 21 Feb 2020 19:12:48 GMT

GET
H2 200 1*f8S1wju71jruLWJ696yWtg.png
miro.medium.com/fit/c/80/80/ 8 KB
8 KB 35ms
35ms Image
image/png 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/80/80/1*f8S1wju71jruLWJ696yWtg.png

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

317ed2320bfe8866deff667bcf685186780bef521e5007b3c55a27c79dece113

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 22 Jan 2020 19:12:48 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 243312
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3217-8161a0a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 8377
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 5593d7719a96c2e0-FRA
expires: Fri, 21 Feb 2020 19:12:48 GMT

GET
H/1.1 200
OK branch-latest.min.js Show response
cdn.branch.io/ 72 KB
22 KB 111ms
23ms Script
text/javascript 52.222.155.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.branch.io/branch-latest.min.js
Requested by: Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34?gi=ab63b7045d06
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.155.29 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-155-29.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 200b68bbdf9c2da0d476171ed46ffab16cac6ee742582310438d511c7cd7d315

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

x-amz-version-id: u0SrVcR4IiRlieei1odV0xSiikdlv4ff
Content-Encoding: gzip
Last-Modified: Wed, 11 Dec 2019 00:16:44 GMT
Server: AmazonS3
Age: 214
ETag: "941dbbc68e8388cbb67f0663975777a3"
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Via: 1.1 831ce605dd77f58786c993787cdac90b.cloudfront.net (CloudFront)
Cache-Control: max-age=300
Date: Wed, 22 Jan 2020 19:09:18 GMT
X-Amz-Cf-Pop: FRA53
Connection: keep-alive
Content-Length: 21893
X-Amz-Cf-Id: -ddWWW08Vml5FxNkluiREmr_Cy8SZVXvHq89cV8av1tMNfk5vj6kQg==

GET
H2 200 1*a0kTTrvjfhEoO6XxErJa5A.png
miro.medium.com/max/1014/ 113 KB
113 KB 22ms
22ms Image
image/png 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/1014/1*a0kTTrvjfhEoO6XxErJa5A.png

Requested by

Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

ed5d87d8b9d3fe7851550cbaeec63ea560ad3b7ecc20f8a6cffedcd86d97761c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 22 Jan 2020 19:12:48 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 21553
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3217-8161a0a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 115782
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 5593d7721c1fc2e0-FRA
expires: Fri, 21 Feb 2020 19:12:48 GMT

GET
H/1.1 200
OK / Show response
srv-2020-01-22-19.pixel.parsely.com/start/ 77 B
380 B 543ms
126ms Script
application/json 52.203.142.184
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://srv-2020-01-22-19.pixel.parsely.com/start/?rand=1579720369106&plid=83408486&idsite=medium.com&url=https%3A%2F%2Fblog.huntresslabs.com%2Fvalidating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%22viewerStatus%22%3A%22visitor%22%7D&sid=1&surl=https%3A%2F%2Fblog.huntresslabs.com%2Fvalidating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34&sref=&sts=1579720369093&slts=0&title=Validating+the+Bishop+Fox+Findings+in+ConnectWise+Control&date=Wed+Jan+22+2020+20%3A12%3A49+GMT%2B0100+(Central+European+Standard+Time)&action=pageview&js=1&pvid=87380872&callback=parselyStartCallback
Requested by: Host: d1z2jf7jlzjs58.cloudfront.net
URL: https://d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/p.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.203.142.184 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-203-142-184.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 15c9f0ef234625c775e6e9ea3c57d28e51aeaa02a84c37c602d1eecaca9969b6

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Wed, 22 Jan 2020 19:12:49 GMT
Server: nginx
Connection: keep-alive
Content-Type: application/json
Content-Length: 77
P3P: CP="CUR ADM OUR NOR STA NID"

GET
H/1.1 200
OK _r Show response
app.link/ 90 B
720 B 185ms
162ms Script
text/javascript 2600:9000:2047:6000:19:9934:6a80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://app.link/_r?sdk=web2.52.3&branch_key=key_live_ofxXr2qTrrU9NqURK8ZwEhknBxiI6KBm&callback=branch_callback__0

Requested by

Host: cdn.branch.io
URL: https://cdn.branch.io/branch-latest.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:2047:6000:19:9934:6a80:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

openresty/1.13.6.2 / Express

Resource Hash

ba29bccfb867eaeae3555152ec7b16aa5488adb32734c024207ef2afd66c1292

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Wed, 22 Jan 2020 19:12:49 GMT
Via: 1.1 c0486ca54d4ad5a3da496bc2b5f49cd2.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Server: openresty/1.13.6.2
X-Amz-Cf-Pop: FRA53
X-Powered-By: Express
X-Cache: Miss from cloudfront
Content-Type: text/javascript; charset=utf-8
Connection: keep-alive
Content-Length: 90
ETag: W/"5a-mQjBX0epU5z7U/jKMGthtqmv0Wc"
X-Amz-Cf-Id: oVhxC0kjukXyU_fYvbjNCpOv1U74J875oR7B5Dl4zFmUqwp3UHp1Nw==

POST
H2 200 open Show response
api2.branch.io/v1/ 312 B
597 B 335ms
310ms XHR
application/json 2600:9000:2047:e000:11:f728:3040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/open
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2047:e000:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.13.6.2 /
Resource Hash: 75d9318cce08778c46789327f7c784a3d8b8f999291c219282077d129678dd7c

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
Origin: https://blog.huntresslabs.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 22 Jan 2020 19:12:49 GMT
via: 1.1 c483a0db2609b3ac0bb94a739fe72cc7.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-amz-cf-pop: FRA53
status: 200
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache
content-length: 312
x-amz-cf-id: kPb6lZaRDvqehi_9QkFX_CRmDdsnPCGMcIKasQDf_WNUf3Qh1ZxM6g==

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 336ms
104ms XHR
text/plain 34.196.15.163
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.196.15.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-196-15-163.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://blog.huntresslabs.com
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Wed, 22 Jan 2020 19:12:49 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
358 B 176ms
175ms XHR
application/json 2600:9000:2047:e000:11:f728:3040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/pageview
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2047:e000:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.13.6.2 / Express
Resource Hash: a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
Origin: https://blog.huntresslabs.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 22 Jan 2020 19:12:49 GMT
via: 1.1 c483a0db2609b3ac0bb94a739fe72cc7.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-amz-cf-pop: FRA53
x-powered-by: Express
etag: W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
status: 200
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
content-length: 28
x-amz-cf-id: 2IaZC0EVoRtGpY7DZiUOnLSnofL1jyE0T8t7yr3eXmfFeMhb1Q-NLg==

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
360 B 314ms
313ms XHR
application/json 2600:9000:2047:e000:11:f728:3040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/pageview
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2047:e000:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.13.6.2 / Express
Resource Hash: a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
Origin: https://blog.huntresslabs.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 22 Jan 2020 19:12:50 GMT
via: 1.1 c483a0db2609b3ac0bb94a739fe72cc7.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-amz-cf-pop: FRA53
x-powered-by: Express
etag: W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
status: 200
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
content-length: 28
x-amz-cf-id: y5PRvEFTOU-UnyUf1xJyq3C_aBGsnk2Q8pvrpxPVr4YZghlIwQQNYQ==

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 110ms
109ms XHR
application/json 34.196.15.163
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: blog.huntresslabs.com
URL: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.196.15.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-196-15-163.compute-1.amazonaws.com
Software: /
Resource Hash: 6a7c2c08499ab65ce3f502090e1345dad13334ea008dd08d28153bcb5a69e2b5

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
Origin: https://blog.huntresslabs.com
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Wed, 22 Jan 2020 19:12:50 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

OPTIONS
H/1.1 200
OK log Show response
errors.client.optimizely.com/ 13 B
413 B 111ms
111ms XHR
text/plain 34.206.28.113
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://errors.client.optimizely.com/log
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.206.28.113 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-206-28-113.compute-1.amazonaws.com
Software: /
Resource Hash: 16f1efa415bfdd7abcf8fdd76cc05ae6fa66ffdfdc730368ecea89ecfe5c3a12

Request headers

Access-Control-Request-Method: POST
Origin: https://blog.huntresslabs.com
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Access-Control-Request-Headers: content-type

Response headers

Date: Wed, 22 Jan 2020 19:12:50 GMT
Allow: POST,OPTIONS
Access-Control-Allow-Methods: GET,POST,OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://blog.huntresslabs.com
Access-Control-Max-Age: 1800
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: X-Requested-With,Content-Type,Accept,Origin
Content-Length: 13

POST
H2 200 render
blog.huntresslabs.com/_/lite/performance/ 2 B
0 121ms
121ms Fetch
text/plain 52.4.225.124
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.huntresslabs.com/_/lite/performance/render

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.a30a5a3f.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.225.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-225-124.compute-1.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	allow-from medium.com

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
Origin: https://blog.huntresslabs.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 22 Jan 2020 19:12:50 GMT
sepia-upstream: production
server: nginx
x-frame-options: allow-from medium.com
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
status: 200
cache-control: no-cache, no-store, max-age=0, must-revalidate
x-envoy-upstream-service-time: 10
medium-fulfilled-by: lite/master-20200122-163420-8d82bbd01e
content-length: 2

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
359 B 222ms
222ms XHR
application/json 2600:9000:2047:e000:11:f728:3040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/pageview
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2047:e000:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.13.6.2 / Express
Resource Hash: a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
Origin: https://blog.huntresslabs.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 22 Jan 2020 19:12:50 GMT
via: 1.1 c483a0db2609b3ac0bb94a739fe72cc7.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-amz-cf-pop: FRA53
x-powered-by: Express
etag: W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
status: 200
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
content-length: 28
x-amz-cf-id: W1YZ6LrJ4msZZ1ONakr7WjNZOMmglvGWppNnFUas25D7tS893hEO6Q==

POST
H/1.1 204
No Content log Show response
errors.client.optimizely.com/ 0
247 B 112ms
112ms XHR
text/plain 34.206.28.113
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://errors.client.optimizely.com/log
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.206.28.113 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-206-28-113.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
Origin: https://blog.huntresslabs.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Content-Type: application/json

Response headers

Access-Control-Allow-Origin: https://blog.huntresslabs.com
Access-Control-Expose-Headers
Access-Control-Allow-Credentials: true
Connection: keep-alive
Date: Wed, 22 Jan 2020 19:12:50 GMT
Content-Type: text/plain

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 104ms
104ms XHR
text/plain 34.196.15.163
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.196.15.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-196-15-163.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://blog.huntresslabs.com
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Wed, 22 Jan 2020 19:12:50 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 104ms
104ms XHR
application/json 34.196.15.163
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.196.15.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-196-15-163.compute-1.amazonaws.com
Software: /
Resource Hash: a8d1bfd1356d47246faff06ad006525f5c4316add9d5172fea492884a3ddfc11

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
Origin: https://blog.huntresslabs.com
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Wed, 22 Jan 2020 19:12:50 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 115ms
115ms XHR
text/plain 34.196.15.163
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.196.15.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-196-15-163.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://blog.huntresslabs.com
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Wed, 22 Jan 2020 19:12:51 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 105ms
105ms XHR
application/json 34.196.15.163
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.196.15.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-196-15-163.compute-1.amazonaws.com
Software: /
Resource Hash: a8ba079d49d94ec3e64426950fbcc4f43566a832db1a8741820b81ef0d79a61f

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
Origin: https://blog.huntresslabs.com
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Wed, 22 Jan 2020 19:12:51 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 105ms
105ms XHR
text/plain 34.196.15.163
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.196.15.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-196-15-163.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://blog.huntresslabs.com
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Wed, 22 Jan 2020 19:12:51 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 109ms
108ms XHR
application/json 34.196.15.163
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.196.15.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-196-15-163.compute-1.amazonaws.com
Software: /
Resource Hash: 891ea746ef6c4ec88305defa336e0e7e037a6fdf6ff67a1b9df6d10db093eb10

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
Origin: https://blog.huntresslabs.com
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Wed, 22 Jan 2020 19:12:51 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

POST
H2 409 batch
blog.huntresslabs.com/_/ 10 KB
0 169ms
169ms Fetch
text/html 52.4.225.124
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.huntresslabs.com/_/batch

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.a30a5a3f.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.225.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-225-124.compute-1.amazonaws.com

Software

nginx / Medium

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src https://localhost https://.instapaper.com https://.stripe.com https://glyph.medium.com https://.paypal.com https://getpocket.com https://blog.huntresslabs.com https://.blog.huntresslabs.com https://.medium.com https://medium.com https://.medium.com https://.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://.lightstep.com https://.branch.io 'self'; font-src data: https://.amazonaws.com https://.medium.com https://glyph.medium.com https://medium.com https://.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
X-Content-Type-Options	nosniff
X-Frame-Options
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
Origin: https://blog.huntresslabs.com
x-xsrf-token: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
content-type: application/json

Response headers

content-security-policy: default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://getpocket.com https://blog.huntresslabs.com https://*.blog.huntresslabs.com https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://*.lightstep.com https://*.branch.io 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
x-content-type-options: nosniff
x-powered-by: Medium
x-obvious-info: 39761-c4f5868,c4f58684111
status: 409
content-length: 10152
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
pragma: no-cache
x-obvious-tid: 1579720373324:34bdd70e50ef
server: nginx
date: Wed, 22 Jan 2020 19:12:53 GMT
x-frame-options
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
link: <https://medium.com/humans.txt>; rel="humans"
expires: Thu, 09 Sep 1999 09:09:09 GMT

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 107ms
107ms XHR
text/plain 34.196.15.163
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.196.15.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-196-15-163.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://blog.huntresslabs.com
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Wed, 22 Jan 2020 19:12:54 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 106ms
105ms XHR
application/json 34.196.15.163
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.196.15.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-196-15-163.compute-1.amazonaws.com
Software: /
Resource Hash: 4b6f87602efae21cf98b7af0d34261f0821f488190262112cc384084f61db515

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
Origin: https://blog.huntresslabs.com
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Wed, 22 Jan 2020 19:12:54 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

GET
H/1.1 200
OK /
srv-2020-01-22-19.pixel.parsely.com/event/ 43 B
385 B 117ms
116ms Image
image/gif 52.203.142.184
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://srv-2020-01-22-19.pixel.parsely.com/event/?rand=1579720379600&plid=83408486&idsite=medium.com&url=https%3A%2F%2Fblog.huntresslabs.com%2Fvalidating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%7D&sid=1&surl=https%3A%2F%2Fblog.huntresslabs.com%2Fvalidating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34&sref=&sts=1579720379599&slts=0&date=Wed+Jan+22+2020+20%3A12%3A59+GMT%2B0100+(Central+European+Standard+Time)&action=heartbeat&inc=5&tt=4900&pvid=87380872&u=pid%3D4efd274ed54fc3aab48b4e8c0f2fa59e
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.203.142.184 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-203-142-184.compute-1.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Wed, 22 Jan 2020 19:12:42 GMT
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
P3P: CP="CUR ADM OUR NOR STA NID"

Verdicts & Comments Add Verdict or Comment

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: Dl9Z6Wce9XI
.youtube.com/	1970-01-19 06:48:42	Name: GPS Value: 1
cdn.embedly.com/	1970-01-19 15:34:16	Name: em_cdn_uid Value: t%3D1579720368802%26u%3Db1e4660b315544d89e4b85f6ceaa649f
blog.huntresslabs.com/	1970-01-19 06:58:45	Name: lightstep_session_id Value: 134f659f07b90657
.youtube.com/	1970-01-19 11:07:52	Name: VISITOR_INFO1_LIVE Value: HIyKKlnKgRs
.huntresslabs.com/	1970-01-19 16:18:04	Name: _parsely_visitor Value: {%22id%22:%22pid=4efd274ed54fc3aab48b4e8c0f2fa59e%22%2C%22session_count%22:1%2C%22last_session_ts%22:1579720369093}
.huntresslabs.com/	1970-01-19 06:48:42	Name: _parsely_session Value: {%22sid%22:1%2C%22surl%22:%22https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34%22%2C%22sref%22:%22%22%2C%22sts%22:1579720369093%2C%22slts%22:0}
blog.huntresslabs.com/	1970-01-19 06:58:45	Name: lightstep_guid/lite-web Value: 1d445a443f36696d

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://cdn-client.medium.com/lite/static/js/main.a30a5a3f.chunk.js(Line 1) Message: -+++++= .+++++= .+@@@@@+ #@@@@: .@@@@@= @@@@@ @+@@@@- =#@@@@@ @ +@@@@: :% @@@@@ @ @@@@-%: @@@@@ @ @@@@- @@@@@ -@- #@@+ :@@@@@: -#@@@#- ## =@@@@@@@= ....... .........
console-api	log	URL: https://cdn-client.medium.com/lite/static/js/main.a30a5a3f.chunk.js(Line 1) Message: We're hiring! https://medium.com/jobs-at-medium/work-at-medium-959d1a85284e

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	allow-from medium.com

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api2.branch.io
app.link
blog.huntresslabs.com
cdn-client.medium.com
cdn.branch.io
cdn.embedly.com
cdn.optimizely.com
collector-medium.lightstep.com
d1z2jf7jlzjs58.cloudfront.net
errors.client.optimizely.com
glyph.medium.com
medium.com
miro.medium.com
srv-2020-01-22-19.pixel.parsely.com
www.google-analytics.com
104.16.89.50
2600:9000:2047:6000:19:9934:6a80:93a1
2600:9000:2047:e000:11:f728:3040:93a1
2606:4700::6810:7691
2606:4700::6810:7b7f
2a00:1450:4001:814::200e
2a02:26f0:6c00:183::13b8
34.196.15.163
34.206.28.113
52.203.142.184
52.222.149.161
52.222.155.29
52.4.225.124
087a4c7aa118304c5ce85d5917d95a49b3c93204ef3500752dfde52595e4eac6
0f71b6b261c1af1760bae411afc51482b33e374e8922ced93fe27ccfcd12f443
12fe85ec038af8c41ba830412520589dbd125d417913c10a57838ac92ab96192
14122ac70338e22941e96d9b3ccb9bacedf93621af29cb5b4a01f20060367947
15c9f0ef234625c775e6e9ea3c57d28e51aeaa02a84c37c602d1eecaca9969b6
16f1efa415bfdd7abcf8fdd76cc05ae6fa66ffdfdc730368ecea89ecfe5c3a12
1c6f488cd9fe1b1e890ef37ac5a603654b2ef90d10ed588ebea9559e8e2051f8
200b0d8fe8fe88aa3678c4a7b0bc5dcd391a7fac8d091103acd20f15a0244c00
200b68bbdf9c2da0d476171ed46ffab16cac6ee742582310438d511c7cd7d315
2b7fef67b497e0555303da2ee9d375ad3f00dd4a6ac92c7128f98a0b9c502867
2c7143c3891c4c95a5563db6c7adca7edb86ce8d50ae77f696ac2b89433bf488
317ed2320bfe8866deff667bcf685186780bef521e5007b3c55a27c79dece113
343b89a6c58ff9c12872df411be730370993e622936e181f94ea516aa0d0b4b4
4b6f87602efae21cf98b7af0d34261f0821f488190262112cc384084f61db515
4c0cc04185396c9a83cfda3644c23327d7d8ff9247157c438575b83713894173
58711bafae315df048e1bc0c36ae1dfd017810b34fd9b4b021f774694397baad
6a7c2c08499ab65ce3f502090e1345dad13334ea008dd08d28153bcb5a69e2b5
712b8612b91836e2616f580efa550f1ffb02a2cde6a7d283c6e72fc2c90aacf5
75d9318cce08778c46789327f7c784a3d8b8f999291c219282077d129678dd7c
7d0a78ec5c8405f41bd3d8f99b2dd29582c71654239481045a0bea702ecf9f45
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84a548a3f01f6d92045be9ae44e89520ed11505928139d831749385a36aee74c
891ea746ef6c4ec88305defa336e0e7e037a6fdf6ff67a1b9df6d10db093eb10
920b288dc2dfa2b6e197fc04dd36620f3eb00968352015887a53fc9a12e95037
97a399f5816c0bbd9b7af9e3359eb25882e587e5d15de5f54f931ab49a1954ce
99c5448d6c84fc71d6805e2485727db250113edcaea123a064f8c26ce95947d8
9a9ff83692d5ab575cd14a5fc28d2713a75f8de6cab95265efc8893c55152d8f
9e61f0b2a6590757f19f4c9f305af89b4e6521e1cf2d5b79f2b14becf9c73de3
a30e9cc321fd5973225b187d57053c1407cd873883fe2e77271136904947176e
a3d669b687929b3aa777fdd2c400c2b8c6b794978536a64d7e1f71edcf8037e8
a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb
a8ba079d49d94ec3e64426950fbcc4f43566a832db1a8741820b81ef0d79a61f
a8d1bfd1356d47246faff06ad006525f5c4316add9d5172fea492884a3ddfc11
ab22cfbee907f4027d8ab50ae662112d445d32a98a4d36152695b0a3ec148377
b79eb86973be4f5f4f0e13240d44fb3159feb6faf712f0182ad2b96acb1eee7b
b8cb1c1ead50abbb12a03b3bcb857c496115fa1987903ff10c428cf4c6148202
ba29bccfb867eaeae3555152ec7b16aa5488adb32734c024207ef2afd66c1292
bc72a2ca45067a3d17fed4cd8776fec5dca3b9ecd7300e107f9256a86a0c8b2f
cf286b2a4add532c3cdef294dc5407b149042bcad1544c884def577790d0e515
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0822619e34c6c4ce38c34bb3811e80548f46233e354b7a402dec9a243b152eb
d1e7d63ccfbfa90f7c0d499e602cb230bbdbdbf321ab5c4e2f6baefd5b524dc0
d89de618fb1b7b1bd0285cfaec0117e52477765486db9903ea6b54000f67e795
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ec658154249e4a8085e4db08af846b60a435a18504352bb8f002d889e70ece2b
ed5d87d8b9d3fe7851550cbaeec63ea560ad3b7ecc20f8a6cffedcd86d97761c
ef1ed6a034a5055a869c7c25765ee1f2844a27a54e83e8a857d77b3f1cd83dd3
f0b9a9e4ea994c106a4fc595828ca1332b2cd0435d5d159d26d1773344d97367
f57137897a4e676f0d2199b79def1a95b253a1a938dff9d8ba10519f3beb2b08
fa85a251c253ef157df5b63bca1286383492aca6edab3933e031b607326f95d7
fef2eb5b7ae950bea823cef4f315a30cc435bb7725ef9d750cdacf0115383899

blog.huntresslabs.com Open in urlscan Pro 52.4.225.124 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

68 Requests

100 %HTTPS

46 %IPv6

10 Domains

15 Subdomains

13 IPs

3 Countries

921 kBTransfer

2666 kBSize

8 Cookies

35 Outgoing links

Page URL History

Redirected requests

68 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

blog.huntresslabs.com Open in urlscan Pro
52.4.225.124 Public Scan

Screenshot
Live screenshot

Full Image

68
Requests

100 %
HTTPS

46 %
IPv6

10
Domains

15
Subdomains

13
IPs

3
Countries

921 kB
Transfer

2666 kB
Size

8
Cookies

68 HTTP transactions
4 data transactions