redcanary.com
104.198.136.223 Public Scan Open in urlscan Pro

Go To Rescan
Add Verdict Report

URL:
https://redcanary.com/threat-detection-report/threats/bloodhound/ 10yr old
Submission: On June 11 via api (June 11th 2026, 1:17:07 am UTC) from US — Scanned from US

Summary HTTP 193 Redirects Links 26 Behaviour Indicators

Summary

This website contacted 77 IPs in 4 countries across 74 domains to perform 193 HTTP transactions. The main IP is 104.198.136.223, located in Council Bluffs, United States and belongs to GOOGLE-CLOUD-PLATFORM - Google LLC, US. The main domain is redcanary.com. The Cisco Umbrella rank of the primary domain is 787581. 10yr old
TLS certificate: Issued by R13 on May 9th 2026. Valid for: 3mo.

This is the only time redcanary.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
27	104.198.136.223 104.198.136.223	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
14	2606:4700:20:... 2606:4700:20::681a:34f	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2	2607:f8b0:400... 2607:f8b0:4004:c1f::5f	15169 (GOOGLE) (GOOGLE - Google LLC)
6	104.17.74.206 104.17.74.206	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
4	2a04:4e42:100... 2a04:4e42:1000::485	54113 (FASTLY) (FASTLY - Fastly)
3	2600:1408:c40... 2600:1408:c400:5a::addf:a3c6	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
11	104.18.17.5 104.18.17.5	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2	2606:4700:440... 2606:4700:4404::ac40:9473	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
3	2607:f8b0:400... 2607:f8b0:4004:c1d::61	15169 (GOOGLE) (GOOGLE - Google LLC)
3	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	16.15.35.30 16.15.35.30	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	23.13.173.12 23.13.173.12	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
3	2620:1ec:33:1... 2620:1ec:33:1::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
1	2606:4700::68... 2606:4700::6812:1eb0	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
3	2607:f8b0:400... 2607:f8b0:4004:c23::5e	15169 (GOOGLE) (GOOGLE - Google LLC)
1 1	54.183.159.18 54.183.159.18	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	44.233.73.129 44.233.73.129	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	2600:1408:c40... 2600:1408:c400:5a::addf:a3d4	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1	2606:4700::68... 2606:4700::6810:bb29	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 3	2607:f8b0:400... 2607:f8b0:4004:c09::9b	15169 (GOOGLE) (GOOGLE - Google LLC)
6	2001:4860:482... 2001:4860:482c:7700::	15169 (GOOGLE) (GOOGLE - Google LLC)
11	23.221.227.208 23.221.227.208	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
2	3.170.3.122 3.170.3.122	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	142.251.179.148 142.251.179.148	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a04:4e42:200... 2a04:4e42:200::396	54113 (FASTLY) (FASTLY - Fastly)
2	2600:1408:a:5... 2600:1408:a:53::170f:355	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1	146.75.36.157 146.75.36.157	54113 (FASTLY) (FASTLY - Fastly)
2	2a03:2880:f33... 2a03:2880:f338:80:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK - Facebook)
2	2600:1408:c40... 2600:1408:c400:26::17da:d929	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
2	35.245.15.98 35.245.15.98	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1	2600:1408:c40... 2600:1408:c400:5a::addf:a3db	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1	2600:1901:0:7... 2600:1901:0:7f7d::	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1	2602:816:5001... 2602:816:5001::39	54113 (FASTLY) (FASTLY - Fastly)
1	4.153.187.221 4.153.187.221	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
1	192.28.164.179 192.28.164.179	15224 (OMNITURE) (OMNITURE - Adobe Inc.)
10	104.18.16.5 104.18.16.5	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2606:4700::68... 2606:4700::6810:4f49	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2	172.66.0.227 172.66.0.227	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2a04:4e42::396 2a04:4e42::396	54113 (FASTLY) (FASTLY - Fastly)
4	192.132.33.68 192.132.33.68	18568 (BIDTELLECT) (BIDTELLECT - Bidtellect Inc.)
1 3	2603:1061:14:... 2603:1061:14:74::1	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
1	2a03:2880:f33... 2a03:2880:f338:1:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK - Facebook)
1	2600:1901:0:5... 2600:1901:0:5e8a::	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1 2	34.36.216.150 34.36.216.150	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1 2	216.157.106.133 216.157.106.133	13768 (COGECO-PEER1) (COGECO-PEER1 - Aptum Technologies)
4	162.247.243.29 162.247.243.29	54113 (FASTLY) (FASTLY - Fastly)
1 2	54.209.86.203 54.209.86.203	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 3	34.111.113.62 34.111.113.62	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
2 3	44.208.117.202 44.208.117.202	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
2 3	35.244.154.8 35.244.154.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1 2	54.87.233.173 54.87.233.173	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 3	68.67.160.114 68.67.160.114	29990 (ASN-APPNEXUS) (ASN-APPNEXUS - Xandr Inc.)
1	2600:1408:c40... 2600:1408:c400:d::17cd:6a49	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
4 6	2606:4700:440... 2606:4700:4407::ac40:92d7	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	104.18.41.41 104.18.41.41	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
3	52.242.103.142 52.242.103.142	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
2	75.2.108.141 75.2.108.141	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 1	2620:1ec:33::10 2620:1ec:33::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
23 25	34.85.181.204 34.85.181.204	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1	34.117.77.79 34.117.77.79	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
2 2	35.211.202.130 35.211.202.130	43515 (YOUTUBE G...) (YOUTUBE Google Ireland Limited)
1	208.92.55.248 208.92.55.248	13360 (TRITONDIG...) (TRITONDIGITAL - Triton Digital)
1	18.160.10.47 18.160.10.47	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 2	44.218.64.233 44.218.64.233	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 1	35.212.120.65 35.212.120.65	43515 (YOUTUBE G...) (YOUTUBE Google Ireland Limited)
1 2	98.82.157.231 98.82.157.231	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
2 3	69.194.240.13 69.194.240.13	26120 (RHYTHMONE) (RHYTHMONE - RhythmOne)
1 2	34.193.247.218 34.193.247.218	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	2600:1f10:4ce... 2600:1f10:4ce4:4a03:2a62:57c9:2b3a:27f4	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 1	3.167.112.115 3.167.112.115	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 1	2600:9000:27c... 2600:9000:27c5:4200:19:fc2c:a140:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2 2	2600:9000:201... 2600:9000:201f:e00:1b:6b7d:2300:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	52.85.193.65 52.85.193.65	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	207.65.32.88 207.65.32.88	62713 (AS-PUBMATIC) (AS-PUBMATIC - PubMatic)
1	2600:1f18:659... 2600:1f18:6593:f608:d96:5850:6736:187e	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
2 3	2606:4700:20:... 2606:4700:20::681a:5f1	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 1	142.251.167.155 142.251.167.155	15169 (GOOGLE) (GOOGLE - Google LLC)
1	35.174.135.129 35.174.135.129	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	35.212.17.176 35.212.17.176	43515 (YOUTUBE G...) (YOUTUBE Google Ireland Limited)
1	52.206.105.60 52.206.105.60	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 2	34.200.91.212 34.200.91.212	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 1	107.178.254.65 107.178.254.65	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1 1	173.194.45.154 173.194.45.154	15169 (GOOGLE) (GOOGLE - Google LLC)
1	216.19.192.2 216.19.192.2	26667 (RUBICONPR...) (RUBICONPROJECT - Magnite)
1 2	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1	2607:f8b0:400... 2607:f8b0:4004:c23::65	15169 (GOOGLE) (GOOGLE - Google LLC)
193	77

27 104.198.136.223 (Council Bluffs, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 223.136.198.104.bc.googleusercontent.com

redcanary.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

14 2606:4700:20::681a:34f (None, )

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

consent.app.relyance.ai 1yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 2607:f8b0:4004:c1f::5f (Washington, United States)

ASN15169 (GOOGLE - Google LLC, US)

ajax.googleapis.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
fonts.googleapis.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

6 104.17.74.206 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

resource.redcanary.com 6yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

4 2a04:4e42:1000::485 (United States)

ASN54113 (FASTLY - Fastly, Inc., US)

cdn.jsdelivr.net 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 2600:1408:c400:5a::addf:a3c6 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

cdn.bizible.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

11 104.18.17.5 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

js.qualified.com 7yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
app.qualified.com 8yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
assets.qualified.com 5yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 2606:4700:4404::ac40:9473 (None, )

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

analytics.ahrefs.com 6yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 2607:f8b0:4004:c1d::61 (Washington, United States)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagmanager.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 2606:4700::6811:190e (None, )

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdnjs.cloudflare.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 16.15.35.30 (Boardman, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

s3-us-west-2.amazonaws.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 23.13.173.12 (Sterling, United States)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-13-173-12.deploy.static.akamaitechnologies.com

munchkin.marketo.net 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 2620:1ec:33:1::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

bat.bing.com 12yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 2606:4700::6812:1eb0 (None, )

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

tracking.g2crowd.com 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 2607:f8b0:4004:c23::5e (Washington, United States)

ASN15169 (GOOGLE - Google LLC, US)

fonts.gstatic.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 54.183.159.18 (San Jose, United States) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-183-159-18.us-west-1.compute.amazonaws.com

tracking.intentsify.io 7yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 44.233.73.129 (Boardman, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-44-233-73-129.us-west-2.compute.amazonaws.com

a.usbrowserspeed.com 4yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 2600:1408:c400:5a::addf:a3d4 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

cdn.bizibly.com 11yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 2606:4700::6810:bb29 (None, )

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

tracking-api.g2.com 2yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 2607:f8b0:4004:c09::9b (Washington, United States) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

googleads.g.doubleclick.net 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

6 2001:4860:482c:7700:: (United States)

ASN15169 (GOOGLE - Google LLC, US)

www.google.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

11 23.221.227.208 (Sterling, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a23-221-227-208.deploy.static.akamaitechnologies.com

j.6sc.co 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
b.6sc.co 12yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 3.170.3.122 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-3-170-3-122.iad55.r.cloudfront.net

cdn-app.pathfactory.com 5yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 142.251.179.148 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: pd-in-f148.1e100.net

ad.doubleclick.net 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 2a04:4e42:200::396 (United States)

ASN54113 (FASTLY - Fastly, Inc., US)

www.redditstatic.com 11yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 2600:1408:a:53::170f:355 (Chantilly, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

snap.licdn.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 146.75.36.157 (Ashburn, United States)

ASN54113 (FASTLY - Fastly, Inc., US)

static.ads-twitter.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 2a03:2880:f338:80:face:b00c:0:3 (Reston, United States)

ASN32934 (FACEBOOK - Facebook, Inc., US)

connect.facebook.net 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 2600:1408:c400:26::17da:d929 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

cdn.bttrack.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 35.245.15.98 (Washington, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 98.15.245.35.bc.googleusercontent.com

tag.simpli.fi 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
i.simpli.fi 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 2600:1408:c400:5a::addf:a3db (Ashburn, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

cdn01.basis.net 8yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 2600:1901:0:7f7d:: (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)

dev.visualwebsiteoptimizer.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 2602:816:5001::39 (United States)

ASN54113 (FASTLY - Fastly, Inc., US)

js-agent.newrelic.com 12yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 4.153.187.221 (Boydton, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

www.clarity.ms 8yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 192.28.164.179 (United States)

ASN15224 (OMNITURE - Adobe Inc., US)

003-yru-314.mktoresp.com 7yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

10 104.18.16.5 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

app.qualified.com 8yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
assets.qualified.com 5yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
messenger-assets.qualified.com 5mo old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 2606:4700::6810:4f49 (None, )

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

static.cloudflareinsights.com 7yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 172.66.0.227 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

t.co 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
analytics.twitter.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 2a04:4e42::396 (United States)

ASN54113 (FASTLY - Fastly, Inc., US)

alb.reddit.com 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

4 192.132.33.68 (United States)

ASN18568 (BIDTELLECT - Bidtellect Inc., US)
PTR: NET-33-132-192.68.bidtellect.com

bttrack.com 12yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 2603:1061:14:74::1 (United States) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

scripts.clarity.ms 1yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
c.clarity.ms 5yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 2a03:2880:f338:1:face:b00c:0:25de (Reston, United States)

ASN32934 (FACEBOOK - Facebook, Inc., US)

www.facebook.com 11yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 2600:1901:0:5e8a:: (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)

o209747.ingest.us.sentry.io 1yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 34.36.216.150 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 150.216.36.34.bc.googleusercontent.com

pixel-sync.sitescout.com 8yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 216.157.106.133 (Herndon, United States) 1 redirects

ASN13768 (COGECO-PEER1 - Aptum Technologies, CA)

pixel.sitescout.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

4 162.247.243.29 (United States)

ASN54113 (FASTLY - Fastly, Inc., US)

bam.nr-data.net 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 54.209.86.203 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-209-86-203.compute-1.amazonaws.com

dpm.demdex.net 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 34.111.113.62 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 62.113.111.34.bc.googleusercontent.com

pixel.tapad.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 44.208.117.202 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-44-208-117-202.compute-1.amazonaws.com

loadm.exelator.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
load77.exelator.com 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 35.244.154.8 (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 8.154.244.35.bc.googleusercontent.com

idsync.rlcdn.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 54.87.233.173 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-87-233-173.compute-1.amazonaws.com

sync.crwdcntrl.net 8yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 68.67.160.114 (Feasterville, United States) 1 redirects

ASN29990 (ASN-APPNEXUS - Xandr Inc., US)
PTR: 672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

secure.adnxs.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
ib.adnxs.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 2600:1408:c400:d::17cd:6a49 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

ipv6.6sc.co 4yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

6 2606:4700:4407::ac40:92d7 (None, ) 4 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

px.ads.linkedin.com 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
www.linkedin.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 104.18.41.41 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

px4.ads.linkedin.com 5yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 52.242.103.142 (Boydton, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

v.clarity.ms 3yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 75.2.108.141 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: afe865822f884bb48.awsglobalaccelerator.com

epsilon.6sense.com 8yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 2620:1ec:33::10 (United States) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

c.bing.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

25 34.85.181.204 (Washington, United States) 23 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 204.181.85.34.bc.googleusercontent.com

um.simpli.fi 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 34.117.77.79 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 79.77.117.34.bc.googleusercontent.com

ml314.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 35.211.202.130 (North Charleston, United States) 2 redirects

ASN43515 (YOUTUBE Google Ireland Limited, IE)
PTR: 130.202.211.35.bc.googleusercontent.com

x.bidswitch.net 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 208.92.55.248 (Canada)

ASN13360 (TRITONDIGITAL - Triton Digital, CA)

yield-op-idsync.live.streamtheworld.com 8yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 18.160.10.47 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-18-160-10-47.iad12.r.cloudfront.net

synchroscript.deliveryengine.adswizz.com 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 44.218.64.233 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-44-218-64-233.compute-1.amazonaws.com

ps.eyeota.net 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 35.212.120.65 (Washington, United States) 1 redirects

ASN43515 (YOUTUBE Google Ireland Limited, IE)
PTR: 65.120.212.35.bc.googleusercontent.com

s.ad.smaato.net 6yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 98.82.157.231 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-98-82-157-231.compute-1.amazonaws.com

s.amazon-adsystem.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 69.194.240.13 (United States) 2 redirects

ASN26120 (RHYTHMONE - RhythmOne, LLC, US)

sync.1rx.io 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
sync.targeting.unrulymedia.com 6yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 34.193.247.218 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-193-247-218.compute-1.amazonaws.com

eb2.3lift.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 2600:1f10:4ce4:4a03:2a62:57c9:2b3a:27f4 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)

simplifi.partners.tremorhub.com 7yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 3.167.112.115 (United States) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-3-167-112-115.iad55.r.cloudfront.net

aa.agkn.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 2600:9000:27c5:4200:19:fc2c:a140:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

d.agkn.com 12yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 2600:9000:201f:e00:1b:6b7d:2300:93a1 (United States) 2 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

sync.intentiq.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 52.85.193.65 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-85-193-65.iad55.r.cloudfront.net

syncv4.intentiq.com 4yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 207.65.32.88 (United States)

ASN62713 (AS-PUBMATIC - PubMatic, Inc., US)

image2.pubmatic.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 2600:1f18:6593:f608:d96:5850:6736:187e (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)

user-sync.fwmrm.net 1yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 2606:4700:20::681a:5f1 (None, ) 2 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

fei.pro-market.net 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
pbid.pro-market.net 11yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 142.251.167.155 (United States) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: ww-in-f155.1e100.net

cm.g.doubleclick.net 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 35.174.135.129 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-35-174-135-129.compute-1.amazonaws.com

loadm.exelator.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 35.212.17.176 (Washington, United States)

ASN43515 (YOUTUBE Google Ireland Limited, IE)
PTR: 176.17.212.35.bc.googleusercontent.com

sync.bfmio.com 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 52.206.105.60 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-206-105-60.compute-1.amazonaws.com

bcp.crwdcntrl.net 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 34.200.91.212 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-200-91-212.compute-1.amazonaws.com

ce.lijit.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 107.178.254.65 (United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 65.254.178.107.bc.googleusercontent.com

pippio.com 12yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 173.194.45.154 (United States) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: yuiadum-in-f154.1e100.net

www.googleadservices.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 216.19.192.2 (United States)

ASN26667 (RUBICONPROJECT - Magnite, Inc., US)

pixel.rubiconproject.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 34.98.64.218 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 2607:f8b0:4004:c23::65 (Washington, United States)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

	Apex Domain Subdomains	Transfer
33	redcanary.com redcanary.com — Cisco Umbrella Rank: 787581 10yr old resource.redcanary.com 6yr old	1 MB
27	simpli.fi 23 redirects tag.simpli.fi — Cisco Umbrella Rank: 7221 9yr old i.simpli.fi — Cisco Umbrella Rank: 5428 10yr old um.simpli.fi — Cisco Umbrella Rank: 1175 10yr old	16 KB
21	qualified.com js.qualified.com — Cisco Umbrella Rank: 15047 7yr old app.qualified.com — Cisco Umbrella Rank: 14545 8yr old assets.qualified.com — Cisco Umbrella Rank: 17223 5yr old messenger-assets.qualified.com — Cisco Umbrella Rank: 23522 5mo old	2 MB
14	relyance.ai consent.app.relyance.ai — Cisco Umbrella Rank: 209809 1yr old	109 KB
12	6sc.co j.6sc.co — Cisco Umbrella Rank: 7871 10yr old ipv6.6sc.co — Cisco Umbrella Rank: 8016 4yr old b.6sc.co — Cisco Umbrella Rank: 6337 12yr old	23 KB
7	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 334 9yr old www.linkedin.com — Cisco Umbrella Rank: 610 13yr old px4.ads.linkedin.com — Cisco Umbrella Rank: 5830 5yr old	4 KB
7	clarity.ms 1 redirects www.clarity.ms — Cisco Umbrella Rank: 394 8yr old scripts.clarity.ms — Cisco Umbrella Rank: 581 1yr old v.clarity.ms — Cisco Umbrella Rank: 6010 3yr old c.clarity.ms — Cisco Umbrella Rank: 696 5yr old	28 KB
6	bttrack.com cdn.bttrack.com — Cisco Umbrella Rank: 15995 10yr old bttrack.com — Cisco Umbrella Rank: 1369 12yr old	6 KB
6	google.com www.google.com — Cisco Umbrella Rank: 3 13yr old	64 B
5	doubleclick.net 2 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 67 10yr old ad.doubleclick.net — Cisco Umbrella Rank: 222 10yr old cm.g.doubleclick.net — Cisco Umbrella Rank: 303 10yr old	929 B
4	exelator.com 2 redirects loadm.exelator.com — Cisco Umbrella Rank: 2511 13yr old load77.exelator.com — Cisco Umbrella Rank: 7657 9yr old	3 KB
4	nr-data.net bam.nr-data.net — Cisco Umbrella Rank: 491 10yr old	2 KB
4	sitescout.com 2 redirects pixel-sync.sitescout.com — Cisco Umbrella Rank: 901 8yr old pixel.sitescout.com — Cisco Umbrella Rank: 9873 10yr old	3 KB
4	bing.com 1 redirects bat.bing.com — Cisco Umbrella Rank: 352 12yr old c.bing.com — Cisco Umbrella Rank: 188 13yr old	20 KB
4	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 283 13yr old	114 KB
3	pro-market.net 2 redirects fei.pro-market.net — Cisco Umbrella Rank: 2821 9yr old pbid.pro-market.net — Cisco Umbrella Rank: 14023 11yr old	2 KB
3	intentiq.com 2 redirects sync.intentiq.com — Cisco Umbrella Rank: 1535 10yr old syncv4.intentiq.com — Cisco Umbrella Rank: 13155 4yr old	4 KB
3	adnxs.com 1 redirects secure.adnxs.com — Cisco Umbrella Rank: 687 10yr old ib.adnxs.com — Cisco Umbrella Rank: 308 10yr old	2 KB
3	crwdcntrl.net 1 redirects sync.crwdcntrl.net — Cisco Umbrella Rank: 1023 8yr old bcp.crwdcntrl.net — Cisco Umbrella Rank: 1237 10yr old	1 KB
3	rlcdn.com 2 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 667 10yr old	1 KB
3	tapad.com 1 redirects pixel.tapad.com — Cisco Umbrella Rank: 653 10yr old	2 KB
3	gstatic.com fonts.gstatic.com — Cisco Umbrella Rank: 39 10yr old	43 KB
3	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 262 13yr old	36 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 53 13yr old	504 KB
3	bizible.com cdn.bizible.com — Cisco Umbrella Rank: 14047 13yr old	26 KB
2	openx.net 1 redirects us-u.openx.net — Cisco Umbrella Rank: 647 10yr old	485 B
2	lijit.com 1 redirects ce.lijit.com — Cisco Umbrella Rank: 1169 10yr old	773 B
2	agkn.com 2 redirects aa.agkn.com — Cisco Umbrella Rank: 661 10yr old d.agkn.com — Cisco Umbrella Rank: 1308 12yr old	1 KB
2	3lift.com 1 redirects eb2.3lift.com — Cisco Umbrella Rank: 528 10yr old	518 B
2	1rx.io 2 redirects sync.1rx.io — Cisco Umbrella Rank: 619 10yr old	730 B
2	amazon-adsystem.com 1 redirects s.amazon-adsystem.com — Cisco Umbrella Rank: 495 13yr old	2 KB
2	eyeota.net 1 redirects ps.eyeota.net — Cisco Umbrella Rank: 1191 13yr old	1 KB
2	bidswitch.net 2 redirects x.bidswitch.net — Cisco Umbrella Rank: 485 13yr old	869 B
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 11491 8yr old	585 B
2	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 329 10yr old	1 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 214 13yr old	153 KB
2	licdn.com snap.licdn.com — Cisco Umbrella Rank: 833 10yr old	38 KB
2	pathfactory.com cdn-app.pathfactory.com — Cisco Umbrella Rank: 64985 5yr old	24 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 4066 10yr old	7 KB
2	ahrefs.com analytics.ahrefs.com — Cisco Umbrella Rank: 6078 6yr old	3 KB
2	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 571 10yr old fonts.googleapis.com — Cisco Umbrella Rank: 59 10yr old	31 KB
1	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 90 13yr old	21 KB
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 478 10yr old	1 KB
1	googleadservices.com 1 redirects www.googleadservices.com — Cisco Umbrella Rank: 114 13yr old	23 B
1	pippio.com 1 redirects pippio.com — Cisco Umbrella Rank: 1206 12yr old	613 B
1	bfmio.com sync.bfmio.com — Cisco Umbrella Rank: 2435 9yr old	379 B
1	fwmrm.net user-sync.fwmrm.net — Cisco Umbrella Rank: 872 1yr old	504 B
1	pubmatic.com image2.pubmatic.com — Cisco Umbrella Rank: 1043 10yr old	578 B
1	tremorhub.com simplifi.partners.tremorhub.com — Cisco Umbrella Rank: 8449 7yr old	175 B
1	unrulymedia.com sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 1444 6yr old	378 B
1	smaato.net 1 redirects s.ad.smaato.net — Cisco Umbrella Rank: 889 6yr old	391 B
1	adswizz.com synchroscript.deliveryengine.adswizz.com — Cisco Umbrella Rank: 3219 9yr old	398 B
1	streamtheworld.com yield-op-idsync.live.streamtheworld.com — Cisco Umbrella Rank: 14486 8yr old	666 B
1	ml314.com ml314.com — Cisco Umbrella Rank: 1760 13yr old	464 B
1	sentry.io o209747.ingest.us.sentry.io — Cisco Umbrella Rank: 18880 1yr old	281 B
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 119 11yr old	19 B
1	reddit.com alb.reddit.com — Cisco Umbrella Rank: 981 9yr old	666 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 1106 10yr old	1010 B
1	t.co t.co — Cisco Umbrella Rank: 1118 13yr old	663 B
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 326 7yr old	11 KB
1	mktoresp.com 003-yru-314.mktoresp.com 7yr old	318 B
1	newrelic.com js-agent.newrelic.com — Cisco Umbrella Rank: 1051 12yr old	30 KB
1	visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com — Cisco Umbrella Rank: 2554 10yr old	349 B
1	basis.net cdn01.basis.net — Cisco Umbrella Rank: 8543 8yr old	3 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 1166 10yr old	13 KB
1	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 948 11yr old	19 KB
1	g2.com tracking-api.g2.com — Cisco Umbrella Rank: 10000 2yr old
1	bizibly.com cdn.bizibly.com — Cisco Umbrella Rank: 21673 11yr old	569 B
1	usbrowserspeed.com a.usbrowserspeed.com — Cisco Umbrella Rank: 4183 4yr old	148 B
1	intentsify.io 1 redirects tracking.intentsify.io — Cisco Umbrella Rank: 47971 7yr old	640 B
1	g2crowd.com tracking.g2crowd.com — Cisco Umbrella Rank: 10974 9yr old	3 KB
1	amazonaws.com s3-us-west-2.amazonaws.com 13yr old	41 KB
0	yahoo.com Failed ups.analytics.yahoo.com Failed — Cisco Umbrella Rank: 547 7yr old
0	ml-attr.com Failed s.ml-attr.com Failed 10yr old
193	74

	Domain	Requested by
27	redcanary.com	redcanary.com
25	um.simpli.fi	23 redirects
14	consent.app.relyance.ai	redcanary.com consent.app.relyance.ai
9	b.6sc.co	redcanary.com
8	app.qualified.com	js.qualified.com assets.qualified.com consent.app.relyance.ai
6	assets.qualified.com	redcanary.com app.qualified.com assets.qualified.com
6	www.google.com	www.googletagmanager.com
6	resource.redcanary.com	redcanary.com resource.redcanary.com
5	px.ads.linkedin.com	3 redirects consent.app.relyance.ai
4	bam.nr-data.net	resource.redcanary.com
4	bttrack.com	redcanary.com cdn.bttrack.com cdn.bizible.com
4	js.qualified.com	redcanary.com js.qualified.com
4	cdn.jsdelivr.net	redcanary.com
3	messenger-assets.qualified.com
3	v.clarity.ms	cdn.bizible.com
3	idsync.rlcdn.com	2 redirects redcanary.com
3	loadm.exelator.com	2 redirects
3	pixel.tapad.com	1 redirects redcanary.com
3	googleads.g.doubleclick.net	1 redirects www.googletagmanager.com
3	fonts.gstatic.com	fonts.googleapis.com
3	bat.bing.com	redcanary.com bat.bing.com
3	cdnjs.cloudflare.com	redcanary.com
3	www.googletagmanager.com	redcanary.com www.googletagmanager.com
3	cdn.bizible.com	redcanary.com cdn.bizible.com
2	us-u.openx.net	1 redirects
2	ib.adnxs.com	1 redirects
2	ce.lijit.com	1 redirects
2	fei.pro-market.net	2 redirects
2	sync.intentiq.com	2 redirects
2	eb2.3lift.com	1 redirects
2	sync.1rx.io	2 redirects
2	s.amazon-adsystem.com	1 redirects
2	ps.eyeota.net	1 redirects
2	x.bidswitch.net	2 redirects
2	c.clarity.ms	1 redirects
2	epsilon.6sense.com	cdn.bizible.com
2	sync.crwdcntrl.net	1 redirects redcanary.com
2	dpm.demdex.net	1 redirects redcanary.com
2	pixel.sitescout.com	1 redirects redcanary.com
2	pixel-sync.sitescout.com	1 redirects redcanary.com
2	cdn.bttrack.com	redcanary.com cdn.bttrack.com
2	connect.facebook.net	redcanary.com connect.facebook.net
2	snap.licdn.com	www.googletagmanager.com snap.licdn.com
2	cdn-app.pathfactory.com	redcanary.com cdn-app.pathfactory.com
2	j.6sc.co	www.googletagmanager.com j.6sc.co
2	munchkin.marketo.net	redcanary.com munchkin.marketo.net
2	analytics.ahrefs.com	redcanary.com analytics.ahrefs.com
1	ws1.qualified.com
1	www.google-analytics.com	www.googletagmanager.com
1	pixel.rubiconproject.com
1	www.googleadservices.com	1 redirects
1	pippio.com	1 redirects
1	bcp.crwdcntrl.net
1	sync.bfmio.com
1	pbid.pro-market.net
1	cm.g.doubleclick.net	1 redirects
1	user-sync.fwmrm.net
1	image2.pubmatic.com
1	syncv4.intentiq.com
1	d.agkn.com	1 redirects
1	aa.agkn.com	1 redirects
1	simplifi.partners.tremorhub.com
1	sync.targeting.unrulymedia.com
1	s.ad.smaato.net	1 redirects
1	synchroscript.deliveryengine.adswizz.com
1	yield-op-idsync.live.streamtheworld.com
1	ml314.com
1	c.bing.com	1 redirects
1	i.simpli.fi	tag.simpli.fi
1	px4.ads.linkedin.com	redcanary.com
1	www.linkedin.com	1 redirects
1	ipv6.6sc.co	cdn.bizible.com
1	secure.adnxs.com	cdn.bizible.com
1	load77.exelator.com	redcanary.com
1	o209747.ingest.us.sentry.io	assets.qualified.com
1	www.facebook.com	redcanary.com
1	scripts.clarity.ms	www.clarity.ms
1	alb.reddit.com	redcanary.com
1	analytics.twitter.com	redcanary.com
1	t.co	redcanary.com
1	static.cloudflareinsights.com	app.qualified.com
1	003-yru-314.mktoresp.com	munchkin.marketo.net
1	www.clarity.ms	bat.bing.com
1	js-agent.newrelic.com	resource.redcanary.com
1	dev.visualwebsiteoptimizer.com	cdn.bizible.com
1	cdn01.basis.net	www.googletagmanager.com
1	tag.simpli.fi	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
1	www.redditstatic.com	www.googletagmanager.com
1	ad.doubleclick.net	www.googletagmanager.com
1	tracking-api.g2.com	tracking.g2crowd.com
1	cdn.bizibly.com	redcanary.com
1	a.usbrowserspeed.com	redcanary.com
1	tracking.intentsify.io	1 redirects
1	tracking.g2crowd.com	redcanary.com
1	fonts.googleapis.com	redcanary.com
1	s3-us-west-2.amazonaws.com	redcanary.com
1	ajax.googleapis.com	redcanary.com
0	ups.analytics.yahoo.com Failed
0	s.ml-attr.com Failed	redcanary.com
193	100

This site contains links to these domains. Also see Links.

Domain
resource.redcanary.com
docs.redcanary.com
twitter.com
www.linkedin.com
www.facebook.com
github.com
www.microsoft.com
www.picussecurity.com
thedfirreport.com
techcommunity.microsoft.com
atomicredteam.io
support.redcanary.com
go.my.redcanary.co
x.com
www.youtube.com

Subject Issuer	Validity	Valid
redcanary.com R13	`2026-05-09` - `2026-08-07`	3mo	crt.sh
relyance.ai WE1	`2026-05-20` - `2026-08-18`	3mo	crt.sh
upload.video.google.com WR2	`2026-05-18` - `2026-08-10`	3mo	crt.sh
resource.redcanary.com WE1	`2026-05-06` - `2026-08-04`	3mo	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2026 Q2	`2026-05-20` - `2026-12-05`	7mo	crt.sh
cdn.bizible.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-12-18` - `2027-01-18`	1yr	crt.sh
qualified.com WE1	`2026-04-18` - `2026-07-17`	3mo	crt.sh
analytics.ahrefs.com WE1	`2026-05-07` - `2026-08-05`	3mo	crt.sh
*.google-analytics.com WR2	`2026-05-18` - `2026-08-10`	3mo	crt.sh
cdnjs.cloudflare.com WE1	`2026-05-12` - `2026-08-10`	3mo	crt.sh
*.s3-us-west-2.amazonaws.com Amazon RSA 2048 M04	`2025-11-18` - `2026-10-30`	1yr	crt.sh
*.marketo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-10-22` - `2026-10-21`	1yr	crt.sh
www.bing.com Microsoft TLS G2 RSA CA OCSP 02	`2026-05-03` - `2026-10-30`	6mo	crt.sh
g2crowd.com WE1	`2026-06-02` - `2026-08-31`	3mo	crt.sh
*.gstatic.com WR2	`2026-05-18` - `2026-08-10`	3mo	crt.sh
tracking-api.g2.com WE1	`2026-05-05` - `2026-08-03`	3mo	crt.sh
*.g.doubleclick.net WR2	`2026-05-18` - `2026-08-10`	3mo	crt.sh
*.google.com WR2	`2026-05-18` - `2026-08-10`	3mo	crt.sh
6sc.co R12	`2026-03-27` - `2026-06-25`	3mo	crt.sh
*.pathfactory.com Amazon RSA 2048 M01	`2026-03-11` - `2026-09-24`	7mo	crt.sh
*.doubleclick.net WR2	`2026-05-18` - `2026-08-10`	3mo	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2026-04-05` - `2026-10-01`	6mo	crt.sh
*.licdn.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-10-14` - `2026-10-13`	1yr	crt.sh
ads-twitter.com R13	`2026-05-01` - `2026-07-30`	3mo	crt.sh
*.facebook.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2026-03-20` - `2026-06-18`	3mo	crt.sh
cdn.bttrack.com YE1	`2026-06-10` - `2026-09-08`	3mo	crt.sh
*.simpli.fi DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-10-23` - `2026-11-23`	1yr	crt.sh
cdn01.basis.net E8	`2026-04-11` - `2026-07-10`	3mo	crt.sh
*.visualwebsiteoptimizer.com WR3	`2026-04-18` - `2026-07-17`	3mo	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA 2025 Q4	`2025-11-25` - `2026-12-27`	1yr	crt.sh
a.tag.clarity.ms Microsoft TLS G2 RSA CA OCSP 16	`2026-06-02` - `2026-11-29`	6mo	crt.sh
*.mktoresp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-07-22` - `2026-08-22`	1yr	crt.sh
cloudflareinsights.com WE1	`2026-04-17` - `2026-07-16`	3mo	crt.sh
t.co E8	`2026-05-11` - `2026-08-09`	3mo	crt.sh
twitter.com E8	`2026-05-24` - `2026-08-22`	3mo	crt.sh
*.reddit.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2026-04-08` - `2026-10-04`	6mo	crt.sh
*.bttrack.com Sectigo Public Server Authentication CA DV R36	`2026-03-26` - `2026-10-10`	7mo	crt.sh
scripts.clarity.ms GeoTrust TLS RSA CA G1	`2026-05-05` - `2026-11-05`	6mo	crt.sh
ingest.sentry.io DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-07-24` - `2026-08-24`	1yr	crt.sh
pixel-sync.sitescout.com WR3	`2026-05-13` - `2026-08-11`	3mo	crt.sh
*.nr-data.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2026-03-13` - `2026-09-27`	7mo	crt.sh
*.adnxs.com GeoTrust TLS ECC CA G1	`2025-09-25` - `2026-10-26`	1yr	crt.sh
www.linkedin.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2026-03-19` - `2026-09-19`	6mo	crt.sh
a.clarity.ms Microsoft TLS G2 RSA CA OCSP 10	`2026-06-02` - `2026-11-29`	6mo	crt.sh
epsilon.6sense.com Amazon RSA 2048 M04	`2025-09-03` - `2026-10-02`	1yr	crt.sh

This page contains 4 frames:

Primary Page: https://redcanary.com/threat-detection-report/threats/bloodhound/
Frame ID: DBEF59B2927BDC431A3E0EF697A4F8DD
Requests: 161 HTTP requests in this frame

Frame: https://resource.redcanary.com/index.php/form/XDFrame
Frame ID: 87D81ADBD8EB7C09A17A841FDE775405
Requests: 7 HTTP requests in this frame

Frame: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=209c2900-8257-4237-b2ab-90860d6fde7b
Frame ID: F8DF234AEB1B503D7B5D5090F3180396
Requests: 12 HTTP requests in this frame

Frame: https://pixel-sync.sitescout.com/dmp/asyncPixelSync?cookieQ=1
Frame ID: 45D157D95FC934B90C7AEFD3063BE727
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

BloodHound - Red Canary Threat Detection Report

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

dc.js (JavaScript graphics) Expand

Overall confidence: 100%
Detected patterns

(?:((?:\d+\.)+\d+)\/(?:dc\/)?)?dc(?:\.leaflet)?\.js

6sense (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

\.6sc\.co/

Adobe Audience Manager (Segmentation) Expand

Overall confidence: 100%
Detected patterns

Amazon Advertising (Advertising) Expand

Overall confidence: 100%
Detected patterns

\.amazon-adsystem\.com

Amazon S3 (CDN) Expand

Overall confidence: 100%
Detected patterns

s3[^ ]*\.amazonaws\.com/

AppNexus (Advertising) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Basis Technologies (Advertising) Expand

Overall confidence: 100%
Detected patterns

cdn01\.basis\.net

cdnjs (CDN) Expand

Overall confidence: 100%
Detected patterns

cdnjs\.cloudflare\.com

Cloudflare Bot Management (Security) Expand

Overall confidence: 100%
Detected patterns

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

DoubleClick Floodlight (Advertising) Expand

Overall confidence: 100%
Detected patterns

\.doubleclick\.net

Dreamdata (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

\.bizible\.com/

Facebook Pixel (Analytics) Expand

Overall confidence: 100%
Detected patterns

connect\.facebook\.\w+/.+/fbevents\.js
connect\.facebook.\w+/signals/config/\d+\?v=([\d\.]+)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js
google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Hosted Libraries (CDN) Expand

Overall confidence: 100%
Detected patterns

ajax\.googleapis\.com/ajax/libs/

Google Tag Manager (Tag managers) Expand

Overall confidence: 100%
Detected patterns

\.googletagmanager\.com/
googletagmanager\.com/gtm\.js

Highlight.js (JavaScript libraries) Expand

Overall confidence: 100%
Detected patterns

/(?:([\d.])+/)?highlight(?:\.min)?\.js

jQuery (JavaScript libraries) Expand

Overall confidence: 100%
Detected patterns

jquery
/(\d+\.\d+\.\d+)/jquery(?!\.popupoverlay\.js|(?:\.[\w-]*)*fancybox)[/.-][^u]

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

cdn\.jsdelivr\.net

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Microsoft Advertising (Advertising) Expand

Overall confidence: 100%
Detected patterns

bat\.bing\.com/bat\.js
\w+

OpenX (Advertising) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PathFactory (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

cdn-app\.pathfactory\.com

PubMatic (Advertising) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Qualified (Live chat) Expand

Overall confidence: 100%
Detected patterns

\.qualified\.com/

Reddit Ads (Advertising) Expand

Overall confidence: 100%
Detected patterns

www\.redditstatic\.com

Rubicon Project (Advertising) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Simpli.fi (Advertising) Expand

Overall confidence: 100%
Detected patterns

\.simpli\.fi

Sovrn (Advertising) Expand

Overall confidence: 100%
Detected patterns

\.(?:linksmart|lijit)\.com/

Twitter Ads (Advertising) Expand

Overall confidence: 100%
Detected patterns

static\.ads-twitter\.com/uwt\.js

Twitter Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

analytics\.twitter\.com

VWO (Analytics) Expand

Overall confidence: 100%
Detected patterns

dev\.visualwebsiteoptimizer\.com/

Page Statistics

193
Requests

82 %
HTTPS

41 %
IPv6

74
Domains

100
Subdomains

77
IPs

4
Countries

4609 kB
Transfer

16239 kB
Size

103
Cookies

26 Outgoing links

These are links going to different origins than the main page.

URL: https://resource.redcanary.com/rs/003-YRU-314/images/2022_ThreatDetectionReport_RedCanary.pdf
Title: 2022 Threat Detection Report PDF

Search URL Search Domain Scan URL

URL: https://resource.redcanary.com/rs/003-YRU-314/images/2022TDR_ExecutiveSummary.pdf
Title: 2022 Executive Summary PDF

Search URL Search Domain Scan URL

URL: https://docs.redcanary.com/
Title: Documentation

Search URL Search Domain Scan URL

URL: https://twitter.com/share?url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F

Search URL Search Domain Scan URL

URL: https://github.com/BloodHoundAD/BloodHound
Title: BloodHound

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/
Title: ransomware intrusions

Search URL Search Domain Scan URL

URL: https://www.picussecurity.com/resource/leaked-tools-ttps-and-iocs-used-by-conti-ransomware-group
Title: leaks about their operations

Search URL Search Domain Scan URL

URL: https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/
Title: Gootloader execution

Search URL Search Domain Scan URL

URL: https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/hunting-for-reconnaissance-activities-using-ldap-search-filters/ba-p/824726
Title: Microsoft blog

Search URL Search Domain Scan URL

URL: https://atomicredteam.io/execution/T1059.001/#atomic-test-2---run-bloodhound-from-local-disk
Title: locally

Search URL Search Domain Scan URL

URL: https://atomicredteam.io/execution/T1059.001/#atomic-test-3---run-bloodhound-from-memory-using-download-cradle
Title: download cradle

Search URL Search Domain Scan URL

URL: https://docs.redcanary.com/#doc_main_content
Title: Products and Solutions

Search URL Search Domain Scan URL

URL: https://docs.redcanary.com/docs/administration
Title: Administration

Search URL Search Domain Scan URL

URL: https://docs.redcanary.com/docs/api-extensibility
Title: APIs and Extensibility

Search URL Search Domain Scan URL

URL: https://docs.redcanary.com/docs/endpoint-usage-how-licensing-and-endpoint-usage-is-determined
Title: Licensing and Usage

Search URL Search Domain Scan URL

URL: https://docs.redcanary.com/docs/red-canary-release-notes
Title: Release Notes

Search URL Search Domain Scan URL

URL: https://docs.redcanary.com/docs/supported-integrations
Title: Supported Integrations

Search URL Search Domain Scan URL

URL: https://support.redcanary.com/hc/en-us
Title: Support Article

Search URL Search Domain Scan URL

URL: https://docs.redcanary.com/docs/getting-help
Title: Getting Help

Search URL Search Domain Scan URL

URL: https://go.my.redcanary.co/saml/create?RelayState=https%3A%2F%2Fsupport.redcanary.com%2Fhc%2Fen-us%2Frequests%2Fnew&brand_id=360004622793&SAMLRequest=hZFLT8MwEITv%2FArLdydOmr6sJlXUCilSQagFDtxcZ6tG%2BBG8Tmn59aiBSuUA%0AXHfn08zOzuZHo8kBPDbO5jSJOJ0XNzOURrei7MLeruGtAwzkaLRF0S9y2nkr%0AnMQGhZUGUAQlNuXdSqQRF613wSmn6RXyNyERwYfGWUqqZU7PgGdbPkxgNwG2%0A5dMRywaDMZOD7ZRNphnPJtMsqWFMSYXYQWUxSBtymvJ0yPiQpfwxGYmEC569%0AUPJ8uS6NOCXlxWzhLHYG%2FAb8oVHwtF7ldB9CiyKOPdRKWulPe9Bt9AG2BnyN%0AlDOxVAoQ43NGWvQ9iT6DL%2F5lZ%2FG1%2FLvje2mgWj443agTKbV27wsPMkBOg%2B%2BA%0AklvnjQy%2F95dEST9parbrpQKMbHRZ1x4QaVx8uf58ZnHzCQ%3D%3D%0A
Title: Contact Support

Search URL Search Domain Scan URL

URL: https://go.my.redcanary.co/saml/create?RelayState=https%3A%2F%2Fsupport.redcanary.com%2Fhc%2Fen-us%2Frequests&brand_id=360004622793&SAMLRequest=hZHNT8JAEMXv%2FBXN3rfdFhGyoSUNxIQEjcGPg7fpdhoa96PubBH86w1VEjyo%0A15n3y3vzZr44GB3t0VPrbM7SWLBFMZoTGN3Jsg87u8W3HilEB6MtyWGRs95b%0A6YBakhYMkgxKPpS3G5nFQnbeBaecZhfI3wQQoQ%2Btsyxar3J2AjwfC8BsViOv%0AmmzGr5rpjENTjXkGMEUQk6qpBIvWRD2uLQWwIWeZyCZcTHgmHtNrmQqZTl9Y%0A9Hy%2BLosFi8qz2dJZ6g36B%2FT7VuHTdpOzXQgdySTxWCuw4I871F38gbZGeo2V%0AMwkohUTJKSMrhp7kkMEX%2F7Lz5FL%2B3fEdGFyv7p1u1TEqtXbvS48QMGfB98ii%0AG%2BcNhN%2F7S%2BN0mLQ1bwapRAOtLuvaIxFLii%2FXn88sRp8%3D%0A
Title: Manage Tickets

Search URL Search Domain Scan URL

URL: https://x.com/redcanary

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/redcanary/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/@RedCanary

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 52

https://tracking.intentsify.io/page-tracking/intentsify-redcanary/https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F HTTP 302
https://a.usbrowserspeed.com/cs?pid=5476ad7fb254ae8ddffd9ee34e77cfbb0c895c04783f2a615f8a1341878ee532&puid=e22feff5-ba40-47b6-bf49-ff9a0923d2c4-intentsify-redcanary-de3b49b0-e9dd-4553-9811-f1bd40d71959

Request Chain 124

https://pixel-sync.sitescout.com/dmp/asyncPixelSync HTTP 302
https://pixel-sync.sitescout.com/dmp/asyncPixelSync?cookieQ=1

Request Chain 125

https://pixel.sitescout.com/up/c8592fd2d60719de?cntr_url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F HTTP 302
https://pixel.sitescout.com/up/c8592fd2d60719de?cookieQ=1&cntr_url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F

Request Chain 129

https://dpm.demdex.net/ibs:dpid=82530&dpuuid=b03d89eb-d60b-4fd8-b177-462ca43604af-6a2a0c96-5553&gdpr=0&gdpr_consent= HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=b03d89eb-d60b-4fd8-b177-462ca43604af-6a2a0c96-5553&gdpr=0&gdpr_consent=

Request Chain 130

https://pixel.tapad.com/idsync/ex/receive?partner_id=2499&partner_device_id=b03d89eb-d60b-4fd8-b177-462ca43604af-6a2a0c96-5553 HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=b03d89eb-d60b-4fd8-b177-462ca43604af-6a2a0c96-5553

Request Chain 131

https://loadm.exelator.com/load/?p=204&g=700&j=0&buid=b03d89eb-d60b-4fd8-b177-462ca43604af-6a2a0c96-5553&gdpr=0&gdpr_consent= HTTP 302
https://loadm.exelator.com/load/?p=204&g=700&j=0&buid=b03d89eb-d60b-4fd8-b177-462ca43604af-6a2a0c96-5553&gdpr=0&gdpr_consent=&xl8blockcheck=1 HTTP 302
https://load77.exelator.com/pixel.gif

Request Chain 132

https://idsync.rlcdn.com/384136.gif?partner_uid=b03d89eb-d60b-4fd8-b177-462ca43604af-6a2a0c96-5553&gdpr=0&gdpr_consent= HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CIi5FxI9CjkIARCMThoyYjAzZDg5ZWItZDYwYi00ZmQ4LWIxNzctNDYyY2E0MzYwNGFmLTZhMmEwYzk2LTU1NTMQABoNCJaZqNEGEgUI6AcQAEIASgA

Request Chain 133

https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=b03d89eb-d60b-4fd8-b177-462ca43604af-6a2a0c96-5553&gdpr=0&gdpr_consent= HTTP 302
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=b03d89eb-d60b-4fd8-b177-462ca43604af-6a2a0c96-5553&gdpr=0&gdpr_consent=&ct=y

Request Chain 137

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1781140630553&li_adsId=2399b5ae-4099-4996-80a0-5d203442ddda&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&tm=gtmv2 HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1781140630553&li_adsId=2399b5ae-4099-4996-80a0-5d203442ddda&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&tm=gtmv2&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1781140630553%26li_adsId%3D2399b5ae-4099-4996-80a0-5d203442ddda%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fthreat-detection-report%252Fthreats%252Fbloodhound%252F%26tm%3Dgtmv2%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1781140630553&li_adsId=2399b5ae-4099-4996-80a0-5d203442ddda&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&tm=gtmv2&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1781140630553&li_adsId=2399b5ae-4099-4996-80a0-5d203442ddda&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQLkkwOU4SlRJwAAAZ60QS1ZcguRrh4SMcogdDK4FTPgfGrNLZv1k4EW4zcMnlmG_yzrhs-K_LX37A

Request Chain 150

https://c.clarity.ms/c.gif HTTP 302
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=2CD965EBCC5E44B48EE32264F88472F1&RedC=c.clarity.ms&MXFR=11AFEF76B99267412A68F803BD9269F9 HTTP 302
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=2CD965EBCC5E44B48EE32264F88472F1&MUID=0D0CCACBBD6762AF26ACDDBEBCA56351

Request Chain 152

https://um.simpli.fi/bombora HTTP 302
https://ml314.com/utsync.ashx?et=0&eid=93940&fp=BAD0F1C186764379A7E8F3E2C74AF371

Request Chain 153

https://um.simpli.fi/bidswitch HTTP 302
https://x.bidswitch.net/sync?dsp_id=518&user_id=BAD0F1C186764379A7E8F3E2C74AF371 HTTP 302
https://x.bidswitch.net/ul_cb/sync?dsp_id=518&user_id=BAD0F1C186764379A7E8F3E2C74AF371 HTTP 302
https://yield-op-idsync.live.streamtheworld.com/pixel.gif?partner=bsw&uid=410650b0-a7b0-4a9a-a6c7-092a4ecec8c6&stn=&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=

Request Chain 154

https://um.simpli.fi/adswizz HTTP 302
https://synchroscript.deliveryengine.adswizz.com/syncMe?partnerDomain=simpli.fi&idType=cookie&partnerUserId=BAD0F1C186764379A7E8F3E2C74AF371

Request Chain 155

https://um.simpli.fi/eyeota HTTP 302
https://ps.eyeota.net/match?bid=irm51m1&uid=BAD0F1C186764379A7E8F3E2C74AF371 HTTP 302
https://ps.eyeota.net/match/bounce/?bid=irm51m1&uid=BAD0F1C186764379A7E8F3E2C74AF371

Request Chain 156

https://um.simpli.fi/smaato HTTP 302
https://s.ad.smaato.net/c/?dspInit=675&dspCookie=BAD0F1C186764379A7E8F3E2C74AF371 HTTP 302
https://s.amazon-adsystem.com/dcm?pid=6c6fd2c8-c9f3-4a37-9a77-029dc3cc98b3&id=918f30da07&gdpr=0&gdpr_consent= HTTP 302
https://s.amazon-adsystem.com/dcm?pid=6c6fd2c8-c9f3-4a37-9a77-029dc3cc98b3&id=918f30da07&gdpr=0&gdpr_consent=&dcc=t

Request Chain 157

https://um.simpli.fi/nexxen HTTP 302
https://sync.1rx.io/usersync/simplifi/BAD0F1C186764379A7E8F3E2C74AF371 HTTP 302
https://sync.1rx.io/usersync/simplifi/BAD0F1C186764379A7E8F3E2C74AF371?zcc=1&cb=1781140631306 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-b544f06f-2021-4524-be56-659b06ea0565-005

Request Chain 158

https://um.simpli.fi/triplelift HTTP 302
https://eb2.3lift.com/xuid?mid=7969&xuid=BAD0F1C186764379A7E8F3E2C74AF371&dongle=yf3 HTTP 302
https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=BAD0F1C186764379A7E8F3E2C74AF371&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=

Request Chain 159

https://um.simpli.fi/telaria_p HTTP 302
https://simplifi.partners.tremorhub.com/sync?UISF=BAD0F1C186764379A7E8F3E2C74AF371

Request Chain 160

https://um.simpli.fi/tapad HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=BAD0F1C186764379A7E8F3E2C74AF371

Request Chain 161

https://um.simpli.fi/ad_advisor HTTP 302
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=BAD0F1C186764379A7E8F3E2C74AF371 HTTP 302
https://d.agkn.com/pixel/10751/?che=1781140631413&ip=8.46.120.161&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D212680605640001374383 HTTP 302
https://um.simpli.fi/aa_px?sk=212680605640001374383 HTTP 302
https://um.simpli.fi/empty.gif

Request Chain 162

https://um.simpli.fi/intentiq HTTP 302
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=BAD0F1C186764379A7E8F3E2C74AF371 HTTP 302
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=BAD0F1C186764379A7E8F3E2C74AF371&ckls=true&ci=XuBqwjHfbC&nc=false&trid=1360377190 HTTP 302
https://syncv4.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=BAD0F1C186764379A7E8F3E2C74AF371&ckls=true&ci=XuBqwjHfbC&nc=false&trid=1360377190&ripv6=2001:1900:2200:4e41:0:0:0:161

Request Chain 163

https://um.simpli.fi/pubmatic HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:BAD0F1C186764379A7E8F3E2C74AF371

Request Chain 164

https://um.simpli.fi/freewheel HTTP 302
https://user-sync.fwmrm.net/ad/u?mode=user-register&dspid=24&dspuid=BAD0F1C186764379A7E8F3E2C74AF371&gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=

Request Chain 165

https://um.simpli.fi/dtnx HTTP 302
https://fei.pro-market.net/engine?du=24;csync=BAD0F1C186764379A7E8F3E2C74AF371;mimetype=img; HTTP 302
https://fei.pro-market.net/engine?du=24;csync=BAD0F1C186764379A7E8F3E2C74AF371;mimetype=img;sr HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datonics-ddp&google_cm&google_hm=LTUxMjY0OTM5MjQwNTA5NzYwNDI= HTTP 302
https://pbid.pro-market.net/engine?du=53&mimetype=img&google_gid=CAESEGP6YV4cl3XuGfX_nVjIFtI&google_cver=1

Request Chain 166

https://um.simpli.fi/exelatem HTTP 302
https://loadm.exelator.com/load/?p=204&g=2191&simid=BAD0F1C186764379A7E8F3E2C74AF371&j=0

Request Chain 167

https://um.simpli.fi/yahoo HTTP 302
https://ups.analytics.yahoo.com/ups/55964/sync?uid=BAD0F1C186764379A7E8F3E2C74AF371 HTTP 302
https://ups.analytics.yahoo.com/ups/55964/sync?uid=BAD0F1C186764379A7E8F3E2C74AF371&verify=true

Request Chain 168

https://um.simpli.fi/beachfront HTTP 302
https://sync.bfmio.com/sync?pid=141&uid=BAD0F1C186764379A7E8F3E2C74AF371

Request Chain 169

https://um.simpli.fi/crwdcntrl HTTP 302
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=BAD0F1C186764379A7E8F3E2C74AF371

Request Chain 170

https://um.simpli.fi/lj_match HTTP 302
https://ce.lijit.com/merge?pid=2&3pid=BAD0F1C186764379A7E8F3E2C74AF371 HTTP 302
https://ce.lijit.com/merge?pid=2&3pid=BAD0F1C186764379A7E8F3E2C74AF371&dnr=1

Request Chain 171

https://um.simpli.fi/liveramp_match HTTP 302
https://idsync.rlcdn.com/419566.gif?partner_uid=BAD0F1C186764379A7E8F3E2C74AF371 HTTP 307
https://pippio.com/api/sync?pid=5324&it=1&iv=8e61fa1d39d723952968e5a35ee5dd059b8cdb09414def0633ad1c292eb5df78791426b5417dce21&_=2 HTTP 307
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=8e61fa1d39d723952968e5a35ee5dd059b8cdb09414def0633ad1c292eb5df78791426b5417dce21&rand=04931552

Request Chain 172

https://www.googleadservices.com/pagead/conversion/1026675585/?random=1781140631136&cv=7&fst=1781140631136&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=150185224&cv=7&fst=1781140631136&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLTesQII8t-xAgit4bECCK7hsQIIr-GxAgihuLECCLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgi0xrECCJPasQII29yxAgiH27ECCNPFsQII68yxAgjtzrECCNXPsQII9NqxAgjL47ECCK7lsQIIl9SxAgjJ27ECCLHhsQIIs-GxAgim3bECCLDesQIIgNuxAg&cerd=CgSk870t&fsk=ChEI8Jak0QYQ0vjt2LrIqfzCARIsAOdlATuPBcgZdJeQMHJGy4x2OFjKofzkJrJkzJ3a3dwx6YOtFRNA4n1P-roaAuvC&pscrd=IhMI0ov59IH-lAMVYmVHAR0xvC7DOhZodHRwczovL3JlZGNhbmFyeS5jb20vegwICWIICAAQABgAIAA HTTP 302
https://www.google.com/pagead/1p-conversion/1026675585/?random=150185224&cv=7&fst=1781140631136&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLTesQII8t-xAgit4bECCK7hsQIIr-GxAgihuLECCLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgi0xrECCJPasQII29yxAgiH27ECCNPFsQII68yxAgjtzrECCNXPsQII9NqxAgjL47ECCK7lsQIIl9SxAgjJ27ECCLHhsQIIs-GxAgim3bECCLDesQIIgNuxAg&cerd=CgSk870t&fsk=ChEI8Jak0QYQ0vjt2LrIqfzCARIsAOdlATuPBcgZdJeQMHJGy4x2OFjKofzkJrJkzJ3a3dwx6YOtFRNA4n1P-roaAuvC&pscrd=IhMI0ov59IH-lAMVYmVHAR0xvC7DOhZodHRwczovL3JlZGNhbmFyeS5jb20vegwICWIICAAQABgAIAA&is_vtc=1&cid=CAQS-QEAEQoqgdEp22WjmOHbW0FmMo3NjHfe1Z2G7Gt4Xm42urQx3JuVVO1cOr3jYUansBLmBJKukTgexQMHYF5Lpikp1XggGZHp34lDr08Jxi1HOHJSFMezDqvVsWCpL4VqGlGJTHRL-rjmvinOtLvMxlj-WNCPaSOQsNIcuvtRTEAKdZGML4uXkYGwxrQPAlGTYUZ15z5I76f9D3rcyaVjNlncolduHc1uU55Gr-jaKQsfwL-8AeSc8qszfP3_lSEa_aJijFLgUorUgbf8d-0447C9ynQ-hLzbhtQ1_3SZ_m8LIWm60vXYCdKxHd4jkCNmg6wQBiV3we0RAe0&random=690000449

Request Chain 174

https://um.simpli.fi/an HTTP 302
https://ib.adnxs.com/setuid?entity=66&code=BAD0F1C186764379A7E8F3E2C74AF371 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D66%26code%3DBAD0F1C186764379A7E8F3E2C74AF371

Request Chain 175

https://um.simpli.fi/rb_match HTTP 302
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=BAD0F1C186764379A7E8F3E2C74AF371&expires=365

Request Chain 176

https://um.simpli.fi/ox_match HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072966&val=BAD0F1C186764379A7E8F3E2C74AF371 HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=BAD0F1C186764379A7E8F3E2C74AF371

193 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
redcanary.com/threat-detection-report/threats/bloodhound/ 403 KB
71 KB 256ms
102ms Document
text/html 104.198.136.223
Google LLC

General

Check archive.org

Download Go to

Full URL

https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

374087c3056d96a733ba5c4383e1c3af526444dffe5c6aed84b544e48a6a808c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN deny
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

cache-control: max-age=600, must-revalidate
content-encoding: gzip
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
content-type: text/html; charset=UTF-8
date: Thu, 11 Jun 2026 01:17:07 GMT
feature-policy: microphone 'none'; geolocation 'none'
link: <https://redcanary.com/?p=33617>; rel=shortlink
referrer-policy: no-referrer strict-origin-when-cross-origin
server: nginx
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
vary: Accept-Encoding Accept-Encoding
x-cache: HIT: 37
x-cache-group: normal
x-cacheable: SHORT
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN deny
x-permitted-cross-domain-policies: master-only
x-powered-by: WP Engine
x-xss-protection: 1; mode=block

GET
H3 200 relyance-agent.js Show response
consent.app.relyance.ai/ 332 KB
74 KB 63ms
23ms Script
application/javascript 2606:4700:20::681a:34f
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://consent.app.relyance.ai/relyance-agent.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:34f -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d2708f532e2389edc680bab6bae3f952e08413c672dceb75ef03b3f3346df6a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
cf-cache-status: HIT
x-amz-version-id: rcNRJv6w7rznEUGRbpxceM8V76V2NL0o
etag: W/"87d3216949ead896210849cb31fdee44"
age: 47
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=04o1aguaa4BMVxcxNf9SZUlPIv1p6BJOCLNpB28hTBsmzZlWwfldd%2BoBuoo2qvHrq%2B4A3CrUCoXgRAMZlHU9jyUR%2FzK%2FnK6MZktMbvDYFVE4526l5XKRXDqEUA2YQgGSvTDPAreT%2B1Tx%2FkoOXYkHl0KoVwA2"}]}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: dxTUvLxvk8nFXm3Ur-V-rIi6sdj8Lkrc5m2fStUZfF9deoJprKkCmA==
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: application/javascript
vary: Accept-Encoding, Origin
last-modified: Wed, 10 Jun 2026 11:52:25 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
priority: u=1,i=?0
cache-control: public, max-age=14400, stale-while-revalidate=3600, stale-if-error=86400
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
server-timing: cfExtPri
referrer-policy: strict-origin-when-cross-origin
via: 1.1 bc413bb41d41a5b805e3b9ecdcebc510.cloudfront.net (CloudFront)
cf-ray: a09cc63a1af6e351-EWR
x-xss-protection: 1
x-amz-cf-pop: JFK50-P10
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.7.1/ 85 KB
30 KB 77ms
26ms Script
text/javascript 2607:f8b0:4004:c1f::5f
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2607:f8b0:4004:c1f::5f Washington, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
age: 7146
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Thu, 10 Jun 2027 23:18:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 10 Jun 2026 23:18:01 GMT
last-modified: Tue, 12 Sep 2023 02:38:22 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 30462
x-xss-protection: 0
server: sffe

GET
H2 200 forms2.min.js Show response
resource.redcanary.com/js/forms2/js/ 201 KB
67 KB 72ms
25ms Script
text/javascript 104.17.74.206
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.74.206 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 17e2808b4349a08c4f770cacf481d4803adb21fb958f050579cfe716204951aa

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "325d2-653c7cc924800-gzip"
age: 6956
cf-ray: a09cc63a2803e0c6-EWR
expires: Thu, 11 Jun 2026 05:17:07 GMT
accept-ranges: bytes
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: text/javascript
last-modified: Tue, 09 Jun 2026 01:10:56 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 index.production.js Show response
cdn.jsdelivr.net/npm/@algolia/autocomplete-js@1.19.2/dist/umd/ 94 KB
22 KB 109ms
30ms Script
application/javascript 2a04:4e42:1000::485
Fastly

General

Check archive.org

Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@algolia/autocomplete-js@1.19.2/dist/umd/index.production.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:1000::485 , United States, ASN54113 (FASTLY - Fastly, Inc., US),

Reverse DNS

Software

Resource Hash

a4959332faa5065301c5d90ce5b23549c2150bb2c52680a9945d2a42d70beb6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"178b9-WeOvO0YPrsUnzZPzHWjiCV0mutE"
age: 776941
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-eddf8230048-FRA, cache-chi-kigq8000033-CHI
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 22019
x-jsd-version: 1.19.2

GET
H2 200 algoliasearch-lite.umd.js Show response
cdn.jsdelivr.net/npm/algoliasearch@4.18.0/dist/ 14 KB
5 KB 138ms
59ms Script
application/javascript 2a04:4e42:1000::485
Fastly

General

Check archive.org

Download Go to

Full URL

https://cdn.jsdelivr.net/npm/algoliasearch@4.18.0/dist/algoliasearch-lite.umd.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:1000::485 , United States, ASN54113 (FASTLY - Fastly, Inc., US),

Reverse DNS

Software

Resource Hash

57718756531202ca204f7c0bd0e63f9787777d12dae7a80dce59f37483012168

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"3832-QbjK4wu5GdRBT0qyEbQFtYF8LBI"
age: 754030
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-etou8220157-FRA, cache-chi-kigq8000033-CHI
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4665
x-jsd-version: 4.18.0

GET
H2 200 instantsearch.production.min.js Show response
cdn.jsdelivr.net/npm/instantsearch.js@4.79.0/dist/ 328 KB
84 KB 116ms
37ms Script
application/javascript 2a04:4e42:1000::485
Fastly

General

Check archive.org

Download Go to

Full URL

https://cdn.jsdelivr.net/npm/instantsearch.js@4.79.0/dist/instantsearch.production.min.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:1000::485 , United States, ASN54113 (FASTLY - Fastly, Inc., US),

Reverse DNS

Software

Resource Hash

14e536a30a273683a637117823c8cb4780fcc3fbf3898362eb81943766e85d14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"51ebc-GMC1CyLWd6GNp2YINSN3Tpqpd/Y"
age: 1800884
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-eddf8230103-FRA, cache-chi-kigq8000033-CHI
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 85653
x-jsd-version: 4.79.0

GET
H/1.1 200
OK bizible.js Show response
cdn.bizible.com/scripts/ 67 KB
25 KB 106ms
42ms Script
application/x-javascript 2600:1408:c400:5a::addf:a3c6
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:c400:5a::addf:a3c6 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

5fef814edcb8411511996c8d5c559c2a5a1bee348fc15edb8d0e18a3cfab83ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Strict-Transport-Security: max-age=31536000; includeSub
Cache-Control: max-age=86400
Content-Encoding: gzip
ETag: "b92294387f5dc1:0"
Connection: keep-alive
Accept-Ranges: bytes
Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600
Content-Length: 25392
Date: Thu, 11 Jun 2026 01:17:07 GMT
Content-Type: application/x-javascript
Last-Modified: Sat, 06 Jun 2026 07:35:14 GMT
Vary: Accept-Encoding

GET
H2 200 qualified.js Show response
js.qualified.com/ 422 KB
118 KB 98ms
28ms Script
text/javascript 104.18.17.5
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.17.5 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d0fc0d74559d5db3cd085d9d4450e9abc7bd47dfdc6d838cb0028d691f506a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-request-id: 9b7d914d-d60d-4f40-be2c-452332c38c22
content-encoding: gzip
cf-cache-status: HIT
etag: W/"a8ede76192cc32d575581b0b45ad95d6"
age: 4572
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
x-cache: miss
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: text/javascript; charset=utf-8
vary: Accept,Accept-Encoding
x-runtime: 0.050321
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=63072000; includeSubDomains
cache-control: max-age=60, public, stale-while-revalidate=60, stale-if-error=300, s-maxage=86400
x-envoy-upstream-service-time: 63
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: a09cc63bff95f569-EWR
x-xss-protection: 0
server: cloudflare

GET
H3 200 analytics.js Show response
analytics.ahrefs.com/ 7 KB
3 KB 66ms
31ms Script
text/javascript 2606:4700:4404::ac40:9473
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://analytics.ahrefs.com/analytics.js
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:4404::ac40:9473 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b270afc5f9df7bcd9239c22857fb1511bba1398a28b1c3548272d720cb433c62

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-request-id: 7facbf60-94ea-4665-8514-73296143443a
content-encoding: gzip
cf-cache-status: HIT
age: 9489
traceparent: 00-7c9781dfdff94146b4d879c67b447a92-56c858029eb14ab1-03
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: text/javascript
vary: accept-encoding
last-modified: Wed, 10 Jun 2026 22:38:58 GMT
priority: u=3,i=?0
cdn-cache-control: max-age=18000
cache-control: max-age=14400
cf-ray: a09cc63bbfbd5930-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2692
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 428 KB
148 KB 155ms
87ms Script
application/javascript 2607:f8b0:4004:c1d::61
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-759876114

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::61 Washington, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

10f87ded7ce26406344832aa6bcd1bfc0f203f369992c68d0a7005f7e2a07ef9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: zstd
expires: Thu, 11 Jun 2026 01:17:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 11 Jun 2026 00:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 151342
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 jquery.matchHeight-min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery.matchHeight/0.7.2/ 3 KB
2 KB 65ms
26ms Script
application/javascript 2606:4700::6811:190e
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery.matchHeight/0.7.2/jquery.matchHeight-min.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

fa87904726726364ad19a7c4b2f2b20ee10637325601b5aa88ed8bfdcb7117a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Origin: https://redcanary.com
sec-ch-ua-platform: "Linux"
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-cdnjs-via: cfworker/r2
content-encoding: br
cf-cache-status: HIT
age: 8097
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=q8FOamfXaJP7OsrQzwsAsYl5sTTXMY1zs9RmqlbmyihCARN%2BvObjcsEqyrtNH85B%2FUGA%2BLTvt2w27l31iqH2WXNiPk4r7b3MTPNQZ1LX7vXc9nMM7BbQhG%2B7ewkQ%2BLeCrKEF95uUubyuB0dNdm3XfWDh"}]}
x-content-type-options: nosniff
expires: Tue, 01 Jun 2027 01:17:07 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-cdnjs-cache: HIT
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 04 May 2020 16:11:47 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: a09cc63a1ab642bf-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 highlight.min.js Show response
cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/ 130 KB
33 KB 61ms
30ms Script
application/javascript 2606:4700::6811:190e
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/highlight.min.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d2f545bb226e5bcc1d50af37b345d245dce63bc07aaeba2243e0f1ea87b2dcb9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-cdnjs-via: cfworker/r2
content-encoding: br
cf-cache-status: HIT
age: 12981
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=%2BDnXzKkIAfSrzuj3wUzeBUmqCyAhzwx6f%2FAJD9XeSEb7uCylYue4aDpy%2B1jTu5rOT9PBPErIb5s6dT%2BM%2FCyb9jm%2Bp12c2Rgrq03dKSbFSUKreNyVufi60yuZSpcv8G3YOQ20ZYvC6aForImmdFCYByuL"}]}
x-content-type-options: nosniff
expires: Tue, 01 Jun 2027 01:17:07 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-cdnjs-cache: HIT
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 08 Feb 2021 15:10:43 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: a09cc63a4e31de94-EWR
access-control-allow-origin: *
server: cloudflare

GET
H/1.1 200
OK teknkl-formsplus-1.0.5.js Show response
s3-us-west-2.amazonaws.com/s.cdpn.io/250687/ 41 KB
41 KB 289ms
116ms Script
application/x-js 16.15.35.30
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://s3-us-west-2.amazonaws.com/s.cdpn.io/250687/teknkl-formsplus-1.0.5.js
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 16.15.35.30 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 731fcb30d45f2e35aaa139a7a964410a7c2bcdbfbb48a837c9d56dec7cc3732f

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Cache-Control: public
ETag: "bab0c2b3523f8244564b675fe34db610"
x-amz-version-id: OjXdZ5iYdmgpgEuq0ftytCBc_PO35ThO
x-amz-request-id: AHNV5Y6M0M93VWW0
Accept-Ranges: bytes
Content-Length: 41617
Date: Thu, 11 Jun 2026 01:17:08 GMT
Last-Modified: Thu, 26 Apr 2018 08:20:46 GMT
Content-Type: application/x-js
Server: AmazonS3
x-amz-id-2: 0dGpirKhY67xoXECM1KvQO+ZgpD+yUvpGDJJkocScGd7T2rbXgmWyZ21TgEd5aVXGUqtGNSP/o7NafLebbhsZtBK1S/HZM10

GET
H2 200 algolia-autocomplete.min.js Show response
redcanary.com/wp-content/themes/redcanary/ 4 KB
2 KB 64ms
63ms Script
application/javascript 104.198.136.223
Google LLC

General

Check archive.org

Download Go to

Full URL

https://redcanary.com/wp-content/themes/redcanary/algolia-autocomplete.min.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

f0255e984f987d1402db5f2a8426f5174bca1cd50ee0ca10abab75d33cd90d67

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/threat-detection-report/threats/bloodhound/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
cache-control: public, max-age=31536000
content-encoding: gzip
etag: W/"69cc25c7-f68"
access-control-allow-origin: *
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: application/javascript
last-modified: Tue, 31 Mar 2026 19:51:35 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding

GET
H2 200 autoptimize_8ba18401d8534bf78474252c699ca9db.js Show response
redcanary.com/wp-content/cache/autoptimize/js/ 291 KB
82 KB 104ms
96ms Script
application/javascript 104.198.136.223
Google LLC

General

Check archive.org

Download Go to

Full URL

https://redcanary.com/wp-content/cache/autoptimize/js/autoptimize_8ba18401d8534bf78474252c699ca9db.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

2bad7f5d14684de5ca3bdde7b9b99a8d2e96969a29f3103b275301847e3c7609

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/threat-detection-report/threats/bloodhound/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
cache-control: public, max-age=31536000
content-encoding: gzip
etag: W/"6a22f858-48a5f"
access-control-allow-origin: *
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: application/javascript
last-modified: Fri, 05 Jun 2026 16:24:56 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding

GET
H3 200 location Show response
consent.app.relyance.ai/api/ 47 B
756 B 49ms
24ms Fetch
application/json 2606:4700:20::681a:34f
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://consent.app.relyance.ai/api/location

Requested by

Host: consent.app.relyance.ai
URL: https://consent.app.relyance.ai/relyance-agent.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:34f -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

1841968e84bd3fdf8d7cf2ec5af55238e50bb3f6a8f6552a19b7c447ed6150aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-expose-headers: *
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=WfdmcReJCN3KayoDZVIQhnboqLIHUlb5CixWF0axkNGYzbWqdL4Qlk9ArY9RQY8Gtda6Mb%2F3T2RmImjB86ypIGzoTUSvdhOO78Unvt52wWcfkQfsXwhnGjExXj8tnkDXw5gOhIckdWEcEEMgiobXkej0T9aZ"}]}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: FunctionGeneratedResponse from cloudfront
x-amz-cf-id: 5vkXkdidUzkzdTuZy_qOrTCuELI9ezbKZNGzVMdmNtDQLo435yyjpg==
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: application/json
priority: u=1,i
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
server-timing: cfExtPri
cache-control: no-cache
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
referrer-policy: strict-origin-when-cross-origin
via: 1.1 4118eb7b967838562b3ffdc0051e0fb8.cloudfront.net (CloudFront)
cf-ray: a09cc63ade370d85-EWR
access-control-allow-origin: *
content-length: 47
x-xss-protection: 1
x-amz-cf-pop: JFK50-P10
server: cloudflare

GET
H2 200 search-insights.iife.min.js Show response
cdn.jsdelivr.net/npm/search-insights@2.17.3/dist/ 12 KB
4 KB 38ms
30ms Script
application/javascript 2a04:4e42:1000::485
Fastly

General

Check archive.org

Download Go to

Full URL

https://cdn.jsdelivr.net/npm/search-insights@2.17.3/dist/search-insights.iife.min.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:1000::485 , United States, ASN54113 (FASTLY - Fastly, Inc., US),

Reverse DNS

Software

Resource Hash

04c460157758fc7cf9748c5c142417a9791fe3c80c4dbf04df8dafb47414313c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"3122-9IJSHbh4FALnnvwm5RYuVBX1kB8"
age: 1289926
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-etou8220052-FRA, cache-chi-kigq8000033-CHI
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3733
x-jsd-version: 2.17.3

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 145ms
57ms Script
application/x-javascript 23.13.173.12
Akamai Technologies

General

Check archive.org

Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.13.173.12 Sterling, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-13-173-12.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: bbdb0a56c8eb30d3b915526ca2bf873b4f73b05bb06be0ba790c9006abeb44fc

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Content-Encoding: gzip
ETag: "fcdfb1ac4ff081d9b3f3d5a96d56eae0:1778641548.919977"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 729
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Date: Thu, 11 Jun 2026 01:17:07 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 13 May 2026 03:05:48 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 570 KB
180 KB 167ms
102ms Script
application/javascript 2607:f8b0:4004:c1d::61
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::61 Washington, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7b48595afb89093d7306c1a2d3555b088f195f1a898837dfe0bf7b8593d353e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: zstd
expires: Thu, 11 Jun 2026 01:17:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 11 Jun 2026 00:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 184180
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 css
fonts.googleapis.com/ 8 KB
1 KB 41ms
37ms Stylesheet
text/css 2607:f8b0:4004:c1f::5f
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2607:f8b0:4004:c1f::5f Washington, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

3d87310582ba2a51b5fabbd081e349c3bcc89cc9f76277da6a5d397dd3b4f937

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Thu, 11 Jun 2026 01:17:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Thu, 11 Jun 2026 01:17:07 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H/1.1 200
OK bat.js Show response
bat.bing.com/ 54 KB
16 KB 95ms
28ms Script
application/javascript 2620:1ec:33:1::10
Microsoft Corpora...

General

Check archive.org

Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

Resource Hash

855230e1321917153b6859521e1ccfab0dce7497f88645e73d7e6db9c4bbe3b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Cache-Control: private,max-age=1800
Content-Encoding: gzip
ETag: "808fed96cbddc1:0"
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
X-MSEdge-Ref: Ref A: C43A78A697774DFEB0F65C6D83D85FE9 Ref B: PHL30EDGE0108 Ref C: 2026-06-11T01:17:07Z
Cross-Origin-Resource-Policy: cross-origin
Accept-Ranges: bytes
X-Cache: CONFIG_NOCACHE
Content-Length: 15402
Date: Thu, 11 Jun 2026 01:17:07 GMT
Content-Type: application/javascript
Last-Modified: Thu, 26 Mar 2026 22:06:51 GMT
Vary: Accept-Encoding

GET
H2 200 autoptimize_c3a432b7291619e1123e524e1f602efb.css
redcanary.com/wp-content/cache/autoptimize/css/ 5 MB
242 KB 134ms
130ms Stylesheet
text/css 104.198.136.223
Google LLC

General

Check archive.org

Download Go to

Full URL

https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_c3a432b7291619e1123e524e1f602efb.css

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

7712303d9c52b323a6ccc8db66f6558c0520acf0fba2b70fdd401abffd66c8ff

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/threat-detection-report/threats/bloodhound/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
cache-control: public, max-age=31536000
content-encoding: gzip
etag: W/"6a22f859-532d3f"
access-control-allow-origin: *
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: text/css
last-modified: Fri, 05 Jun 2026 16:24:57 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding

GET
H2 200 5354.js Show response
tracking.g2crowd.com/attribution_tracking/conversions/ 4 KB
3 KB 93ms
33ms Script
text/javascript 2606:4700::6812:1eb0
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://tracking.g2crowd.com/attribution_tracking/conversions/5354.js?p=https://redcanary.com/threat-detection-report/threats/bloodhound/&e=

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1eb0 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d4aa1f65a1a12d9fb4c71fd1538e0a6b871fbbd6558ad36e10134a50d38281c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: text/javascript;charset=UTF-8
content-disposition: inline
vary: Origin, accept-encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
x-dns-prefetch-control: off
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
referrer-policy: no-referrer
x-download-options: noopen
cf-ray: a09cc63c2c9109a2-EWR
access-control-allow-origin: *
x-xss-protection: 0
origin-agent-cluster: ?1
server: cloudflare

GET
DATA 200
OK truncated
/ 67 B
0 Image
image/svg+xml

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6e0408f7fbaf5216b577287b7654be1388d933b9b41dbd95dc733d5b5020f67a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H3 200 default.min.css
cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/ 763 B
890 B 25ms
25ms Stylesheet
text/css 2606:4700::6811:190e
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/default.min.css

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3cc36c64ef86bed21592653daac82fd7e4c364c32c8344336aa13f7dbf52c90

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-cdnjs-via: cfworker/r2
content-encoding: br
cf-cache-status: HIT
age: 456684
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=EhlN5JFFkUFxww2XlB93zmlh9GfH6Wg2FaiftXrcKUFsB5f%2BJlpFhdKU0zQ0Pe9auMyUSI27kKXJouHGR28TGT4OsqQZdE5Lk1oBkXpu%2BDMWWWczf5BgNEsAWZOqhOX1DROVxF1PZqiLRuZFGxL8fWeY"}]}
x-content-type-options: nosniff
expires: Tue, 01 Jun 2027 01:17:07 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-cdnjs-cache: HIT
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: text/css; charset=utf-8
last-modified: Mon, 08 Feb 2021 15:10:43 GMT
vary: Accept-Encoding
priority: u=4,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: a09cc63bcb11de94-EWR
access-control-allow-origin: *
server: cloudflare

GET
DATA 200
OK truncated
/ 64 B
0 Image
image/svg+xml

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 button-right-arrow-white.svg
redcanary.com/wp-content/themes/redcanary/assets/img/ 350 B
607 B 122ms
116ms Image
image/svg+xml 104.198.136.223
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/img/button-right-arrow-white.svg

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

8edbf02936f4bbda931a228bd84f7b668522af07f3dfc33b5caee429e7febb85

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/threat-detection-report/threats/bloodhound/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
cache-control: public, max-age=31536000
content-encoding: gzip
etag: W/"5c76b1e9-15e"
access-control-allow-origin: *
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: image/svg+xml
last-modified: Wed, 27 Feb 2019 15:51:05 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding

GET
H2 200 GT-Haptik-ZS-Regular.woff2
redcanary.com/wp-content/themes/redcanary/assets/fontsZscaler/ 37 KB
37 KB 90ms
89ms Font
font/woff2 104.198.136.223
Google LLC

General

Check archive.org

Download Go to

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/fontsZscaler/GT-Haptik-ZS-Regular.woff2

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

89fde8fd7b0ad034128435bc21892e617683afdfb5cd4fef39c0bd6ff7d53723

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

Origin: https://redcanary.com
sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/threat-detection-report/threats/bloodhound/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
cache-control: public, max-age=31536000
etag: "69fa6ce0-93f4"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 37876
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: font/woff2
last-modified: Tue, 05 May 2026 22:19:12 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 DMMono-Regular.woff2
redcanary.com/wp-content/themes/redcanary/assets/fontsZscaler/ 21 KB
21 KB 91ms
90ms Font
font/woff2 104.198.136.223
Google LLC

General

Check archive.org

Download Go to

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/fontsZscaler/DMMono-Regular.woff2

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

44428afa0827a9d9209a3e7dca200155bb6475e9cac503e45ed4e87786292e32

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

Origin: https://redcanary.com
sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/threat-detection-report/threats/bloodhound/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
cache-control: public, max-age=31536000
etag: "6a07645b-5478"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21624
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: font/woff2
last-modified: Fri, 15 May 2026 18:22:19 GMT
server: nginx
vary: Accept-Encoding

OPTIONS
H3 204 behaviors
consent.app.relyance.ai/api/config/v1/app-b971e13b-6813-58b1-95be-36a12d8eb337/ Frame 0
0 22ms
22ms Preflight 2606:4700:20::681a:34f
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://consent.app.relyance.ai/api/config/v1/app-b971e13b-6813-58b1-95be-36a12d8eb337/behaviors?

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:34f -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-relyance-consent-app-id
Access-Control-Request-Method: GET
Origin: https://redcanary.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Relyance-Consent-App-Id,X-Relyance-Consent-App-Version,X-Amz-Content-Sha256
access-control-allow-methods: GET,HEAD,OPTIONS,PUT,PATCH,POST,DELETE
access-control-allow-origin: *
access-control-max-age: 86400
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: a09cc63c6e4c0d85-EWR
date: Thu, 11 Jun 2026 01:17:07 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
priority: u=1,i
referrer-policy: strict-origin-when-cross-origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=RylrfbDqyj1%2Fw0h2THeOySWVRf7VjUxCD38lY1LfNrRVXUxHVcre%2BTwm8LKt%2B5qLkkCxm9Icy4tn35d0%2Fp7BrN%2FMhYRLSOocNnQVxEBQ4N2coWkXUo2A2zi5ABpTZewTE9csIFYezLvizfvX%2BkKVs5jLMbvI"}]}
server: cloudflare
server-timing: cfExtPri
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 4118eb7b967838562b3ffdc0051e0fb8.cloudfront.net (CloudFront)
x-amz-cf-id: 1SzllxFGRpZF3e9pPugzggBItIdcYyPFTL0CvS8zgYNeZtFm3Fq3lw==
x-amz-cf-pop: JFK50-P10
x-cache: FunctionGeneratedResponse from cloudfront
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1

GET
H3 200 behaviors Show response
consent.app.relyance.ai/api/config/v1/app-b971e13b-6813-58b1-95be-36a12d8eb337/ 3 KB
2 KB 25ms
25ms Fetch
application/json 2606:4700:20::681a:34f
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://consent.app.relyance.ai/api/config/v1/app-b971e13b-6813-58b1-95be-36a12d8eb337/behaviors?

Requested by

Host: consent.app.relyance.ai
URL: https://consent.app.relyance.ai/relyance-agent.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:34f -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f6233fa488c999209dbdabe59d894d04642906ee5c9fb85b6da59537f5a5fa0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type: application/json
X-Relyance-Consent-App-Id: app-b971e13b-6813-58b1-95be-36a12d8eb337
sec-ch-ua-mobile: ?0

Response headers

x-amzn-remapped-content-length: 2942
access-control-expose-headers: *
content-encoding: br
cf-cache-status: DYNAMIC
age: 15
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=XalibiDX0UeAbadW7Qu8mByVVO8UNU6hGHp1gWY66SPOM7%2Fn3lNqZtq1mmQLSEyuvZYsJv2xEhTG2j6bnOwhdkiR6K6CExsfTJPHsImDZwNw0je1RcSsK1cRRXO%2F2k4X6kieuhjWF5s%2FvFdx91jRs%2FimjlOJ"}]}
x-content-type-options: nosniff
x-amzn-requestid: a12fcd5e-70e5-4614-a0a4-c3bc8d2875d3
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: w7xOh6EuQl3eIGjuZ0h98yzoVVCHOJh7eIlPjZ6Nl4xPQNX3KGctEQ==
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: application/json
vary: Origin
priority: u=1,i
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
server-timing: cfExtPri
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: public, max-age=0, s-maxage=60, stale-while-revalidate=2592000
x-amzn-trace-id: Root=1-6a2a0c84-68622df11dece37334b390a9;Parent=14b6ea1cd43fa798;Sampled=0;Lineage=1:e8edfaad:0
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
via: 1.1 4118eb7b967838562b3ffdc0051e0fb8.cloudfront.net (CloudFront)
cf-ray: a09cc63c8e500d85-EWR
access-control-allow-origin: https://redcanary.com
x-xss-protection: 1
x-amz-cf-pop: JFK50-P10
server: cloudflare

GET
H2 206 RED0003-Analysis-Icon.webm
redcanary.com/wp-content/uploads/2025/03/ 208 KB
208 KB 82ms
79ms Media
video/webm 104.198.136.223
Google LLC

General

Check archive.org

Download Go to

Full URL

https://redcanary.com/wp-content/uploads/2025/03/RED0003-Analysis-Icon.webm

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

2246c91e028dd5e9127de56300e675abffb7d07fdbd3f165304cb740368505e3

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/threat-detection-report/threats/bloodhound/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Range: bytes=0-
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
cache-control: public, max-age=31536000
etag: "67c3cd74-33e49"
Content-Range: bytes 0-212552/212553
access-control-allow-origin: *
Content-Length: 212553
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: video/webm
last-modified: Sun, 02 Mar 2025 03:16:04 GMT
server: nginx
vary: Accept-Encoding

GET
H2 206 RED0003-Take-Action-Icon.webm
redcanary.com/wp-content/uploads/2025/03/ 48 KB
48 KB 91ms
89ms Media
video/webm 104.198.136.223
Google LLC

General

Check archive.org

Download Go to

Full URL

https://redcanary.com/wp-content/uploads/2025/03/RED0003-Take-Action-Icon.webm

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

166733f82cf41f33586d49c530dcb26015fc2e5f0fd1903e3dcd9eb555453f44

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/threat-detection-report/threats/bloodhound/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Range: bytes=0-
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
cache-control: public, max-age=31536000
etag: "67ca3d25-bf6e"
Content-Range: bytes 0-49005/49006
access-control-allow-origin: *
Content-Length: 49006
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: video/webm
last-modified: Fri, 07 Mar 2025 00:26:13 GMT
server: nginx
vary: Accept-Encoding

GET
H2 206 RED0003-Detection-Icon.webm
redcanary.com/wp-content/uploads/2025/03/ 88 KB
0 91ms
89ms Media
video/webm 104.198.136.223
Google LLC

General

Check archive.org

Download Go to

Full URL

https://redcanary.com/wp-content/uploads/2025/03/RED0003-Detection-Icon.webm

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/threat-detection-report/threats/bloodhound/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Range: bytes=0-
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
cache-control: public, max-age=31536000
etag: "67c3cdd6-16157"
Content-Range: bytes 0-90454/90455
access-control-allow-origin: *
Content-Length: 90455
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: video/webm
last-modified: Sun, 02 Mar 2025 03:17:42 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 getForm Show response
resource.redcanary.com/index.php/form/ 9 KB
2 KB 30ms
30ms Script
application/javascript 104.17.74.206
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://resource.redcanary.com/index.php/form/getForm?munchkinId=003-YRU-314&form=1035&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&callback=jQuery37105588301942098506_1781140627689&_=1781140627690
Requested by: Host: resource.redcanary.com
URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.74.206 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e43094bb352e0044aa4dfe3130ef75452abe87d6970a3629553da4040bf0773

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-ray: a09cc63c8f67e0c6-EWR
cached: true
content-encoding: gzip
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: application/javascript; charset=utf-8
server: cloudflare

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v23/ 14 KB
14 KB 71ms
31ms Font
font/woff2 2607:f8b0:4004:c23::5e
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v23/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c23::5e Washington, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

06b675a649489d21b7fd33f19b1c6d37e8bd778ded07ecfec26bbc8f11e694f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://redcanary.com
sec-ch-ua-platform: "Linux"
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

age: 36191
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 10 Jun 2027 15:13:57 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 10 Jun 2026 15:13:57 GMT
last-modified: Wed, 10 Sep 2025 16:43:54 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 14724
x-xss-protection: 0
server: sffe

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v23/ 14 KB
14 KB 76ms
36ms Font
font/woff2 2607:f8b0:4004:c23::5e
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v23/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c23::5e Washington, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

46d6a0984aa795b764141232671160e61bdcc49e900de67ca6b35bae25b1ebdd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://redcanary.com
sec-ch-ua-platform: "Linux"
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

age: 1070
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Fri, 11 Jun 2027 00:59:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 11 Jun 2026 00:59:18 GMT
last-modified: Wed, 10 Sep 2025 16:47:45 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 14792
x-xss-protection: 0
server: sffe

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v23/ 15 KB
15 KB 62ms
24ms Font
font/woff2 2607:f8b0:4004:c23::5e
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v23/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c23::5e Washington, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

691491f1fc8badab623e1be56f92cc2d98c462b16617c67e1e288d6b061444bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://redcanary.com
sec-ch-ua-platform: "Linux"
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

age: 36191
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 10 Jun 2027 15:13:57 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 10 Jun 2026 15:13:57 GMT
last-modified: Wed, 10 Sep 2025 16:47:45 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 14868
x-xss-protection: 0
server: sffe

GET
H2 206 RED0003-Testing-Icon.webm
redcanary.com/wp-content/uploads/2025/03/ 61 KB
62 KB 57ms
56ms Media
video/webm 104.198.136.223
Google LLC

General

Check archive.org

Download Go to

Full URL

https://redcanary.com/wp-content/uploads/2025/03/RED0003-Testing-Icon.webm

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

a2246fb1d340b6fac379b467e849a59f902bdfdd7c406d1d4b61015f3eb6c8e7

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/threat-detection-report/threats/bloodhound/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Range: bytes=0-
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
cache-control: public, max-age=31536000
etag: "67c3cdab-f52e"
Content-Range: bytes 0-62765/62766
access-control-allow-origin: *
Content-Length: 62766
date: Thu, 11 Jun 2026 01:17:08 GMT
content-type: video/webm
last-modified: Sun, 02 Mar 2025 03:16:59 GMT
server: nginx
vary: Accept-Encoding

POST
H3 200 event Show response
analytics.ahrefs.com/api/ 11 B
307 B 87ms
55ms XHR
application/json 2606:4700:4404::ac40:9473
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://analytics.ahrefs.com/api/event
Requested by: Host: analytics.ahrefs.com
URL: https://analytics.ahrefs.com/analytics.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:4404::ac40:9473 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d42d95676a5fb59c33cf368c1c8fc71930805c1f4111bb007f02ca6bc05ed42a

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

x-request-id: 87c60052-539b-4448-926e-2fbff2e8ab83
content-encoding: gzip
cf-cache-status: DYNAMIC
cf-ray: a09cc63dcc1c0c23-EWR
traceparent: 00-9556ac04fe78453aadab97ddbe26f6bd-69d66ad4d23944ec-03
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 11 Jun 2026 01:17:08 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
priority: u=1,i

GET
H2 200 red-arrow.svg
redcanary.com/wp-content/uploads/2025/03/ 755 B
739 B 55ms
53ms Image
image/svg+xml 104.198.136.223
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://redcanary.com/wp-content/uploads/2025/03/red-arrow.svg

Requested by

Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_c3a432b7291619e1123e524e1f602efb.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

efa187625053a93995802ce699cb2ff4a8ec9e8d36a63e8c9483bcbc45563011

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_c3a432b7291619e1123e524e1f602efb.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
cache-control: public, max-age=31536000
content-encoding: gzip
etag: W/"67c6ba50-2f3"
access-control-allow-origin: *
date: Thu, 11 Jun 2026 01:17:08 GMT
content-type: image/svg+xml
last-modified: Tue, 04 Mar 2025 08:31:12 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding

GET
H2 200 Mask-group-cropped-1.svg
redcanary.com/wp-content/uploads/2025/03/ 12 KB
5 KB 111ms
110ms Image
image/svg+xml 104.198.136.223
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://redcanary.com/wp-content/uploads/2025/03/Mask-group-cropped-1.svg

Requested by

Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_c3a432b7291619e1123e524e1f602efb.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

51339437afce2e5acd06bfa0f514b8aa3381bf7aeadc1b9a50c3f1164d279cf7

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_c3a432b7291619e1123e524e1f602efb.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
cache-control: public, max-age=31536000
content-encoding: gzip
etag: W/"67c6c05d-31df"
access-control-allow-origin: *
date: Thu, 11 Jun 2026 01:17:08 GMT
content-type: image/svg+xml
last-modified: Tue, 04 Mar 2025 08:57:01 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding

GET
H2 200 tdr-white-arrow.png
redcanary.com/wp-content/uploads/2026/02/ 508 B
846 B 109ms
108ms Image
image/png 104.198.136.223
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://redcanary.com/wp-content/uploads/2026/02/tdr-white-arrow.png

Requested by

Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_c3a432b7291619e1123e524e1f602efb.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

f868f70c106fb972895d9de2bba1e29dc79723e887cb7c75fdb384cf22ffb79b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_c3a432b7291619e1123e524e1f602efb.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
cache-control: public, max-age=31536000
etag: "69957454-1fc"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 508
date: Thu, 11 Jun 2026 01:17:08 GMT
content-type: image/png
last-modified: Wed, 18 Feb 2026 08:12:04 GMT
server: nginx
vary: Accept-Encoding

GET
H2 404 CanarySans-Text-300.woff2
redcanary.com/wp-content/themes/redcanary/assets/build/fonts/ 0
0 95ms
94ms Font
text/html 104.198.136.223
Google LLC

General

Check archive.org

Download Go to

Full URL: https://redcanary.com/wp-content/themes/redcanary/assets/build/fonts/CanarySans-Text-300.woff2
Requested by: Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_c3a432b7291619e1123e524e1f602efb.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash

Request headers

Origin: https://redcanary.com
sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_c3a432b7291619e1123e524e1f602efb.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
date: Thu, 11 Jun 2026 01:17:08 GMT
content-type: text/html
vary: Accept-Encoding
server: nginx

GET
H2 404 CanarySans-Text-400.woff2
redcanary.com/wp-content/themes/redcanary/assets/build/fonts/ 0
0 93ms
92ms Font
text/html 104.198.136.223
Google LLC

General

Check archive.org

Download Go to

Full URL: https://redcanary.com/wp-content/themes/redcanary/assets/build/fonts/CanarySans-Text-400.woff2
Requested by: Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_c3a432b7291619e1123e524e1f602efb.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash

Request headers

Origin: https://redcanary.com
sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_c3a432b7291619e1123e524e1f602efb.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
date: Thu, 11 Jun 2026 01:17:08 GMT
content-type: text/html
vary: Accept-Encoding
server: nginx

GET
H2 200 420x500_1_ForresterWave_RedCanary.jpg
redcanary.com/wp-content/uploads/2025/06/ 28 KB
29 KB 91ms
88ms Image
image/jpeg 104.198.136.223
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://redcanary.com/wp-content/uploads/2025/06/420x500_1_ForresterWave_RedCanary.jpg

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

e11ac71f6335623b82890e0390bc0bd0673e0154a935e7ef46da5fcf6a34bb47

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/threat-detection-report/threats/bloodhound/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
cache-control: public, max-age=31536000
etag: "685d7a9d-7152"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 29010
date: Thu, 11 Jun 2026 01:17:08 GMT
content-type: image/jpeg
last-modified: Thu, 26 Jun 2025 16:51:41 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 product-cta4.jpg
redcanary.com/wp-content/uploads/2024/05/ 105 KB
106 KB 93ms
91ms Image
image/jpeg 104.198.136.223
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://redcanary.com/wp-content/uploads/2024/05/product-cta4.jpg

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

7b386ad2debb9b701ec71427b4ec08dce25b898555d9c5d42e6d70bd2bf39fcc

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/threat-detection-report/threats/bloodhound/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
cache-control: public, max-age=31536000
etag: "6651228c-1a587"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 107911
date: Thu, 11 Jun 2026 01:17:08 GMT
content-type: image/jpeg
last-modified: Fri, 24 May 2024 23:28:12 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 420x1040_TDR26-NavBanner_RedCanary.jpg
redcanary.com/wp-content/uploads/2026/03/ 8 KB
8 KB 83ms
82ms Image
image/jpeg 104.198.136.223
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://redcanary.com/wp-content/uploads/2026/03/420x1040_TDR26-NavBanner_RedCanary.jpg

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

ab6277dadbd2151d76bd5e9627d73f0cf5f1f59a853fab189726185928ebb51d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/threat-detection-report/threats/bloodhound/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
cache-control: public, max-age=31536000
etag: "69ba9c81-1fe5"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 8165
date: Thu, 11 Jun 2026 01:17:08 GMT
content-type: image/jpeg
last-modified: Wed, 18 Mar 2026 12:37:21 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 Red-Canary_x_Zscaler_logo.svg
redcanary.com/wp-content/uploads/2025/08/ 15 KB
6 KB 81ms
80ms Image
image/svg+xml 104.198.136.223
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://redcanary.com/wp-content/uploads/2025/08/Red-Canary_x_Zscaler_logo.svg

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

4eb4779718a74a4209375a47456cde1a92e274d1757e45baa03e04281d8f8856

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/threat-detection-report/threats/bloodhound/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
cache-control: public, max-age=31536000
content-encoding: gzip
etag: W/"688cbb84-3dc4"
access-control-allow-origin: *
date: Thu, 11 Jun 2026 01:17:08 GMT
content-type: image/svg+xml
last-modified: Fri, 01 Aug 2025 13:05:08 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding

GET
H2 200 tdr-red-radial.png
redcanary.com/wp-content/uploads/2026/02/ 13 KB
14 KB 80ms
79ms Image
image/png 104.198.136.223
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://redcanary.com/wp-content/uploads/2026/02/tdr-red-radial.png

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

a9df61f6196adb2d59f88a72241d587b32ebe4cc349c939324109739ab6a8e27

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/threat-detection-report/threats/bloodhound/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
cache-control: public, max-age=31536000
etag: "69957caa-35e0"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 13792
date: Thu, 11 Jun 2026 01:17:08 GMT
content-type: image/png
last-modified: Wed, 18 Feb 2026 08:47:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 forms2.css
resource.redcanary.com/js/forms2/css/ 13 KB
3 KB 22ms
20ms Stylesheet
text/css 104.17.74.206
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://resource.redcanary.com/js/forms2/css/forms2.css
Requested by: Host: resource.redcanary.com
URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.74.206 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd538f2e8b207133b0ae87d87e777db9fc0e65d293f0d7be4a1022811f5397f0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "34c2-653c7cc8305c0-gzip"
age: 6956
cf-ray: a09cc6423a5de0c6-EWR
expires: Thu, 11 Jun 2026 05:17:08 GMT
accept-ranges: bytes
content-length: 2652
date: Thu, 11 Jun 2026 01:17:08 GMT
content-type: text/css
last-modified: Tue, 09 Jun 2026 01:10:55 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 forms2-theme-plain.css
resource.redcanary.com/js/forms2/css/ 828 B
333 B 23ms
22ms Stylesheet
text/css 104.17.74.206
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://resource.redcanary.com/js/forms2/css/forms2-theme-plain.css
Requested by: Host: resource.redcanary.com
URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.74.206 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "33c-653c7cc8305c0-gzip"
age: 546
cf-ray: a09cc6423a5fe0c6-EWR
expires: Thu, 11 Jun 2026 05:17:08 GMT
accept-ranges: bytes
content-length: 246
date: Thu, 11 Jun 2026 01:17:08 GMT
content-type: text/css
last-modified: Tue, 09 Jun 2026 01:10:55 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2

204

cs Show response
a.usbrowserspeed.com/
Redirect Chain

https://tracking.intentsify.io/page-tracking/intentsify-redcanary/https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F
https://a.usbrowserspeed.com/cs?pid=5476ad7fb254ae8ddffd9ee34e77cfbb0c895c04783f2a615f8a1341878ee532&puid=e22feff5-ba40-47b6-bf49-ff9a0923d2c4-intentsify-redcanary-de3b49b0-e9dd-4553-9811-f1bd40d71959

0
148 B

367ms
189ms

Script
text/plain

44.233.73.129
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://a.usbrowserspeed.com/cs?pid=5476ad7fb254ae8ddffd9ee34e77cfbb0c895c04783f2a615f8a1341878ee532&puid=e22feff5-ba40-47b6-bf49-ff9a0923d2c4-intentsify-redcanary-de3b49b0-e9dd-4553-9811-f1bd40d71959
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/
Protocol: H2
Server: 44.233.73.129 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-44-233-73-129.us-west-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

date: Thu, 11 Jun 2026 01:17:09 GMT
server: awselb/2.0

Redirect headers

cache-control: private, no-cache, no-store, must-revalidate
location: https://a.usbrowserspeed.com/cs?pid=5476ad7fb254ae8ddffd9ee34e77cfbb0c895c04783f2a615f8a1341878ee532&puid=e22feff5-ba40-47b6-bf49-ff9a0923d2c4-intentsify-redcanary-de3b49b0-e9dd-4553-9811-f1bd40d71959
pragma: no-cache
expires: -1
content-length: 222
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: text/plain; charset=utf-8
x-powered-by: Express
vary: Accept

GET
H3 200 banner Show response
consent.app.relyance.ai/api/config/v1/app-b971e13b-6813-58b1-95be-36a12d8eb337/ 4 KB
2 KB 27ms
26ms Fetch
application/json 2606:4700:20::681a:34f
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://consent.app.relyance.ai/api/config/v1/app-b971e13b-6813-58b1-95be-36a12d8eb337/banner?regionName=Global

Requested by

Host: consent.app.relyance.ai
URL: https://consent.app.relyance.ai/relyance-agent.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:34f -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

5b377f76e98999426a39cc96af13706daaa0083da740cee2e020fe8e25627966

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type: application/json
X-Relyance-Consent-App-Id: app-b971e13b-6813-58b1-95be-36a12d8eb337
sec-ch-ua-mobile: ?0

Response headers

x-amzn-remapped-content-length: 4026
access-control-expose-headers: *
content-encoding: br
cf-cache-status: DYNAMIC
age: 16
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=XfDWVnNWXMyaoPxWh76Jl2Hz9jpVa7bm4kcrEb0UHXWIYMJ%2Bl0rXXb2pPiuUaC5f2B3WCsuK%2F7Ds%2B%2FxOtYDZLEtwBBSoXgEoPvjctnHcQ7NO%2BJKlo5VVc%2FT7jOsQ2gK0ThXC90cj3F%2FvFX4Ieo%2Bq%2BuMPLhJP"}]}
x-content-type-options: nosniff
x-amzn-requestid: 70808aa5-c92e-4ee2-8a49-cd0df6bafb82
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: GcQib5gXzsSjgjy7WIc8lPUerFVXHZ4bSrRJpnIlj4YVaFWubKtR8Q==
date: Thu, 11 Jun 2026 01:17:08 GMT
content-type: application/json
vary: Origin
priority: u=1,i
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
server-timing: cfExtPri
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: public, max-age=0, s-maxage=60, stale-while-revalidate=2592000
x-amzn-trace-id: Root=1-6a2a0c84-2ba089a207e034991a58cc59;Parent=303adc17df2d7b48;Sampled=0;Lineage=1:e8edfaad:0
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
via: 1.1 4118eb7b967838562b3ffdc0051e0fb8.cloudfront.net (CloudFront)
cf-ray: a09cc642af0c0d85-EWR
access-control-allow-origin: https://redcanary.com
x-xss-protection: 1
x-amz-cf-pop: JFK50-P10
server: cloudflare

GET
H2 404 CanarySans-Text-400.woff
redcanary.com/wp-content/themes/redcanary/assets/build/fonts/ 0
0 53ms
51ms Font
text/html 104.198.136.223
Google LLC

General

Check archive.org

Download Go to

Full URL: https://redcanary.com/wp-content/themes/redcanary/assets/build/fonts/CanarySans-Text-400.woff
Requested by: Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_c3a432b7291619e1123e524e1f602efb.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash

Request headers

Origin: https://redcanary.com
sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_c3a432b7291619e1123e524e1f602efb.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
date: Thu, 11 Jun 2026 01:17:08 GMT
content-type: text/html
vary: Accept-Encoding
server: nginx

GET
H2 404 CanarySans-Text-300.woff
redcanary.com/wp-content/themes/redcanary/assets/build/fonts/ 0
0 174ms
173ms Font
text/html 104.198.136.223
Google LLC

General

Check archive.org

Download Go to

Full URL: https://redcanary.com/wp-content/themes/redcanary/assets/build/fonts/CanarySans-Text-300.woff
Requested by: Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_c3a432b7291619e1123e524e1f602efb.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash

Request headers

Origin: https://redcanary.com
sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_c3a432b7291619e1123e524e1f602efb.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: text/html
vary: Accept-Encoding
server: nginx

GET
H2 200 XDFrame Show response
resource.redcanary.com/index.php/form/ Frame 87D8 68 KB
24 KB 116ms
115ms Document
text/html 104.17.74.206
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://resource.redcanary.com/index.php/form/XDFrame
Requested by: Host: resource.redcanary.com
URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.74.206 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 261f6febbe1b970782d4680512944816a84f037134abb40f14fa5dc25c70131e

Request headers

Referer: https://redcanary.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

cache-control: max-age=3600
cf-cache-status: DYNAMIC
cf-ray: a09cc6440847e0c6-EWR
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 11 Jun 2026 01:17:09 GMT
server: cloudflare
vary: Accept-Encoding

GET
H3 200 ipv
cdn.bizible.com/ 43 B
64 B 209ms
24ms Image
image/gif 2600:1408:c400:5a::addf:a3c6
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://cdn.bizible.com/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=1ed7fede4b70443bedbeb730001ce892&_biz_l=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&_biz_t=1781140628959&_biz_i=BloodHound%20-%20Red%20Canary%20Threat%20Detection%20Report&_biz_n=0&a=redcanary.com&rnd=957471&cdn_o=a&_biz_z=1781140628959

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

QUIC, , AES_256_GCM

Server

2600:1408:c400:5a::addf:a3c6 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; includeSub
cache-control: no-cache, no-store
pragma: no-cache
quic-version: 0x00000001
expires: Thu, 11 Jun 2026 01:17:09 GMT
alt-svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-length: 43
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: Image/GIF

GET
H/1.1 200
OK u
cdn.bizibly.com/ 43 B
569 B 246ms
53ms Image
image/gif 2600:1408:c400:5a::addf:a3d4
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://cdn.bizibly.com/u?_biz_u=1ed7fede4b70443bedbeb730001ce892&_biz_l=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&_biz_t=1781140628963&_biz_i=BloodHound%20-%20Red%20Canary%20Threat%20Detection%20Report&a=redcanary.com&rnd=38043&cdn_o=a&_biz_z=1781140628963

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:c400:5a::addf:a3d4 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Strict-Transport-Security: max-age=31536000; includeSub
Cache-Control: no-cache, no-store
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 11 Jun 2026 01:17:09 GMT
Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Length: 43
Date: Thu, 11 Jun 2026 01:17:09 GMT
Content-Type: Image/GIF

GET
H/1.1 200
OK 343174072.js Show response
bat.bing.com/p/action/ 4 KB
2 KB 25ms
25ms Script
application/javascript 2620:1ec:33:1::10
Microsoft Corpora...

General

Check archive.org

Download Go to

Full URL

https://bat.bing.com/p/action/343174072.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

Resource Hash

32185e846976c2e1c3a39b5d4b4b48dad55ca07fa39aff36c687a8cd03d5e23d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Cache-Control: private,max-age=60
Content-Encoding: br
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
X-MSEdge-Ref: Ref A: 841B6350AAB249DF992372B304936AB2 Ref B: PHL30EDGE0108 Ref C: 2026-06-11T01:17:08Z
Cross-Origin-Resource-Policy: cross-origin
X-Cache: CONFIG_NOCACHE
Date: Thu, 11 Jun 2026 01:17:08 GMT
Content-Type: application/javascript; charset=utf-8
Vary: Accept-Encoding

POST
H2 204 visitor_events
app.qualified.com/w/1/bAEbi2aHVysBKzuy/ 0
0 80ms
68ms Fetch
text/plain 104.18.17.5
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/visitor_events?wu=

Requested by

Host: js.qualified.com
URL: https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.17.5 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type: application/json
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 7200
x-request-id: d7bb4464-3623-4702-9307-62ed82a6a747
access-control-expose-headers
cf-cache-status: DYNAMIC
x-permitted-cross-domain-policies: none
access-control-allow-methods: POST
x-content-type-options: nosniff
x-cache: bypass
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding,Origin
x-runtime: 0.006101
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=63072000; includeSubDomains
cache-control: no-cache
x-envoy-upstream-service-time: 7
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: a09cc644f98c983e-EWR
access-control-allow-origin: *
x-xss-protection: 0
server: cloudflare

POST
H3 200 assign
tracking-api.g2.com/attribution_tracking/conversions/ 0
0 75ms
34ms Ping
text/html 2606:4700::6810:bb29
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://tracking-api.g2.com/attribution_tracking/conversions/assign
Requested by: Host: tracking.g2crowd.com
URL: https://tracking.g2crowd.com/attribution_tracking/conversions/5354.js?p=https://redcanary.com/threat-detection-report/threats/bloodhound/&e=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6810:bb29 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAAR1hVZUyzwf5rXW
sec-ch-ua-mobile: ?0

Response headers

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/165/ 13 KB
6 KB 23ms
23ms Script
application/x-javascript 23.13.173.12
Akamai Technologies

General

Check archive.org

Download Go to

Full URL: https://munchkin.marketo.net/165/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.13.173.12 Sterling, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-13-173-12.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a85866392118d4e9d6474f16c8d3654b039859e2085d6c01785129fd21422eb4

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Cache-Control: max-age=8640000
Content-Encoding: gzip
ETag: "21f3b75d5543e9f89007dede9f557c7f:1771982218.120391"
Connection: keep-alive
Expires: Sat, 19 Sep 2026 01:17:09 GMT
Accept-Ranges: bytes
Content-Length: 5230
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Date: Thu, 11 Jun 2026 01:17:09 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 25 Feb 2026 01:16:58 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

OPTIONS
H3 204 banner
consent.app.relyance.ai/api/config/v1/app-b971e13b-6813-58b1-95be-36a12d8eb337/ Frame 0
0 20ms
19ms Preflight 2606:4700:20::681a:34f
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://consent.app.relyance.ai/api/config/v1/app-b971e13b-6813-58b1-95be-36a12d8eb337/banner?regionName=Global

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:34f -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-relyance-consent-app-id
Access-Control-Request-Method: GET
Origin: https://redcanary.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Relyance-Consent-App-Id,X-Relyance-Consent-App-Version,X-Amz-Content-Sha256
access-control-allow-methods: GET,HEAD,OPTIONS,PUT,PATCH,POST,DELETE
access-control-allow-origin: *
access-control-max-age: 86400
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: a09cc6428f0a0d85-EWR
date: Thu, 11 Jun 2026 01:17:08 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
priority: u=1,i
referrer-policy: strict-origin-when-cross-origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=0i4xbwHHHb7QWTsxfuLX4svu6aITJemRUfwyoHzJJe2ofAlcxpvClx%2Fpjv990JizeSUwJzkhkszKBotopU3mTI2SRVTxkCia8omt2L7wUUgD3e78iupAffPSSzvaa6XUT39XwWFJyBqN9tlvqgNjRdz5N6I6"}]}
server: cloudflare
server-timing: cfExtPri
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 4118eb7b967838562b3ffdc0051e0fb8.cloudfront.net (CloudFront)
x-amz-cf-id: FNZWtauGn3Rsd-FPHNrqEcCoXG1-HBpMVDxCbpJjbUM6SCwFIyHr3Q==
x-amz-cf-pop: JFK50-P10
x-cache: FunctionGeneratedResponse from cloudfront
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/ 43 B
61 B 94ms
34ms Script
text/javascript 2607:f8b0:4004:c09::9b
Google LLC

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/?random=1781140629102&cv=11&fst=1781140629102&bg=ffffff&guid=ON&async=1&en=gtag.config&gtm=45be6691v9103488584za200zd9103488584xec&gcd=13l3l3l3l1l1&dma=0&tag_exp=115938466~115938469~119349418~119456240~119456248&u_w=1600&u_h=1200&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&rcb=11&frm=0&tiba=BloodHound%20-%20Red%20Canary%20Threat%20Detection%20Report&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=1179620159.1781140629&uaa=x86&uab=64&uafvl=Chromium%3B149.0.0.0%7CGoogle%2520Chrome%3B149.0.0.0%7CNot-A.Brand%3B24.0.0.0&uamb=0&uam=&uap=Linux&uapv=&uaw=0&data=event%3Dgtag.config&ept=9&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-759876114

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::9b Washington, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 37
date: Thu, 11 Jun 2026 01:17:09 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

POST
H3 200 /
www.google.com/rmkt/collect/759876114/ 0
0 99ms
55ms Fetch
text/html 2001:4860:482c:7700::
Google LLC

General

Check archive.org

Download Go to

Full URL: https://www.google.com/rmkt/collect/759876114/?random=1781140629102&cv=11&fst=1781140629102&fmt=8&bg=ffffff&guid=ON&async=1&en=gtag.config&gtm=45be6691v9103488584za200zd9103488584xec&gcd=13l3l3l3l1l1&dma=0&tag_exp=115938466~115938469~119349418~119456240~119456248&u_w=1600&u_h=1200&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&rcb=11&frm=0&tiba=BloodHound%20-%20Red%20Canary%20Threat%20Detection%20Report&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=1179620159.1781140629&uaa=x86&uab=64&uafvl=Chromium%3B149.0.0.0%7CGoogle%2520Chrome%3B149.0.0.0%7CNot-A.Brand%3B24.0.0.0&uamb=0&uam=&uap=Linux&uapv=&uaw=0&data=event%3Dgtag.config&ept=68&gcp=5
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-759876114
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:482c:7700:: , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

POST
H3 200 collect
www.google.com/ccm/ 0
0 106ms
64ms Fetch
text/plain 2001:4860:482c:7700::
Google LLC

General

Check archive.org

Download Go to

Full URL: https://www.google.com/ccm/collect?rcb=11&frm=0&auid=1179620159.1781140629&dt=BloodHound%20-%20Red%20Canary%20Threat%20Detection%20Report&en=page_view&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&scrsrc=www.googletagmanager.com&rnd=1202008683.1781140629&navt=n&npa=0&gtm=45be6691v9103488584za200zd9103488584xec&gcd=13l3l3l3l1l1&dma=0&tag_exp=115938466~115938469~119349418~119456240~119456248&apve=1&apvf=f&apvc=1&tids=AW-759876114&tid=AW-759876114&tft=1781140629135&tfd=1914
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-759876114
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:482c:7700:: , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

OPTIONS
H2 200 visitor_events
app.qualified.com/w/1/bAEbi2aHVysBKzuy/ Frame 0
0 101ms
58ms Preflight
text/plain 104.18.17.5
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/visitor_events?wu=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.17.5 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://redcanary.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-expose-headers
access-control-max-age: 7200
cf-cache-status: DYNAMIC
cf-ray: a09cc6447fc9983e-EWR
content-length: 0
content-type: text/plain; charset=utf-8
date: Thu, 11 Jun 2026 01:17:09 GMT
server: cloudflare
vary: Accept-Encoding
x-cache: bypass
x-envoy-upstream-service-time: 0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 538 KB
176 KB 57ms
55ms Script
application/javascript 2607:f8b0:4004:c1d::61
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=GT-MQBVDDDX&cx=c&gtm=4e6691

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::61 Washington, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f46a6c472b8609dc34d2aa4c613d46760f47ab264895bc34f1c44965dfb12fa0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Thu, 11 Jun 2026 01:17:09 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 180210
date: Thu, 11 Jun 2026 01:17:09 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 f3744a5e-342b-429c-9d2c-2c1b7b45310a.js Show response
j.6sc.co/j/ 5 KB
2 KB 150ms
84ms Script
application/javascript 23.221.227.208
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://j.6sc.co/j/f3744a5e-342b-429c-9d2c-2c1b7b45310a.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.221.227.208 Sterling, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-221-227-208.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 805ce4322a9be88ec58266cf40c95f62920aadea2a0d00f6ddeda8f82df66b09

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-amz-meta-content-type: application/json
cache-control: private, max-age=1800
content-encoding: gzip
etag: "e32c5c81f0cda4121d7ac50a6fa46548"
x-amz-version-id: ZP_GnDytUL9NRU7xM5CP6PgfirMXR58J
expires: Thu, 11 Jun 2026 01:47:09 GMT
accept-ranges: bytes
content-length: 1566
x-amz-cf-id: TYnI9ED1VjVVk0Vf5uayG4XoDBfeUICVOZATb0CGM9X5qlstd6P5cw==
date: Thu, 11 Jun 2026 01:17:09 GMT
last-modified: Thu, 15 Feb 2024 19:15:51 GMT
x-amz-cf-pop: IAD12-P5
vary: Accept-Encoding
content-type: application/javascript
x-amz-server-side-encryption: AES256

GET
H2 200 jukebox.js Show response
cdn-app.pathfactory.com/production/jukebox-lite/current/ 68 KB
20 KB 99ms
34ms Script
text/javascript 3.170.3.122
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/jukebox.js
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.170.3.122 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-170-3-122.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5002430970a4f72568f30a8495f8569e055a689b1e998282df1f7d844f6dcca5

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

vary: Accept-Encoding
content-encoding: gzip
etag: W/"df02c3bfb95598f4fa9a2aba9866c49b"
x-amz-version-id: null
age: 21101
via: 1.1 90aae5d559fbbbe252f6d8de0a8d7ca8.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: skJRG18_xcrVLvvjbFYWWbZiglGgylrEPb714mhQ1hosZ4sy2f58aQ==
date: Wed, 10 Jun 2026 19:25:29 GMT
content-type: text/javascript
last-modified: Wed, 29 Apr 2026 01:54:55 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P9
x-amz-server-side-encryption: AES256

POST
H3 204 collect
ad.doubleclick.net/ccm/s/ 0
0 82ms
39ms Fetch
text/html 142.251.179.148
Google LLC

General

Check archive.org

Download Go to

Full URL: https://ad.doubleclick.net/ccm/s/collect?auid=1179620159.1781140629&gtm=45He6691v813277038za200zd813277038xea
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.179.148 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: pd-in-f148.1e100.net
Software: /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 67 KB
19 KB 109ms
38ms Script
application/javascript 2a04:4e42:200::396
Fastly

General

Check archive.org

Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js?pixel_id=t2_5kac730w
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::396 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software: snooserv /
Resource Hash: 91e72350ad025d66f6f6651d636942a8a3d280bf04cf84345065930ed9f93535

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
etag: "2d69a7add0f11aee596447feb41999e7"
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
alt-svc: h3=":443";ma=2592000;persist=1,h3-29=":443";ma=2592000;persist=1,h3-27=":443";ma=2592000;persist=1
date: Thu, 11 Jun 2026 01:17:09 GMT
last-modified: Wed, 10 Jun 2026 18:52:20 GMT
content-type: application/javascript
vary: Accept-Encoding,Origin
cache-control: public, max-age=60
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
via: 1.1 varnish, 1.1 varnish
x-reddit-ct: v=1,dn=FT,p=EWR,cs=HIT
accept-ranges: bytes
content-length: 18874
server: snooserv
x-amz-server-side-encryption: AES256

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 54 KB
19 KB 127ms
38ms Script
application/javascript 2600:1408:a:53::170f:355
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:a:53::170f:355 Chantilly, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

6e187798f38903d98819498dfa7d58da47db4e8fcfd5f76bb27e6abe90bda262

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=86400
content-encoding: gzip
x-cdn-proto: HTTP2
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600
access-control-allow-origin: *
content-length: 19564
date: Thu, 11 Jun 2026 01:17:09 GMT
last-modified: Wed, 10 Jun 2026 07:46:22 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 47 KB
13 KB 109ms
21ms Script
application/javascript 146.75.36.157
Fastly

General

Check archive.org

Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.75.36.157 Ashburn, United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software: /
Resource Hash: fed344940a52670af96d23cd88e8fedf17c4db4adfeb66e284f36df2b14c1219

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

vary: Accept-Encoding,Host
cache-control: no-cache
content-encoding: gzip
etag: "6404fceba8a6f71ceb2342c923ae791f+gzip"
accept-ranges: bytes
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 13407
date: Thu, 11 Jun 2026 01:17:09 GMT
x-tw-cdn: FT
last-modified: Thu, 16 Apr 2026 01:33:25 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-iad-kcgs7200137-IAD
x-amz-server-side-encryption: AES256

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 370 KB
98 KB 66ms
23ms Script
application/x-javascript 2a03:2880:f338:80:face:b00c:0:3
Facebook

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f338:80:face:b00c:0:3 Reston, United States, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

30d29bec2dffa0400fa6dd0623e6c7768a56a511f5cd41051056ed6290e14816

Security Headers

Name	Value
Content-Security-Policy	default-src .facebook.com .fbcdn.net .facebook.net 'self' blob:;script-src .facebook.com .fbcdn.net .facebook.net blob: 'self' 'nonce-RmDLQ85Z';style-src .facebook.com .fbcdn.net .facebook.net 'self' data: blob: 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.fbcdn.net attachment.fbsbx.com .cdninstagram.com blob: 'self' data: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net;font-src .facebook.com .fbcdn.net .facebook.net 'self' data: blob:;img-src .facebook.com .fbcdn.net .facebook.net 'self' data: blob:;media-src .facebook.com .fbcdn.net .facebook.net 'self' data: blob:;child-src .facebook.com .fbcdn.net .facebook.net 'self' data: blob:;frame-src .facebook.com .fbcdn.net .facebook.net 'self' data: blob:;manifest-src .facebook.com .fbcdn.net .facebook.net 'self' data: blob:;object-src .facebook.com .fbcdn.net .facebook.net 'self' data: blob:;worker-src .facebook.com .fbcdn.net .facebook.net 'self' data: blob:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src *.facebook.com *.fbcdn.net *.facebook.net 'self' blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net blob: 'self' 'nonce-RmDLQ85Z';style-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob: 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com *.cdninstagram.com blob: 'self' data: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net;font-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;img-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;media-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;child-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;frame-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;manifest-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;object-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;worker-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=22, rtx=0, c=23, mss=1232, tbw=6199, tp=10, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: 7ZXqzfDnopFe6KNsb5zCV1aoKMuncUjKiUVYfOmGevdGqyz4pqrlVJ0BHmBmvrGBYQDnVc1OvRBsJKmqgoiNOw==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
content-length: 100137
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 46183 Show response
cdn.bttrack.com/universal/ 3 KB
1 KB 132ms
52ms Script
text/javascript 2600:1408:c400:26::17da:d929
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://cdn.bttrack.com/universal/46183
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:26::17da:d929 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: 6432f93541d5ecc55532ce3179c698322f876d188eebb665cd947982a47f4181

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=637
x-servername: NATIVE01
content-length: 1301
date: Thu, 11 Jun 2026 01:17:09 GMT
content-encoding: gzip
content-type: text/javascript
vary: Accept-Encoding

GET
H2 200 641ec645-3300-4d04-8dcf-2d7b5e50a8bd Show response
tag.simpli.fi/sifitag/ 3 KB
2 KB 103ms
23ms Script
application/javascript 35.245.15.98
Google LLC

General

Check archive.org

Download Go to

Full URL: https://tag.simpli.fi/sifitag/641ec645-3300-4d04-8dcf-2d7b5e50a8bd
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.245.15.98 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 98.15.245.35.bc.googleusercontent.com
Software: openresty /
Resource Hash: 31d157475734629d2e46c2a6bede91ac5c0a36d43347edc6e46fb78fa34cf751

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-request-id: GLfh9yrQ0HTqNZXkxZ2h
cache-control: max-age=0, private, must-revalidate, max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-encoding: gzip
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
server: openresty

GET
H/1.1 200
OK up.js Show response
cdn01.basis.net/assets/ 6 KB
3 KB 104ms
25ms Script
text/javascript 2600:1408:c400:5a::addf:a3db
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://cdn01.basis.net/assets/up.js?um=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:5a::addf:a3db Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: AC1.1 /
Resource Hash: 476961502744986081e82755dc5c78bb75c811d61811942ac3830a430674101b

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Access-Control-Max-Age: 86400
Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC
Content-Encoding: gzip
ETag: W/"5720-1778781821894"
Access-Control-Allow-Methods: GET,POST,OPTIONS
Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600
Date: Thu, 11 Jun 2026 01:17:09 GMT
Last-Modified: Thu, 14 May 2026 18:03:41 GMT
Content-Type: text/javascript
Vary: Accept-Encoding
Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session
Connection: keep-alive
Access-Control-Allow-Credentials: true
Akamai-Request-BC: [a=23.202.158.27,b=4030364738,c=g,n=US_VA_ASHBURN,o=20940]
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 2292
Akamai-GRN: 0.1b9eca17.1781140629.f03a7c42
Server: AC1.1

GET
H2 200 j.php Show response
dev.visualwebsiteoptimizer.com/ 110 B
349 B 335ms
209ms XHR
application/javascript 2600:1901:0:7f7d::
Google LLC

General

Check archive.org

Download Go to

Full URL

https://dev.visualwebsiteoptimizer.com/j.php?a=906194&u=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&vn=2.1&x=true

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:0:7f7d:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

Software

giow2 /

Resource Hash

543a2bc3bdebec6bc98871c2f227d07e725618df26154df87e5504b1d73f2c63

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
timing-allow-origin: *
content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://redcanary.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: application/javascript; charset=UTF-8
server: giow2

POST
H3 200 collect
www.google.com/ccm/ 0
0 50ms
42ms Fetch
text/plain 2001:4860:482c:7700::
Google LLC

General

Check archive.org

Download Go to

Full URL: https://www.google.com/ccm/collect?rcb=19&frm=0&ae=g&auid=1179620159.1781140629&dt=BloodHound%20-%20Red%20Canary%20Threat%20Detection%20Report&en=page_view&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&scrsrc=www.googletagmanager.com&rnd=1202008683.1781140629&navt=n&npa=0&ep.ads_data_redaction=0&gtm=45He6691v813277038za200zd813277038xea&gcd=13l3l3l3l1l1&dma=0&tag_exp=115938466~115938469~117776793~119456239~119456247&apve=1&apvf=f&apvc=0&tft=1781140629249&tfd=2028
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:482c:7700:: , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

GET getuid
s.ml-attr.com/ 0
0

GET
H3 200 xdc.js Show response
cdn.bizible.com/ 116 B
238 B 102ms
98ms Script
text/javascript 2600:1408:c400:5a::addf:a3c6
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://cdn.bizible.com/xdc.js?_biz_u=1ed7fede4b70443bedbeb730001ce892&_biz_h=-1906410348&cdn_o=a&jsVer=4.26.06.01&a=redcanary.com

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com

Protocol

Security

QUIC, , AES_256_GCM

Server

2600:1408:c400:5a::addf:a3c6 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

a2d216891690b783996c8296496cf0dc9c101d4f532befd5342921ee86e024ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; includeSub
cache-control: private, must-revalidate, max-age=21600
content-encoding: gzip
etag: 47EA6778
quic-version: 0x00000001
alt-svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600
content-length: 217
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/ 43 B
62 B 36ms
32ms Script
text/javascript 2607:f8b0:4004:c09::9b
Google LLC

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/?random=1781140629257&cv=11&fst=1781140629257&bg=ffffff&guid=ON&async=1&gtm=45be6691v9103488584z8813277038za200zd9103488584xea&gcd=13l3l3l3l1l1&dma=0&tag_exp=115938466~115938469~119349418~119456240~119456248&u_w=1600&u_h=1200&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&rcb=11&frm=0&tiba=BloodHound%20-%20Red%20Canary%20Threat%20Detection%20Report&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=1179620159.1781140629&uaa=x86&uab=64&uafvl=Chromium%3B149.0.0.0%7CGoogle%2520Chrome%3B149.0.0.0%7CNot-A.Brand%3B24.0.0.0&uamb=0&uam=&uap=Linux&uapv=&uaw=0&_tu=CA&ept=9&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-759876114

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::9b Washington, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 37
date: Thu, 11 Jun 2026 01:17:09 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

POST
H3 200 /
www.google.com/rmkt/collect/759876114/ 0
0 40ms
38ms Fetch
text/html 2001:4860:482c:7700::
Google LLC

General

Check archive.org

Download Go to

Full URL: https://www.google.com/rmkt/collect/759876114/?random=1781140629257&cv=11&fst=1781140629257&fmt=8&bg=ffffff&guid=ON&async=1&gtm=45be6691v9103488584z8813277038za200zd9103488584xea&gcd=13l3l3l3l1l1&dma=0&tag_exp=115938466~115938469~119349418~119456240~119456248&u_w=1600&u_h=1200&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&rcb=11&frm=0&tiba=BloodHound%20-%20Red%20Canary%20Threat%20Detection%20Report&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=1179620159.1781140629&uaa=x86&uab=64&uafvl=Chromium%3B149.0.0.0%7CGoogle%2520Chrome%3B149.0.0.0%7CNot-A.Brand%3B24.0.0.0&uamb=0&uam=&uap=Linux&uapv=&uaw=0&_tu=CA&ept=68&gcp=5
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-759876114
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:482c:7700:: , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

POST
H3 200 collect
www.google.com/ccm/ 0
0 46ms
44ms Fetch
text/plain 2001:4860:482c:7700::
Google LLC

General

Check archive.org

Download Go to

Full URL: https://www.google.com/ccm/collect?rcb=11&frm=0&ae=g&auid=1179620159.1781140629&dt=BloodHound%20-%20Red%20Canary%20Threat%20Detection%20Report&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&scrsrc=www.googletagmanager.com&rnd=1202008683.1781140629&navt=n&npa=0&_tu=CA&gtm=45be6691v9103488584z8813277038za200zd9103488584xea&gcd=13l3l3l3l1l1&dma=0&tag_exp=115938466~115938469~119349418~119456240~119456248&apve=1&apvf=f&apvc=0&tids=AW-759876114&tid=AW-759876114&tft=1781140629263&tfd=2042
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-759876114
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:482c:7700:: , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

GET
H2 200 forms2.min.js Show response
resource.redcanary.com/js/forms2/js/ Frame 87D8 201 KB
0 4ms
4ms Script
text/javascript 104.17.74.206
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js
Requested by: Host: resource.redcanary.com
URL: https://resource.redcanary.com/index.php/form/XDFrame
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.74.206 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 17e2808b4349a08c4f770cacf481d4803adb21fb958f050579cfe716204951aa

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://resource.redcanary.com/index.php/form/XDFrame
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "325d2-653c7cc924800-gzip"
age: 6956
cf-ray: a09cc63a2803e0c6-EWR
expires: Thu, 11 Jun 2026 05:17:07 GMT
accept-ranges: bytes
date: Thu, 11 Jun 2026 01:17:07 GMT
content-type: text/javascript
last-modified: Tue, 09 Jun 2026 01:10:56 GMT
server: cloudflare
vary: Accept-Encoding

GET
H3 200 locale Show response
consent.app.relyance.ai/api/config/v1/app-b971e13b-6813-58b1-95be-36a12d8eb337/ 2 KB
2 KB 29ms
24ms Fetch
application/json 2606:4700:20::681a:34f
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://consent.app.relyance.ai/api/config/v1/app-b971e13b-6813-58b1-95be-36a12d8eb337/locale?regionName=Global&localeName=en

Requested by

Host: consent.app.relyance.ai
URL: https://consent.app.relyance.ai/relyance-agent.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:34f -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e689dfb73e1049f703f0c28fbcb91b038caeab063d878933d05b0fb30dfb6b9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type: application/json
X-Relyance-Consent-App-Id: app-b971e13b-6813-58b1-95be-36a12d8eb337
sec-ch-ua-mobile: ?0

Response headers

x-amzn-remapped-content-length: 2063
access-control-expose-headers: *
content-encoding: br
cf-cache-status: DYNAMIC
age: 17
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=jJsKk9xfBWUmj3ok43H8goOLI04yXK6Mv32C41qGdtVv56D9NDy0kM4mPaXOVnLJxvklpEI4twwHqbMISiCmknJUHEvtMG6bdZXkmxAHA4e2uRKh5SzehNei1v5W0IwTcVNrJQUqdhaAgU6DrsjFfygX2%2BRi"}]}
x-content-type-options: nosniff
x-amzn-requestid: 8f14c097-11f2-4b0d-ae42-75c2036ccd48
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: fmcnyHZ7Sv8Z8k5O-owNldnaG4ngHlt6YiNsOld_OxFJaCzE8qtciw==
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: application/json
vary: Origin
priority: u=1,i
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
server-timing: cfExtPri
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: public, max-age=0, s-maxage=60, stale-while-revalidate=2592000
x-amzn-trace-id: Root=1-6a2a0c84-24139417037692d3540fdcc8;Parent=2e692125e36aac28;Sampled=0;Lineage=1:e8edfaad:0
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
via: 1.1 4118eb7b967838562b3ffdc0051e0fb8.cloudfront.net (CloudFront)
cf-ray: a09cc6455f2d0d85-EWR
access-control-allow-origin: https://redcanary.com
x-xss-protection: 1
x-amz-cf-pop: JFK50-P10
server: cloudflare

OPTIONS
H3 204 locale
consent.app.relyance.ai/api/config/v1/app-b971e13b-6813-58b1-95be-36a12d8eb337/ Frame 0
0 24ms
23ms Preflight 2606:4700:20::681a:34f
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://consent.app.relyance.ai/api/config/v1/app-b971e13b-6813-58b1-95be-36a12d8eb337/locale?regionName=Global&localeName=en

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:34f -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-relyance-consent-app-id
Access-Control-Request-Method: GET
Origin: https://redcanary.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Relyance-Consent-App-Id,X-Relyance-Consent-App-Version,X-Amz-Content-Sha256
access-control-allow-methods: GET,HEAD,OPTIONS,PUT,PATCH,POST,DELETE
access-control-allow-origin: *
access-control-max-age: 86400
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: a09cc6451f290d85-EWR
date: Thu, 11 Jun 2026 01:17:09 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
priority: u=1,i
referrer-policy: strict-origin-when-cross-origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=blOGEx5qmF2LTpOStInMhG90ReESJOwcWyJm1MECp549S1hx17avme3Bra2aDLou1YwBUI7dk0OS3ex6yyOnRB4SYPZ3Zp2Z4ssrDWpQo6OMtoK4P0qWSMC067vn0II5KGMLSXrYiK8PI9An8TSzXUj4jqZo"}]}
server: cloudflare
server-timing: cfExtPri
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 4118eb7b967838562b3ffdc0051e0fb8.cloudfront.net (CloudFront)
x-amz-cf-id: -LYBj7kNoY3uKsVlAz4cZ9GdE3SZh0Zs-sYnj3lV5Ou1N2_57mHfYQ==
x-amz-cf-pop: JFK50-P10
x-cache: FunctionGeneratedResponse from cloudfront
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1

GET
H2 200 nr-spa-1.316.0.min.js Show response
js-agent.newrelic.com/ Frame 87D8 102 KB
30 KB 462ms
210ms Script
application/javascript 2602:816:5001::39
Fastly

General

Check archive.org

Download Go to

Full URL

https://js-agent.newrelic.com/nr-spa-1.316.0.min.js

Requested by

Host: resource.redcanary.com
URL: https://resource.redcanary.com/index.php/form/XDFrame

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2602:816:5001::39 , United States, ASN54113 (FASTLY - Fastly, Inc., US),

Reverse DNS

Software

Resource Hash

0df2e20fff12147eaae1c3cee1a32d80f62b12fb993a02ae0de5aa995c4b8fb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Origin: https://resource.redcanary.com
sec-ch-ua-platform: "Linux"
Referer: https://resource.redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=300
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
content-encoding: br
etag: "760bd1e1e7734fdcb206ae51643ea5e7"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
x-cache: HIT
content-length: 30829
date: Thu, 11 Jun 2026 01:17:09 GMT
last-modified: Wed, 03 Jun 2026 16:44:28 GMT
content-type: application/javascript
x-served-by: cache-fra-etou8220140-FRA
x-cache-hits: 13805
vary: Accept-Encoding

GET
H3 200 tracking-technologies-localised Show response
consent.app.relyance.ai/api/config/v1/app-b971e13b-6813-58b1-95be-36a12d8eb337/ 188 KB
17 KB 34ms
32ms Fetch
application/json 2606:4700:20::681a:34f
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://consent.app.relyance.ai/api/config/v1/app-b971e13b-6813-58b1-95be-36a12d8eb337/tracking-technologies-localised?regionName=Global&localeName=en

Requested by

Host: consent.app.relyance.ai
URL: https://consent.app.relyance.ai/relyance-agent.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:34f -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

9429b97bbbb888d78537493ad43f8f0351b11dbc7cdb535db2d930dd88b05ecd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type: application/json
X-Relyance-Consent-App-Id: app-b971e13b-6813-58b1-95be-36a12d8eb337
sec-ch-ua-mobile: ?0

Response headers

x-amzn-remapped-content-length: 192734
access-control-expose-headers: *
content-encoding: br
cf-cache-status: DYNAMIC
age: 16
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=wmRuUZGsQw0HjK1cw7qRbw%2BjcoSYu3pkEaQlkMcyIQ8NV1v99PAUQcvF0NjcrYQSrKmflhbFTXAYvZDSNNhuOvoX1ynGdMeuYecxYLDXIQSsiO6G7FhgoUzfEf%2F8r6HeCf3juG97fH0RvL80KrLHKZjzBoWV"}]}
x-content-type-options: nosniff
x-amzn-requestid: 336d1afc-ca9e-4fe6-bcc5-add9ee4fc08b
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: -EBVE8aon_cb1VAMG5iRNWSK0EEqUeDJoiYZqQFKOUJMot3n1d5Euw==
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: application/json
vary: Origin
priority: u=1,i
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
server-timing: cfExtPri
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: public, max-age=0, s-maxage=60, stale-while-revalidate=2592000
x-amzn-trace-id: Root=1-6a2a0c84-35bb22e81ae65e3c21c4a94a;Parent=509336173c45c9a4;Sampled=0;Lineage=1:e8edfaad:0
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
via: 1.1 4118eb7b967838562b3ffdc0051e0fb8.cloudfront.net (CloudFront)
cf-ray: a09cc645df370d85-EWR
access-control-allow-origin: https://redcanary.com
x-xss-protection: 1
x-amz-cf-pop: JFK50-P10
server: cloudflare

GET
H3 200 request-url-by-purpose Show response
consent.app.relyance.ai/api/config/v1/app-b971e13b-6813-58b1-95be-36a12d8eb337/ 54 KB
9 KB 34ms
33ms Fetch
application/json 2606:4700:20::681a:34f
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://consent.app.relyance.ai/api/config/v1/app-b971e13b-6813-58b1-95be-36a12d8eb337/request-url-by-purpose?

Requested by

Host: consent.app.relyance.ai
URL: https://consent.app.relyance.ai/relyance-agent.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:34f -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

940a30cc5a6f62d07d11907a2046a98159278ba570f33f1662d2d2d07488f9c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type: application/json
X-Relyance-Consent-App-Id: app-b971e13b-6813-58b1-95be-36a12d8eb337
sec-ch-ua-mobile: ?0

Response headers

x-amzn-remapped-content-length: 55403
access-control-expose-headers: *
content-encoding: br
cf-cache-status: DYNAMIC
age: 17
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=KY410R2KXrTh8A8bOmV%2FguKGV%2BtZUXnMYtXyymS1MuRyCSSU0oQfBbfatiuuTmNH163ip698r6FXRYFCK4GmuZHVy0nt62zoQ6o7uPTgLodxTxlFY%2FO8uK3jNY%2FUEmNnN9VZauYsRb90gt5UwfXmg%2FZ2Rair"}]}
x-content-type-options: nosniff
x-amzn-requestid: cede6a5b-2873-4531-bb98-ae5036eff6ec
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: QnOKQwAWFx-JtE0CytvK6pMXNpS8nFQ1PY84AwUabF3n_btBFzEERQ==
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: application/json
vary: Origin
priority: u=1,i
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
server-timing: cfExtPri
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: public, max-age=0, s-maxage=60, stale-while-revalidate=2592000
x-amzn-trace-id: Root=1-6a2a0c84-631528f7256c481661a7d965;Parent=216d0ed627ae95bf;Sampled=0;Lineage=1:e8edfaad:0
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
via: 1.1 4118eb7b967838562b3ffdc0051e0fb8.cloudfront.net (CloudFront)
cf-ray: a09cc645df390d85-EWR
access-control-allow-origin: https://redcanary.com
x-xss-protection: 1
x-amz-cf-pop: JFK50-P10
server: cloudflare

GET
H3 200 processing-activities Show response
consent.app.relyance.ai/api/config/v1/app-b971e13b-6813-58b1-95be-36a12d8eb337/ 7 KB
3 KB 29ms
29ms Fetch
application/json 2606:4700:20::681a:34f
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://consent.app.relyance.ai/api/config/v1/app-b971e13b-6813-58b1-95be-36a12d8eb337/processing-activities?localeName=en

Requested by

Host: consent.app.relyance.ai
URL: https://consent.app.relyance.ai/relyance-agent.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:34f -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

433f268f71df56717ec557789644719f4d7cf1dc190d21b85a3c0b39d7ce3d1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type: application/json
X-Relyance-Consent-App-Id: app-b971e13b-6813-58b1-95be-36a12d8eb337
sec-ch-ua-mobile: ?0

Response headers

x-amzn-remapped-content-length: 7150
access-control-expose-headers: *
content-encoding: br
cf-cache-status: DYNAMIC
age: 17
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=OVPw8RjT9S51ZIo4PTPFnbFWhUN6MOI6Z4DdHXQKvelqR4a0xAjXyzrhkPBh7LHUd3y3ZtCVKr3G8RTB8aUb7Og2DShdGLNzCzd2pGWgHK5JFDMnupueQv%2FUSNL5upu73hXuxje336OBMtYoIPag%2FGeLlCiI"}]}
x-content-type-options: nosniff
x-amzn-requestid: 3eb1724f-f4ce-4c31-a50c-e0da2cea240a
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: Sc9g60n6bxYBLRl1axHjdqsxWDikWUyDQmZpiTFJ7DcoyIMgzujTog==
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: application/json
vary: Origin
priority: u=1,i
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
server-timing: cfExtPri
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: public, max-age=0, s-maxage=60, stale-while-revalidate=2592000
x-amzn-trace-id: Root=1-6a2a0c84-17afab356ae8c8e122ddf132;Parent=6337a94d8f011f3b;Sampled=0;Lineage=1:e8edfaad:0
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
via: 1.1 4118eb7b967838562b3ffdc0051e0fb8.cloudfront.net (CloudFront)
cf-ray: a09cc645df380d85-EWR
access-control-allow-origin: https://redcanary.com
x-xss-protection: 1
x-amz-cf-pop: JFK50-P10
server: cloudflare

OPTIONS
H3 204 tracking-technologies-localised
consent.app.relyance.ai/api/config/v1/app-b971e13b-6813-58b1-95be-36a12d8eb337/ Frame 0
0 20ms
19ms Preflight 2606:4700:20::681a:34f
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://consent.app.relyance.ai/api/config/v1/app-b971e13b-6813-58b1-95be-36a12d8eb337/tracking-technologies-localised?regionName=Global&localeName=en

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:34f -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-relyance-consent-app-id
Access-Control-Request-Method: GET
Origin: https://redcanary.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Relyance-Consent-App-Id,X-Relyance-Consent-App-Version,X-Amz-Content-Sha256
access-control-allow-methods: GET,HEAD,OPTIONS,PUT,PATCH,POST,DELETE
access-control-allow-origin: *
access-control-max-age: 86400
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: a09cc645bf310d85-EWR
date: Thu, 11 Jun 2026 01:17:09 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
priority: u=1,i
referrer-policy: strict-origin-when-cross-origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=wfKPiIRezJ0nn3B994dqqGJNjVph8ndhCEnLKrlzmzBlJxy9q65xGF%2FXnG4MEpLABth1jF8JXiye3Lgb%2BeFJyAqFDCT2UJxh3iFKd%2FA9ULMDgZOksBmAnYd1nhOi9%2Fa9reJ%2Fu2hsdCfK%2B%2F5DhPJJYz4VMZRi"}]}
server: cloudflare
server-timing: cfExtPri
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 4118eb7b967838562b3ffdc0051e0fb8.cloudfront.net (CloudFront)
x-amz-cf-id: TtlL8CE_gOaGD2OiTqbxU9_ClAYFDUXpRd-uElv91IihdIcaZjj55Q==
x-amz-cf-pop: JFK50-P10
x-cache: FunctionGeneratedResponse from cloudfront
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1

OPTIONS
H3 204 request-url-by-purpose
consent.app.relyance.ai/api/config/v1/app-b971e13b-6813-58b1-95be-36a12d8eb337/ Frame 0
0 21ms
21ms Preflight 2606:4700:20::681a:34f
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://consent.app.relyance.ai/api/config/v1/app-b971e13b-6813-58b1-95be-36a12d8eb337/request-url-by-purpose?

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:34f -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-relyance-consent-app-id
Access-Control-Request-Method: GET
Origin: https://redcanary.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Relyance-Consent-App-Id,X-Relyance-Consent-App-Version,X-Amz-Content-Sha256
access-control-allow-methods: GET,HEAD,OPTIONS,PUT,PATCH,POST,DELETE
access-control-allow-origin: *
access-control-max-age: 86400
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: a09cc645bf320d85-EWR
date: Thu, 11 Jun 2026 01:17:09 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
priority: u=1,i
referrer-policy: strict-origin-when-cross-origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=%2Fg15gin4lijSibZXv04so%2FDSGmPCR5bT3TwNe8g41086yj7Ag4UQzVa1NnX3kdD9LrnjOuP68cUpKwSxmm0WAfMDukjS3vf6YxnBeusEm9t%2Bg%2BoLhYjNqX9PLASZrBaveSGNrcKAs8tKlJ%2BPC%2FLJMI2zphsz"}]}
server: cloudflare
server-timing: cfExtPri
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 4118eb7b967838562b3ffdc0051e0fb8.cloudfront.net (CloudFront)
x-amz-cf-id: 4MQny82NX2hs9Lsjf8aa7ScI7tO5T8vwC0zr5oPFZ6MJjccrcTXvpw==
x-amz-cf-pop: JFK50-P10
x-cache: FunctionGeneratedResponse from cloudfront
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1

OPTIONS
H3 204 processing-activities
consent.app.relyance.ai/api/config/v1/app-b971e13b-6813-58b1-95be-36a12d8eb337/ Frame 0
0 20ms
20ms Preflight 2606:4700:20::681a:34f
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://consent.app.relyance.ai/api/config/v1/app-b971e13b-6813-58b1-95be-36a12d8eb337/processing-activities?localeName=en

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:34f -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-relyance-consent-app-id
Access-Control-Request-Method: GET
Origin: https://redcanary.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Relyance-Consent-App-Id,X-Relyance-Consent-App-Version,X-Amz-Content-Sha256
access-control-allow-methods: GET,HEAD,OPTIONS,PUT,PATCH,POST,DELETE
access-control-allow-origin: *
access-control-max-age: 86400
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: a09cc645bf330d85-EWR
date: Thu, 11 Jun 2026 01:17:09 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
priority: u=1,i
referrer-policy: strict-origin-when-cross-origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=IjcOPJ3ZBbn6mJbJ4pgqoIT4tgTNwIFg6BeQ9LgcAPbiar%2BNWZ9L4DFG7eDTsql7QQVz0bIemBMjpVIht6lOxTf2pJR0JeiYANRLqdkjGwP7feOqo7sNh2%2BEV87OvEehLueoi3HfBBJclIZ%2FA5mxecIMrw6T"}]}
server: cloudflare
server-timing: cfExtPri
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 4118eb7b967838562b3ffdc0051e0fb8.cloudfront.net (CloudFront)
x-amz-cf-id: TY_llQ2PSsQd6TAFnVWSDu59Pn3wycuVBqOHU15aEDot189d0WmK2Q==
x-amz-cf-pop: JFK50-P10
x-cache: FunctionGeneratedResponse from cloudfront
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1

GET
H/1.1 200
OK 343174072 Show response
www.clarity.ms/tag/uet/ 904 B
1 KB 124ms
56ms Script
application/x-javascript 4.153.187.221
Microsoft Corpora...

General

Check archive.org

Download Go to

Full URL: https://www.clarity.ms/tag/uet/343174072?insights=1
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/p/action/343174072.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 4.153.187.221 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: nginx /
Resource Hash: 5578be2549624d90439f96ec64d34bdb5d049124dea892a176ed6fd31767672d

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Cache-Control: no-cache, no-store
Connection: keep-alive
Request-Context: appId=cid-v1:a894a21c-0197-44e5-b203-3cbc01252c82
Expires: -1
Content-Length: 904
Date: Thu, 11 Jun 2026 01:17:09 GMT
Content-Type: application/x-javascript
Server: nginx

GET
H/1.1 204
No Content 0
bat.bing.com/action/ 0
845 B 25ms
25ms Image
text/plain 2620:1ec:33:1::10
Microsoft Corpora...

General

Check archive.org

Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=343174072&Ver=2&mid=5809cfcf-97a1-42a6-b296-de41830efa4d&bo=1&sid=449a64a0653311f19d37612a68f5dc31&vid=449a9340653311f190788352bf10d27e&vids=1&msclkid=N&pi=918639831&lg=en-US&sw=1600&sh=1200&sc=24&tl=BloodHound%20-%20Red%20Canary%20Threat%20Detection%20Report&p=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&r=&lt=1028&evt=pageLoad&sv=2&cdb=AQAQ&rn=577174

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Cache-Control: no-cache, must-revalidate
Pragma: no-cache
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
X-MSEdge-Ref: Ref A: 4396F3F9E8A24963BF731B2184BC3FE5 Ref B: PHL30EDGE0108 Ref C: 2026-06-11T01:17:09Z
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Access-Control-Allow-Origin: *
X-Cache: CONFIG_NOCACHE
Date: Thu, 11 Jun 2026 01:17:08 GMT

POST
H/1.1 200
OK visitWebPage
003-yru-314.mktoresp.com/webevents/ 2 B
318 B 342ms
88ms Ping
text/plain 192.28.164.179
Adobe Inc.

General

Check archive.org

Download Go to

Full URL: https://003-yru-314.mktoresp.com/webevents/visitWebPage?_mchNc=1781140629395&_mchCn=&_mchId=003-YRU-314&_mchTk=_mch-redcanary.com-9397e1a4a005e73f88c375845d2f2cc6&_mchHo=redcanary.com&_mchPo=&_mchRu=%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&_mchPc=https%3A&_mchVr=165&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/165/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.164.179 , United States, ASN15224 (OMNITURE - Adobe Inc., US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Transfer-Encoding: chunked
X-Request-Id: 94c728a8-05af-44ca-91ac-201eb7107794
Content-Encoding: gzip
Connection: keep-alive
Access-Control-Allow-Origin: *
Date: Thu, 11 Jun 2026 01:17:09 GMT
Content-Type: text/plain; charset=UTF-8
Server: nginx/1.20.1

GET
H2 200 307.js Show response
cdn-app.pathfactory.com/production/jukebox-lite/current/ 8 KB
4 KB 20ms
19ms Script
text/javascript 3.170.3.122
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/307.js
Requested by: Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/jukebox.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.170.3.122 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-170-3-122.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 01b266c8f4da9c337556438cc023dbbcb18085c96c1b0515cbcc904a2dcdc4ed

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

vary: Accept-Encoding
content-encoding: gzip
etag: W/"145045e4b68f430c16ce5e77600fd36f"
x-amz-version-id: null
age: 54879
via: 1.1 90aae5d559fbbbe252f6d8de0a8d7ca8.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: ZepMhSnI-e97ZZ8HVa8YHbzvV5iiK7R9Pljbo_ISzLzjnd-s85S2qQ==
date: Wed, 10 Jun 2026 10:02:31 GMT
content-type: text/javascript
last-modified: Wed, 29 Apr 2026 01:55:54 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P9
x-amz-server-side-encryption: AES256

GET
H2 200 messenger Show response
app.qualified.com/w/1/bAEbi2aHVysBKzuy/ Frame F8DF 9 KB
3 KB 113ms
80ms Document
text/html 104.18.16.5
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=209c2900-8257-4237-b2ab-90860d6fde7b

Requested by

Host: js.qualified.com
URL: https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.16.5 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

a6cb54052b059e6487abafcc0d4e33138639fcce2aa511f26cd23634517f1276

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://redcanary.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

cache-control: max-age=0, private, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: a09cc64678c7f4bf-EWR
content-encoding: gzip
content-security-policy
content-type: text/html; charset=utf-8
date: Thu, 11 Jun 2026 01:17:09 GMT
link: <https://assets.qualified.com/packs/css/widget/sandboxed/messenger-9fcbda82.css>; rel=preload; as=style; nopush
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC" cfEdge;dur=6,cfOrigin;dur=57
strict-transport-security: max-age=63072000; includeSubDomains
vary: Accept-Encoding
x-cache: miss
x-content-type-options: nosniff
x-download-options: noopen
x-envoy-upstream-service-time: 47
x-permitted-cross-domain-policies: none
x-request-id: 29e4eaf5-cf3b-4287-b134-31d8d3f9eb65
x-runtime: 0.045503
x-xss-protection: 0

POST
H2 204 visitor_events
app.qualified.com/w/1/bAEbi2aHVysBKzuy/ 0
0 49ms
47ms Fetch
text/plain 104.18.17.5
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/visitor_events?wu=34ab5aba-6a01-4ec2-a1f3-407f025ec036&uuid=209c2900-8257-4237-b2ab-90860d6fde7b

Requested by

Host: js.qualified.com
URL: https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.17.5 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type: application/json
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 7200
x-request-id: d3462a3a-c071-451e-a691-684cf12998d5
access-control-expose-headers
cf-cache-status: DYNAMIC
x-permitted-cross-domain-policies: none
access-control-allow-methods: POST
x-content-type-options: nosniff
x-cache: bypass
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding,Origin
x-runtime: 0.012960
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=63072000; includeSubDomains
cache-control: no-cache
x-envoy-upstream-service-time: 14
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: a09cc6467e9a983e-EWR
access-control-allow-origin: *
x-xss-protection: 0
server: cloudflare

OPTIONS
H2 200 visitor_events
app.qualified.com/w/1/bAEbi2aHVysBKzuy/ Frame 0
0 29ms
29ms Preflight
text/plain 104.18.17.5
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/visitor_events?wu=34ab5aba-6a01-4ec2-a1f3-407f025ec036&uuid=209c2900-8257-4237-b2ab-90860d6fde7b
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.17.5 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://redcanary.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-expose-headers
access-control-max-age: 7200
cf-cache-status: DYNAMIC
cf-ray: a09cc6464dfb983e-EWR
content-length: 0
content-type: text/plain; charset=utf-8
date: Thu, 11 Jun 2026 01:17:09 GMT
server: cloudflare
vary: Accept-Encoding
x-cache: bypass
x-envoy-upstream-service-time: 1

GET
H2 200 analytics-bc611ace.js Show response
js.qualified.com/packs/js/ 2 KB
1 KB 19ms
18ms Script
application/javascript 104.18.17.5
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://js.qualified.com/packs/js/analytics-bc611ace.js
Requested by: Host: js.qualified.com
URL: https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.17.5 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5379cc07e1c683ca5b3edd90da73b2363489c2db855f42bd63043935106c6b17

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-amz-id-2: 625e9utFVlAsT84RB+OxuQobWvawl5n/b/q28/bSHADXmCFYFPq5oxWEy55JHb74rWqKzQ+XYRE=
cache-control: public, max-age=31536000, immutable
content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: null
age: 124660
etag: W/"b04a4399be4f9cfc808702280bacb53e"
x-amz-request-id: 6ZT9EG93290RRVXJ
expires: Wed, 09 Jun 2027 14:22:25 GMT
cf-ray: a09cc6464978f569-EWR
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: application/javascript
last-modified: Wed, 06 May 2026 20:17:38 GMT
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 multimodal_v2-3ec39f4f.js Show response
js.qualified.com/packs/js/ 360 KB
103 KB 36ms
36ms Script
application/javascript 104.18.17.5
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://js.qualified.com/packs/js/multimodal_v2-3ec39f4f.js
Requested by: Host: js.qualified.com
URL: https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.17.5 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9b9e1688a0124d7252439be6cd3be347cfac5328e74d12b9f8f392421f6d2da8

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-amz-id-2: a9y5Gq8CME2qQbvALA5siCv8xZpMWj3kcmL8XdgYgUaORwSU1PyUCg+IOmq49dy++DEc5dTokkoPWBEbP6JkTzPzJ84tHORL
cache-control: public, max-age=31536000, immutable
content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: null
age: 18258
etag: W/"bf8f2127c1365b7d23b8938db80340b0"
x-amz-request-id: VBQKJ8DA92EMA0G5
expires: Thu, 10 Jun 2027 19:59:44 GMT
cf-ray: a09cc6464983f569-EWR
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: application/javascript
last-modified: Wed, 10 Jun 2026 20:00:10 GMT
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 206 orb-animation.mp4
assets.qualified.com/static-media/piperx-orb/ 708 KB
709 KB 22ms
20ms Media
video/mp4 104.18.17.5
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://assets.qualified.com/static-media/piperx-orb/orb-animation.mp4
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.17.5 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9ee3f1033cd0661c6cf86bedd7da2bd2cd3a967410b50466952ad8c2431a4e39

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Range: bytes=0-
sec-ch-ua-mobile: ?0

Response headers

x-amz-id-2: BkbEeQdixcHp9IErGGekJCQELOXVEPD8jb1vEcD0ei2vha8pEHl44HtK++1zJI8kvNWcWE+hPag=
cf-cache-status: HIT
x-amz-version-id: null
etag: "aaf85177a95bedb03361055cc960c932"
age: 2783
Content-Range: bytes 0-724788/724789
x-amz-request-id: NCC461MHZKZPRSP3
cf-ray: a09cc64669dff569-EWR
Content-Length: 724789
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: video/mp4
last-modified: Tue, 17 Feb 2026 18:44:36 GMT
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 1042590016249604 Show response
connect.facebook.net/signals/config/ 232 KB
56 KB 32ms
30ms Script
application/x-javascript 2a03:2880:f338:80:face:b00c:0:3
Facebook

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/signals/config/1042590016249604?v=2.9.337&r=stable&domain=redcanary.com&hme=a4ca9981c995923b5752040373feb3dd5ae6be6b3954c741d676eccf72e2f0a2&ex_m=105%2C208%2C156%2C22%2C73%2C74%2C147%2C69%2C68%2C11%2C165%2C91%2C16%2C139%2C128%2C39%2C76%2C79%2C135%2C161%2C167%2C8%2C4%2C5%2C7%2C6%2C3%2C92%2C102%2C168%2C173%2C222%2C30%2C75%2C234%2C233%2C232%2C23%2C33%2C55%2C104%2C61%2C10%2C64%2C98%2C99%2C100%2C106%2C131%2C31%2C29%2C133%2C134%2C130%2C129%2C157%2C77%2C160%2C158%2C159%2C50%2C60%2C124%2C15%2C164%2C45%2C267%2C268%2C266%2C26%2C27%2C28%2C48%2C148%2C78%2C113%2C18%2C20%2C44%2C40%2C42%2C41%2C84%2C93%2C97%2C111%2C146%2C149%2C46%2C112%2C24%2C21%2C120%2C70%2C36%2C151%2C150%2C152%2C143%2C141%2C25%2C35%2C59%2C110%2C163%2C71%2C17%2C154%2C115%2C82%2C67%2C19%2C86%2C87%2C117%2C85%2C137%2C136%2C140%2C162%2C34%2C281%2C297%2C215%2C204%2C62%2C205%2C203%2C300%2C291%2C52%2C216%2C108%2C132%2C81%2C122%2C54%2C47%2C49%2C114%2C121%2C127%2C126%2C58%2C65%2C63%2C153%2C116%2C37%2C32%2C53%2C56%2C101%2C166%2C1%2C125%2C14%2C123%2C12%2C2%2C57%2C94%2C66%2C119%2C90%2C89%2C169%2C170%2C95%2C96%2C9%2C103%2C51%2C144%2C88%2C80%2C72%2C118%2C107%2C43%2C145%2C0%2C83%2C138%2C142%2C155%2C38%2C109%2C13%2C171

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f338:80:face:b00c:0:3 Reston, United States, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

d6d04ca5639d6cb737de1cfcc6030b96dcc3bdad824942556b01915f8b575d82

Security Headers

Name	Value
Content-Security-Policy	default-src .facebook.com .fbcdn.net .facebook.net 'self' blob:;script-src .facebook.com .fbcdn.net .facebook.net blob: 'self' 'nonce-sAHFxlgp';style-src .facebook.com .fbcdn.net .facebook.net 'self' data: blob: 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.fbcdn.net attachment.fbsbx.com .cdninstagram.com blob: 'self' data: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net;font-src .facebook.com .fbcdn.net .facebook.net 'self' data: blob:;img-src .facebook.com .fbcdn.net .facebook.net 'self' data: blob:;media-src .facebook.com .fbcdn.net .facebook.net 'self' data: blob:;child-src .facebook.com .fbcdn.net .facebook.net 'self' data: blob:;frame-src .facebook.com .fbcdn.net .facebook.net 'self' data: blob:;manifest-src .facebook.com .fbcdn.net .facebook.net 'self' data: blob:;object-src .facebook.com .fbcdn.net .facebook.net 'self' data: blob:;worker-src .facebook.com .fbcdn.net .facebook.net 'self' data: blob:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src *.facebook.com *.fbcdn.net *.facebook.net 'self' blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net blob: 'self' 'nonce-sAHFxlgp';style-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob: 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com *.cdninstagram.com blob: 'self' data: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net;font-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;img-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;media-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;child-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;frame-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;manifest-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;object-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;worker-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=17, rtx=0, c=98, mss=1232, tbw=112610, tp=100, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: SZfaaz/DDHAePF+15UhjPy3JOuEF4U7wox19FEHY5hLmKHb7cVFCOyA4XvvUo0135Cb+YJfAmPqvmWnfU6Otqg==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
content-length: 56759
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 messenger-9fcbda82.css
assets.qualified.com/packs/css/widget/sandboxed/ Frame F8DF 43 KB
8 KB 24ms
23ms Stylesheet
text/css 104.18.16.5
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://assets.qualified.com/packs/css/widget/sandboxed/messenger-9fcbda82.css
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.16.5 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: bad580c9649fd2b94581d73b47d7e4c620d0efd603f6830c0f20101cf09ef96a

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://app.qualified.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-amz-id-2: MXaHlNjDBpZi2BokWg/Re4qF/LWXojsjGeMqE8MxBQe4nOKTFvYLenZjyfa0bX1FH55hjNpLnYg=
cache-control: public, max-age=31536000, immutable
content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: null
age: 1864907
etag: W/"14221c674c27afa6fb09776af178d6cc"
x-amz-request-id: QRN20HQGT4091JZ9
expires: Wed, 19 May 2027 23:54:11 GMT
cf-ray: a09cc6471a89f4bf-EWR
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: text/css
last-modified: Mon, 23 Feb 2026 17:04:38 GMT
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 messenger-ee8fad45.js Show response
assets.qualified.com/packs/js/widget/sandboxed/ Frame F8DF 3 MB
806 KB 90ms
89ms Script
application/javascript 104.18.16.5
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://assets.qualified.com/packs/js/widget/sandboxed/messenger-ee8fad45.js
Requested by: Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=209c2900-8257-4237-b2ab-90860d6fde7b
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.16.5 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0faf90022f9fa72f79da2187f4a5b5f832e84583e2fe8452e73a88adb8eb7f54

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://app.qualified.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-amz-id-2: Zl4jkYrj5InEPZNiMvzgfVW3JjS/kspOKqvs7BkJOSJUgdzGFQZjAPW0vRJNkJFqZCJTGs0tmzZaT2ZpOttMlN2uDQSBjWrW
cache-control: public, max-age=31536000, immutable
content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: null
age: 18268
etag: W/"35a1d37db5f8c00f7b7a063eeb91d26d"
x-amz-request-id: 06BXPPS2HBCSHQBE
expires: Thu, 10 Jun 2027 19:59:44 GMT
cf-ray: a09cc6471aa8f4bf-EWR
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: application/javascript
last-modified: Wed, 10 Jun 2026 20:00:10 GMT
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 Inter-Regular.f1f0c35b.woff2
assets.qualified.com/packs/media/ Frame F8DF 97 KB
97 KB 63ms
23ms Font
font/woff2 104.18.16.5
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://assets.qualified.com/packs/media/Inter-Regular.f1f0c35b.woff2
Requested by: Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=209c2900-8257-4237-b2ab-90860d6fde7b
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.16.5 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d612f1212b452af07f1a5defb2b672e76a91f7139e7499fa48bb9b2b985c22d6

Request headers

Origin: https://app.qualified.com
sec-ch-ua-platform: "Linux"
Referer: https://app.qualified.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 3600
access-control-expose-headers: ETag, Last-Modified, Cache-Control, Expires, CF-Cache-Status, CF-Ray
cf-cache-status: HIT
etag: "dc131113894217b5031000575d9de002"
x-amz-version-id: null
age: 3252
access-control-allow-methods: GET, HEAD
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: font/woff2
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
last-modified: Mon, 23 Feb 2026 21:56:09 GMT
x-amz-id-2: xiztgqUg6X+J/MCx//NXvPxXzVG8FMkqZxNDgQCmoitUSAjnwVevR4Xt+2Xp4hx+Xq4NRaJ0VSFZl6orIIJBb7x67LsTX5zi
x-amz-request-id: 9WEYE3WJTGVR81RT
cf-ray: a09cc64759cfb7a0-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 98868
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 Inter-SemiBold.fcb100c7.woff2
assets.qualified.com/packs/media/ Frame F8DF 103 KB
104 KB 83ms
43ms Font
font/woff2 104.18.16.5
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://assets.qualified.com/packs/media/Inter-SemiBold.fcb100c7.woff2
Requested by: Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=209c2900-8257-4237-b2ab-90860d6fde7b
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.16.5 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 152261291c938aa5aad6a56d52b47ffcb893d1c0387e76d7f270a7382ff786d5

Request headers

Origin: https://app.qualified.com
sec-ch-ua-platform: "Linux"
Referer: https://app.qualified.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 3600
access-control-expose-headers: ETag, Last-Modified, Cache-Control, Expires, CF-Cache-Status, CF-Ray
cf-cache-status: HIT
etag: "007ad31a53f4ab3f58ee74f2308482ce"
x-amz-version-id: null
age: 4089
access-control-allow-methods: GET, HEAD
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: font/woff2
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
last-modified: Sun, 07 Jun 2026 11:40:47 GMT
x-amz-id-2: MQ7TFIQqFiC3gVqv1FL1J6kQNm/H4PctooovkahtGToJGklAxqC6zxl7qROp7yKmSfMDUQDYPZCjE9XMmyxUo8fg4C0GQFf4
x-amz-request-id: P8TE9FT9VTCJT027
cf-ray: a09cc64759d4b7a0-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 105804
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 v833ccba57c9e4d2798f2e76cebdd09a11778172276447 Show response
static.cloudflareinsights.com/beacon.min.js/ Frame F8DF 32 KB
11 KB 57ms
21ms Script
text/javascript 2606:4700::6810:4f49
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v833ccba57c9e4d2798f2e76cebdd09a11778172276447
Requested by: Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=209c2900-8257-4237-b2ab-90860d6fde7b
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:4f49 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: aca73fc574e12740e3368860b88a284d01b643456f3ed6a06322ecb47750563f

Request headers

Origin: https://app.qualified.com
sec-ch-ua-platform: "Linux"
Referer: https://app.qualified.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2026.5.0"
cross-origin-resource-policy: cross-origin
cf-ray: a09cc647587083ad-EWR
access-control-allow-origin: *
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 07 May 2026 16:44:36 GMT
server: cloudflare

GET
H2 200 adsct
t.co/1/i/ 43 B
663 B 106ms
61ms Image
image/gif 172.66.0.227
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL

https://t.co/1/i/adsct?bci=4&dv=America%2FNew_York%26en-US%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2648%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=723ada0d-bda6-4bb4-a4c1-caf0f68a257e&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=1ec13fb0-2cde-4760-9090-68ef02aa7328&pt=BloodHound%20-%20Red%20Canary%20Threat%20Detection%20Report&tw_document_href=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&tw_iframe_status=0&tw_pid_src=1&twpid=tw.1781140629617.278865766192623632&txn_id=o015g&type=javascript&version=2.3.53

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.0.227 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare envoy /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519; includeSubdomains

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=631138519; includeSubdomains
x-transaction-id: 66a582ecf323a0e0
cache-control: no-cache, no-store, max-age=0
origin-cf-ray: a09cc64779b10c9b-EWR
cf-cache-status: DYNAMIC
cf-ray: a09cc64779b10c9b-EWR
x-response-time: 6
content-length: 43
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare envoy
x-served-by: t4_a

GET
H2 200 adsct
analytics.twitter.com/1/i/ 43 B
1010 B 87ms
47ms Image
image/gif 172.66.0.227
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL

https://analytics.twitter.com/1/i/adsct?bci=4&dv=America%2FNew_York%26en-US%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2648%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=723ada0d-bda6-4bb4-a4c1-caf0f68a257e&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=1ec13fb0-2cde-4760-9090-68ef02aa7328&pt=BloodHound%20-%20Red%20Canary%20Threat%20Detection%20Report&tw_document_href=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&tw_iframe_status=0&tw_pid_src=1&twpid=tw.1781140629617.278865766192623632&txn_id=o015g&type=javascript&version=2.3.53

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.0.227 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare envoy /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519; includeSubdomains

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=631138519; includeSubdomains
x-transaction-id: 11716b1b91908042
cache-control: no-cache, no-store, max-age=0
origin-cf-ray: a09cc64768d92e74-ATL
cf-cache-status: DYNAMIC
cf-ray: a09cc64768d92e74-EWR
x-response-time: 7
content-length: 43
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare envoy
x-served-by: t4_a

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
666 B 71ms
28ms Image
image/gif 2a04:4e42::396
Fastly

General

Check archive.org

Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1781140629639&id=t2_5kac730w&event=PageVisit&m.value=&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=2c649406-947c-47e1-8106-039da4de3803&aaid=&external_id=&idfa=&integration=gtm&partner=&partner_version=1.0.3&opt_out=0&sh=1600&sw=1200&v=rdt_afb90018&dpm=&dpcc=&dprc=&esurl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::396 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
retry-after: 0
cross-origin-resource-policy: cross-origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
via: 1.1 varnish
x-reddit-ct: v=1,dn=FT,p=NYC,cs=HIT
accept-ranges: bytes
content-length: 42
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: image/gif
server: Varnish

GET
H2 200 6si.min.js Show response
j.6sc.co/ 68 KB
19 KB 21ms
21ms Script
application/javascript 23.221.227.208
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://j.6sc.co/6si.min.js
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/j/f3744a5e-342b-429c-9d2c-2c1b7b45310a.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.221.227.208 Sterling, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-221-227-208.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 91c20c70d36b608cf919e894b0ac9e32298d6b3ac3ca59c45a85e7c44161d170

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-type: application/javascript
cache-control: private, max-age=10800
content-encoding: gzip
x-amz-version-id: P3wU2zsFsU_YKU_VzrjthagDfojxxkBN
etag: W/"bc32411fd6fa348d8203d2f26dd9866d"
expires: Thu, 11 Jun 2026 04:17:09 GMT
content-length: 18919
x-amz-cf-id: eaHZ4UUz869WHJ3kRX31DrorCN8KbhUUuGlf6hAtEuFoCdc22t7SyQ==
date: Thu, 11 Jun 2026 01:17:09 GMT
last-modified: Wed, 19 Feb 2025 12:59:27 GMT
vary: accept-encoding
x-amz-cf-pop: IAD79-C3
x-amz-server-side-encryption: AES256

GET
H2 200 insight.old.min.js Show response
snap.licdn.com/li.lms-analytics/ 52 KB
19 KB 23ms
21ms Script
application/javascript 2600:1408:a:53::170f:355
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.old.min.js

Requested by

Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:a:53::170f:355 Chantilly, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

246646a9adecc53ddd648f6073306ccb3ad17e926d9ef5ccfffd6975c092feb5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=86400
content-encoding: gzip
x-cdn-proto: HTTP2
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18894
date: Thu, 11 Jun 2026 01:17:09 GMT
last-modified: Sun, 17 May 2026 09:47:35 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 analytics.min.js Show response
cdn.bttrack.com/js/16590/analytics/1.0/ 599 B
489 B 69ms
67ms Script
text/javascript 2600:1408:c400:26::17da:d929
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://cdn.bttrack.com/js/16590/analytics/1.0/analytics.min.js
Requested by: Host: cdn.bttrack.com
URL: https://cdn.bttrack.com/universal/46183
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:26::17da:d929 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: 2678f7766bba46715a0e635ea5878d55dfdcff15f746a9299110a222c6d654b5

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=23167
x-servername: NATIVE01
content-length: 370
date: Thu, 11 Jun 2026 01:17:09 GMT
content-encoding: gzip
content-type: text/javascript
vary: Accept-Encoding

GET
H2 404 3547
bttrack.com/Pixel/Retarget/ 0
203 B 107ms
51ms Image
text/plain 192.132.33.68
Bidtellect Inc.

General

Check archive.org

Download Go to Show image

Full URL

https://bttrack.com/Pixel/Retarget/3547

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.132.33.68 , United States, ASN18568 (BIDTELLECT - Bidtellect Inc., US),

Reverse DNS

NET-33-132-192.68.bidtellect.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

date: Thu, 11 Jun 2026 01:17:09 GMT
strict-transport-security: max-age=31536000;

GET
H2 404 3546
bttrack.com/Pixel/Retarget/ 0
163 B 108ms
53ms Image
text/plain 192.132.33.68
Bidtellect Inc.

General

Check archive.org

Download Go to Show image

Full URL

https://bttrack.com/Pixel/Retarget/3546

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.132.33.68 , United States, ASN18568 (BIDTELLECT - Bidtellect Inc., US),

Reverse DNS

NET-33-132-192.68.bidtellect.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

date: Thu, 11 Jun 2026 01:17:09 GMT
strict-transport-security: max-age=31536000;

GET
H2 200 clarity.js Show response
scripts.clarity.ms/0.8.65/ 73 KB
25 KB 233ms
86ms Script
application/javascript 2603:1061:14:74::1
Microsoft Corpora...

General

Check archive.org

Download Go to

Full URL: https://scripts.clarity.ms/0.8.65/clarity.js
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/uet/343174072?insights=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2603:1061:14:74::1 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: /
Resource Hash: 0bd23f74f23102aa057696b22f06751c932e319ff0a21b53e8d66f17fa17ea80

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-azure-ref: 20260611T011709Z-18455786969cd6m6hC1MIAudcn0000000geg000000003e63
cache-control: public, max-age=86400
x-ms-version: 2018-03-28
content-encoding: br
etag: W/"0x8DEC6147D188CE7"
x-fd-int-roxy-purgeid: 0
x-ms-request-id: 21de6f75-101e-0028-366e-f84f73000000
access-control-allow-origin: *
x-cache: TCP_HIT
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 09 Jun 2026 10:47:23 GMT

GET
H2 200 4463-8e5f8646.js Show response
js.qualified.com/packs/js/ 5 KB
2 KB 22ms
21ms Script
application/javascript 104.18.17.5
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://js.qualified.com/packs/js/4463-8e5f8646.js
Requested by: Host: js.qualified.com
URL: https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.17.5 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f5aec9320f7ba6050172736d730c97e3a743e136eaa67cbe23be52df15245d80

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-amz-id-2: 1GezvsbkOpMSHutOW5tnl3xVqTQCAxKXI3/FNyQXNEIapXJdtg31PODQBVD/wELA5QbzJM1XG87jiiBkvwIVMStrpUJi3/pc
cache-control: public, max-age=31536000, immutable
content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: null
age: 18258
etag: W/"e698bfdd4cc95ec03347c4c56dc61f01"
x-amz-request-id: JWM0EF9T6SWW4Q7M
expires: Thu, 10 Jun 2027 19:59:44 GMT
cf-ray: a09cc6487fddf569-EWR
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: application/javascript
last-modified: Wed, 10 Jun 2026 20:00:05 GMT
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 /
www.facebook.com/tr/ 0
19 B 81ms
24ms Image
text/plain 2a03:2880:f338:1:face:b00c:0:25de
Facebook

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1042590016249604&ev=PageView&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&rl=&if=false&ts=1781140629875&iw=false&sw=1600&sh=1200&v=2.9.337&r=stable&ec=0&o=12318&aems=0%3B0&fbp=fb.1.1781140629860.213152477632356342&ler=empty&cdl=API_unavailable&pmd[title]=BloodHound%20-%20Red%20Canary%20Threat%20Detection%20Report&pmd[locale]=en_US&pmd[description]=BloodHound%20is%20an%20open%20source%20tool%20that%20provides%20visibility%20into%20Active%20Directory%20environments%20and%20is%20a%20precursor%20to%20follow-on%20activity.&plt=1027.7999954223633&iss=1&imft=1&tz=-240&it=1781140629552&coo=false&expv2[0]=pl0&expv2[1]=el3&expv2[2]=bc1&expv2[3]=ra2&expv2[4]=rp2&expv2[5]=ct3&expv2[6]=hf1&rqm=GET

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f338:1:face:b00c:0:25de Reston, United States, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=18, rtx=0, c=23, mss=1232, tbw=6197, tp=10, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: text/plain
server: proxygen-bolt
priority: u=1,i

POST
H2 200 / Show response
o209747.ingest.us.sentry.io/api/4508915056574464/envelope/ Frame F8DF 2 B
281 B 253ms
131ms Fetch
application/json 2600:1901:0:5e8a::
Google LLC

General

Check archive.org

Download Go to

Full URL

https://o209747.ingest.us.sentry.io/api/4508915056574464/envelope/?sentry_key=c36ec735e564530732f0d75311d173b6&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.119.1

Requested by

Host: assets.qualified.com
URL: https://assets.qualified.com/packs/js/widget/sandboxed/messenger-ee8fad45.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:0:5e8a:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://app.qualified.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-expose-headers: x-sentry-error,x-sentry-rate-limits,retry-after
cross-origin-resource-policy: cross-origin
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000
content-length: 2
date: Thu, 11 Jun 2026 01:17:10 GMT
content-type: application/json
vary: origin, access-control-request-method, access-control-request-headers
server: nginx

GET
H2

200

asyncPixelSync Show response
pixel-sync.sitescout.com/dmp/ Frame 45D1
Redirect Chain

https://pixel-sync.sitescout.com/dmp/asyncPixelSync
https://pixel-sync.sitescout.com/dmp/asyncPixelSync?cookieQ=1

1 KB
2 KB

27ms
26ms

Document
text/html

34.36.216.150
Google LLC

General

Check archive.org

Download Go to

Full URL: https://pixel-sync.sitescout.com/dmp/asyncPixelSync?cookieQ=1
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.216.150 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 150.216.36.34.bc.googleusercontent.com
Software: A /
Resource Hash: 5684151efeb65bfeff27c460399467d754b476bc64cb4e78246bc2eebb5ef132

Request headers

Referer: https://redcanary.com/threat-detection-report/threats/bloodhound/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

alt-svc: h3=":443"; ma=2592000
cache-control: max-age=0,no-cache,no-store
content-length: 1174
content-type: text/html;charset=UTF-8
date: Thu, 11 Jun 2026 01:17:10 GMT
expires: Tue, 11 Oct 1977 12:34:56 GMT
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma: no-cache
server: A
via: 1.1 google

Redirect headers

alt-svc: h3=":443"; ma=2592000
content-length: 0
date: Thu, 11 Jun 2026 01:17:10 GMT
location: https://pixel-sync.sitescout.com/dmp/asyncPixelSync?cookieQ=1
server: A
via: 1.1 google

GET
H2

200

c8592fd2d60719de
pixel.sitescout.com/up/
Redirect Chain

https://pixel.sitescout.com/up/c8592fd2d60719de?cntr_url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F
https://pixel.sitescout.com/up/c8592fd2d60719de?cookieQ=1&cntr_url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F

43 B
425 B

20ms
19ms

Image
image/gif

216.157.106.133
Aptum Technologies

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.sitescout.com/up/c8592fd2d60719de?cookieQ=1&cntr_url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/
Protocol: H2
Server: 216.157.106.133 Herndon, United States, ASN13768 (COGECO-PEER1 - Aptum Technologies, CA),
Reverse DNS
Software: AC1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: max-age=0,no-cache,no-store
pragma: no-cache
expires: Tue, 11 Oct 1977 12:34:56 GMT
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length: 43
date: Thu, 11 Jun 2026 01:17:10 GMT
content-type: image/gif
server: AC1.1

Redirect headers

location: https://pixel.sitescout.com/up/c8592fd2d60719de?cookieQ=1&cntr_url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F
content-length: 0
date: Thu, 11 Jun 2026 01:17:10 GMT
server: AC1.1

POST
H2 204 rum Show response
app.qualified.com/cdn-cgi/ Frame F8DF 0
173 B 61ms
59ms XHR
text/plain 104.18.16.5
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://app.qualified.com/cdn-cgi/rum?
Requested by: Host: assets.qualified.com
URL: https://assets.qualified.com/packs/js/widget/sandboxed/messenger-ee8fad45.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.16.5 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=209c2900-8257-4237-b2ab-90860d6fde7b
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
content-type: application/json
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: POST,OPTIONS
cf-ray: a09cc64cad2df4bf-EWR
access-control-allow-origin: https://app.qualified.com
date: Thu, 11 Jun 2026 01:17:10 GMT
content-type: text/plain
vary: Origin
server: cloudflare

POST
H/1.1 200 aef4f65953 Show response
bam.nr-data.net/1/ Frame 87D8 199 B
692 B 171ms
46ms XHR
application/json 162.247.243.29
Fastly

General

Check archive.org

Download Go to

Full URL: https://bam.nr-data.net/1/aef4f65953?a=1820827029&v=1.316.0&to=Y11XN0tYDxJTBRZdVloXdhZKTQ4MHQANRlQbYHElS1gMBA%3D%3D&rst=1556&ck=0&s=a6253ab3535e551b&ref=https://resource.redcanary.com/index.php/form/XDFrame&ptid=bec48cb429c5a342&af=err,spa,xhr,stn,ins&ap=21&be=281&fe=147&dc=121&at=TxpUQQNCHBw%3D&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1781140628949,%22n%22:0,%22f%22:165,%22dn%22:165,%22dne%22:165,%22c%22:165,%22s%22:165,%22ce%22:165,%22rq%22:166,%22rp%22:282,%22rpe%22:291,%22di%22:402,%22ds%22:402,%22de%22:402,%22dc%22:427,%22l%22:427,%22le%22:428%7D,%22navigation%22:%7B%7D%7D
Requested by: Host: resource.redcanary.com
URL: https://resource.redcanary.com/index.php/form/XDFrame
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.29 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software: /
Resource Hash: af15306be707d140f27a8d04bccf5763110d62d7ee332932626f6001ff74d9df

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://resource.redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-expose-headers: Date
timing-allow-origin: https://resource.redcanary.com
cross-origin-resource-policy: cross-origin
Connection: keep-alive
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
access-control-allow-credentials: true
access-control-allow-origin: https://resource.redcanary.com
Content-Length: 199
date: Thu, 11 Jun 2026 01:17:10 GMT
content-type: application/json
x-served-by: cache-nyc-kteb1890070-NYC
nr-rate-limited: allowed

POST
H2 204 visitor_events
app.qualified.com/w/1/bAEbi2aHVysBKzuy/ 0
0 49ms
47ms Fetch
text/plain 104.18.17.5
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/visitor_events?wu=34ab5aba-6a01-4ec2-a1f3-407f025ec036&uuid=209c2900-8257-4237-b2ab-90860d6fde7b

Requested by

Host: consent.app.relyance.ai
URL: https://consent.app.relyance.ai/relyance-agent.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.17.5 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type: application/json
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 7200
x-request-id: b8218978-23a9-4987-b056-5a845d6b7d7a
access-control-expose-headers
cf-cache-status: DYNAMIC
x-permitted-cross-domain-policies: none
access-control-allow-methods: POST
x-content-type-options: nosniff
x-cache: bypass
date: Thu, 11 Jun 2026 01:17:10 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding,Origin
x-runtime: 0.017464
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=63072000; includeSubDomains
cache-control: no-cache
x-envoy-upstream-service-time: 19
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: a09cc64d7fdf983e-EWR
access-control-allow-origin: *
x-xss-protection: 0
server: cloudflare

GET
H2

200

demconf.jpg
dpm.demdex.net/ Frame 45D1
Redirect Chain

https://dpm.demdex.net/ibs:dpid=82530&dpuuid=b03d89eb-d60b-4fd8-b177-462ca43604af-6a2a0c96-5553&gdpr=0&gdpr_consent=
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=b03d89eb-d60b-4fd8-b177-462ca43604af-6a2a0c96-5553&gdpr=0&gdpr_consent=

42 B
716 B

60ms
59ms

Image
image/gif

54.209.86.203
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=b03d89eb-d60b-4fd8-b177-462ca43604af-6a2a0c96-5553&gdpr=0&gdpr_consent=

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Server

54.209.86.203 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-209-86-203.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://pixel-sync.sitescout.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-1-v089-01cc85c62.edge-va6.demdex.com 5 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: /Y/10wkmT5s=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 11 Jun 2026 01:17:10 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=b03d89eb-d60b-4fd8-b177-462ca43604af-6a2a0c96-5553&gdpr=0&gdpr_consent=
dcs: dcs-prod-va6-1-v089-01f571cf2.edge-va6.demdex.com 0 ms
pragma: no-cache
x-tid: IMr9i7OGSV4=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 11 Jun 2026 01:17:10 GMT

GET
H2

200

check
pixel.tapad.com/idsync/ex/receive/ Frame 45D1
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=2499&partner_device_id=b03d89eb-d60b-4fd8-b177-462ca43604af-6a2a0c96-5553
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=b03d89eb-d60b-4fd8-b177-462ca43604af-6a2a0c96-5553

95 B
425 B

47ms
46ms

Image
image/png

34.111.113.62
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=b03d89eb-d60b-4fd8-b177-462ca43604af-6a2a0c96-5553

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://pixel-sync.sitescout.com/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Thu, 11 Jun 2026 01:17:10 GMT
content-type: image/png

Redirect headers

strict-transport-security: max-age=31536000
location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=b03d89eb-d60b-4fd8-b177-462ca43604af-6a2a0c96-5553
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Thu, 11 Jun 2026 01:17:10 GMT

GET
H2

204

pixel.gif
load77.exelator.com/ Frame 45D1
Redirect Chain

https://loadm.exelator.com/load/?p=204&g=700&j=0&buid=b03d89eb-d60b-4fd8-b177-462ca43604af-6a2a0c96-5553&gdpr=0&gdpr_consent=
https://loadm.exelator.com/load/?p=204&g=700&j=0&buid=b03d89eb-d60b-4fd8-b177-462ca43604af-6a2a0c96-5553&gdpr=0&gdpr_consent=&xl8blockcheck=1
https://load77.exelator.com/pixel.gif

0
93 B

25ms
20ms

Image
text/plain

44.208.117.202
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://load77.exelator.com/pixel.gif
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/
Protocol: H2
Server: 44.208.117.202 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-44-208-117-202.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://pixel-sync.sitescout.com/

Response headers

server-timing: total;dur=0.000
date: Thu, 11 Jun 2026 01:17:10 GMT
etag: "665c80c5-0"
server: nginx

Redirect headers

cache-control: no-cache
location: https://load77.exelator.com/pixel.gif
access-control-allow-credentials: true
content-length: 0
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
date: Thu, 11 Jun 2026 01:17:10 GMT
content-type: image/gif
x-powered-by: Undertow/1
server: nginx

GET
H2

200

1000.gif
idsync.rlcdn.com/ Frame 45D1
Redirect Chain

https://idsync.rlcdn.com/384136.gif?partner_uid=b03d89eb-d60b-4fd8-b177-462ca43604af-6a2a0c96-5553&gdpr=0&gdpr_consent=
https://idsync.rlcdn.com/1000.gif?memo=CIi5FxI9CjkIARCMThoyYjAzZDg5ZWItZDYwYi00ZmQ4LWIxNzctNDYyY2E0MzYwNGFmLTZhMmEwYzk2LTU1NTMQABoNCJaZqNEGEgUI6AcQAEIASgA

42 B
301 B

57ms
56ms

Image
image/gif

35.244.154.8
Google LLC

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/1000.gif?memo=CIi5FxI9CjkIARCMThoyYjAzZDg5ZWItZDYwYi00ZmQ4LWIxNzctNDYyY2E0MzYwNGFmLTZhMmEwYzk2LTU1NTMQABoNCJaZqNEGEgUI6AcQAEIASgA
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/
Protocol: H2
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://pixel-sync.sitescout.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Thu, 11 Jun 2026 01:17:10 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://idsync.rlcdn.com/1000.gif?memo=CIi5FxI9CjkIARCMThoyYjAzZDg5ZWItZDYwYi00ZmQ4LWIxNzctNDYyY2E0MzYwNGFmLTZhMmEwYzk2LTU1NTMQABoNCJaZqNEGEgUI6AcQAEIASgA
via: 1.1 google
alt-svc: h3=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Thu, 11 Jun 2026 01:17:10 GMT

GET
H2

200

qmap
sync.crwdcntrl.net/ Frame 45D1
Redirect Chain

https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=b03d89eb-d60b-4fd8-b177-462ca43604af-6a2a0c96-5553&gdpr=0&gdpr_consent=
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=b03d89eb-d60b-4fd8-b177-462ca43604af-6a2a0c96-5553&gdpr=0&gdpr_consent=&ct=y

49 B
830 B

53ms
53ms

Image
image/gif

54.87.233.173
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=b03d89eb-d60b-4fd8-b177-462ca43604af-6a2a0c96-5553&gdpr=0&gdpr_consent=&ct=y

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Server

54.87.233.173 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-87-233-173.compute-1.amazonaws.com

Software

Resource Hash

2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://pixel-sync.sitescout.com/

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
cache-control: no-cache
pragma: no-cache
expires: 0
access-control-allow-origin: *
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 49
date: Thu, 11 Jun 2026 01:17:10 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000 ; includeSubDomains
cache-control: no-cache
location: https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=b03d89eb-d60b-4fd8-b177-462ca43604af-6a2a0c96-5553&gdpr=0&gdpr_consent=&ct=y
pragma: no-cache
expires: 0
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Thu, 11 Jun 2026 01:17:10 GMT

GET
H2 200 getuidj Show response
secure.adnxs.com/ 11 B
571 B 270ms
57ms XHR
application/json 68.67.160.114
Xandr Inc.

General

Check archive.org

Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.114 Feasterville, United States, ASN29990 (ASN-APPNEXUS - Xandr Inc., US),

Reverse DNS

672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.25.5 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 8.46.120.161; 8.46.120.161; 672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://redcanary.com
an-x-request-uuid: ae155f5b-ca1d-4bb9-a5a4-e23113af5fec
content-length: 11
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 11 Jun 2026 01:17:10 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.25.5

GET
H2 200 / Show response
ipv6.6sc.co/ 24 B
314 B 160ms
60ms XHR
text/html 2600:1408:c400:d::17cd:6a49
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:d::17cd:6a49 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: 12e53a4ef1c178726c50f804a6fd551eec0e7ac8d1409d324162f373d37048c6

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: 2001:1900:2200:4e41::161
expires: Thu, 11 Jun 2026 01:17:10 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1781140630593_400219719_1168718716_26_1030_7_51_219";dur=1
access-control-allow-origin: https://redcanary.com
content-length: 24
date: Thu, 11 Jun 2026 01:17:10 GMT
content-type: text/html
vary: Origin

POST
H2 204 /
px.ads.linkedin.com/wa/ 0
0 137ms
123ms Fetch 2606:4700:4407::ac40:92d7
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://px.ads.linkedin.com/wa/?medium=fetch&fmt=g

Requested by

Host: consent.app.relyance.ai
URL: https://consent.app.relyance.ai/relyance-agent.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4407::ac40:92d7 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Accept: *
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

linkedin-action: 1
x-li-pop: cf-prod-lor1-x
strict-transport-security: max-age=31536000
cf-cache-status: DYNAMIC
x-li-fabric: prod-lor1
access-control-allow-credentials: true
x-content-type-options: nosniff
cf-ray: a09cc64d989e6e53-EWR
x-li-uuid: AAZT8B6Wbl7s5L2NlBAGHw==
x-li-proto: http/2
access-control-allow-origin: https://redcanary.com
alt-svc: h3=":443"; ma=86400
date: Thu, 11 Jun 2026 01:17:10 GMT
vary: Origin
server: cloudflare

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1781140630553&li_adsId=2399b5ae-4099-4996-80a0-5d203442ddda&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fblo...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1781140630553&li_adsId=2399b5ae-4099-4996-80a0-5d203442ddda&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fblo...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1781140630553%26li_adsId%3D2399b5ae-4099-4996-80a0-5d203442ddda%...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1781140630553&li_adsId=2399b5ae-4099-4996-80a0-5d203442ddda&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fblo...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1781140630553&li_adsId=2399b5ae-4099-4996-80a0-5d203442ddda&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbl...

0
734 B

193ms
128ms

Image
application/javascript

104.18.41.41
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL

https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1781140630553&li_adsId=2399b5ae-4099-4996-80a0-5d203442ddda&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQLkkwOU4SlRJwAAAZ60QS1ZcguRrh4SMcogdDK4FTPgfGrNLZv1k4EW4zcMnlmG_yzrhs-K_LX37A

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Server

104.18.41.41 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

linkedin-action: 1
x-li-pop: cf-prod-lor1-x
strict-transport-security: max-age=31536000
cf-cache-status: DYNAMIC
x-li-fabric: prod-lor1
x-content-type-options: nosniff
cf-ray: a09cc64fbb354f77-EWR
x-li-uuid: AAZT8B6brCPY6/PhVyiEsw==
x-li-proto: http/2
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: application/javascript
server: cloudflare

Redirect headers

linkedin-action: 1
cf-cache-status: DYNAMIC
x-li-fabric: prod-lor1
x-content-type-options: nosniff
x-li-proto: http/3
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 11 Jun 2026 01:17:10 GMT
priority: u=3,i
x-li-pop: cf-prod-lor1-x
strict-transport-security: max-age=31536000
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1781140630553&li_adsId=2399b5ae-4099-4996-80a0-5d203442ddda&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQLkkwOU4SlRJwAAAZ60QS1ZcguRrh4SMcogdDK4FTPgfGrNLZv1k4EW4zcMnlmG_yzrhs-K_LX37A
cf-ray: a09cc64eaab2438c-EWR
x-li-uuid: AAZT8B6ZC0FGyZf6eM0NZQ==
content-length: 0
server: cloudflare

GET
H2 200 js Show response
bttrack.com/engagement/ 10 KB
4 KB 20ms
20ms Script
text/javascript 192.132.33.68
Bidtellect Inc.

General

Check archive.org

Download Go to

Full URL

https://bttrack.com/engagement/js?goalId=16590&cb=1781140630555

Requested by

Host: cdn.bttrack.com
URL: https://cdn.bttrack.com/js/16590/analytics/1.0/analytics.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.132.33.68 , United States, ASN18568 (BIDTELLECT - Bidtellect Inc., US),

Reverse DNS

NET-33-132-192.68.bidtellect.com

Software

Resource Hash

26290221230d18bd4b202a20bb0bf2d1f9a9d9a9495b35af3b0ed7a959697e50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000;
content-encoding: gzip
date: Thu, 11 Jun 2026 01:17:10 GMT
content-type: text/javascript
vary: Accept-Encoding

GET
H2 200 getpixels Show response
bttrack.com/engagement/ 0
117 B 139ms
42ms XHR
text/html 192.132.33.68
Bidtellect Inc.

General

Check archive.org

Download Go to

Full URL

https://bttrack.com/engagement/getpixels?gid=16590

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.132.33.68 , United States, ASN18568 (BIDTELLECT - Bidtellect Inc., US),

Reverse DNS

NET-33-132-192.68.bidtellect.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000;
access-control-allow-origin: https://redcanary.com
content-length: 0
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: text/html
vary: Origin
access-control-allow-credentials: true

POST
H/1.1 204
No Content collect Show response
v.clarity.ms/ 0
277 B 122ms
42ms XHR
text/plain 52.242.103.142
Microsoft Corpora...

General

Check archive.org

Download Go to

Full URL: https://v.clarity.ms/collect
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 52.242.103.142 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Accept: application/x-clarity-gzip
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Request-Context: appId=cid-v1:a449a586-8786-487f-a449-dc1b282a2628
Access-Control-Allow-Origin: https://redcanary.com
Date: Thu, 11 Jun 2026 01:17:10 GMT
Vary: Origin
Server: nginx
Connection: keep-alive
Access-Control-Allow-Credentials: true

POST
H/1.1 200 aef4f65953 Show response
bam.nr-data.net/events/1/ Frame 87D8 24 B
375 B 50ms
49ms XHR
image/gif 162.247.243.29
Fastly

General

Check archive.org

Download Go to

Full URL: https://bam.nr-data.net/events/1/aef4f65953?a=1820827029&v=1.316.0&to=Y11XN0tYDxJTBRZdVloXdhZKTQ4MHQANRlQbYHElS1gMBA%3D%3D&rst=1744&ck=0&s=a6253ab3535e551b&ref=https://resource.redcanary.com/index.php/form/XDFrame&ptid=bec48cb429c5a342
Requested by: Host: resource.redcanary.com
URL: https://resource.redcanary.com/index.php/form/XDFrame
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.29 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software: /
Resource Hash: 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://resource.redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

Connection: keep-alive
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
access-control-allow-origin: https://resource.redcanary.com
Content-Length: 24
date: Thu, 11 Jun 2026 01:17:09 GMT
content-type: image/gif
x-served-by: cache-nyc-kteb1890070-NYC
nr-rate-limited: allowed

POST
H/1.1 200 aef4f65953 Show response
bam.nr-data.net/jserrors/1/ Frame 87D8 24 B
370 B 97ms
44ms XHR
image/gif 162.247.243.29
Fastly

General

Check archive.org

Download Go to

Full URL: https://bam.nr-data.net/jserrors/1/aef4f65953?a=1820827029&v=1.316.0&to=Y11XN0tYDxJTBRZdVloXdhZKTQ4MHQANRlQbYHElS1gMBA%3D%3D&rst=1745&ck=0&s=a6253ab3535e551b&ref=https://resource.redcanary.com/index.php/form/XDFrame&ptid=bec48cb429c5a342
Requested by: Host: resource.redcanary.com
URL: https://resource.redcanary.com/index.php/form/XDFrame
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.29 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software: /
Resource Hash: 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://resource.redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

Connection: close
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
access-control-allow-origin: https://resource.redcanary.com
Content-Length: 24
date: Thu, 11 Jun 2026 01:17:10 GMT
content-type: image/gif
x-served-by: cache-nyc-kteb1890049-NYC
nr-rate-limited: allowed

POST
H/1.1 200 aef4f65953 Show response
bam.nr-data.net/events/1/ Frame 87D8 24 B
375 B 507ms
295ms XHR
image/gif 162.247.243.29
Fastly

General

Check archive.org

Download Go to

Full URL: https://bam.nr-data.net/events/1/aef4f65953?a=1820827029&v=1.316.0&to=Y11XN0tYDxJTBRZdVloXdhZKTQ4MHQANRlQbYHElS1gMBA%3D%3D&rst=1747&ck=0&s=a6253ab3535e551b&ref=https://resource.redcanary.com/index.php/form/XDFrame&ptid=bec48cb429c5a342
Requested by: Host: resource.redcanary.com
URL: https://resource.redcanary.com/index.php/form/XDFrame
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.29 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software: /
Resource Hash: 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://resource.redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

Connection: keep-alive
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
access-control-allow-origin: https://resource.redcanary.com
Content-Length: 24
date: Thu, 11 Jun 2026 01:17:10 GMT
content-type: image/gif
x-served-by: cache-fra-eddf8230088-FRA
nr-rate-limited: allowed

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 660 B
585 B 320ms
135ms XHR
application/json 75.2.108.141
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash: 0b96905923d1c096be22beb729fe7f5e4b7f1ca4e8787c5a412c28986094c28f

Request headers

sec-ch-ua-platform: "Linux"
Authorization: Token e8bebcdaa132f727ae8d16d9967447769318945e
X-6s-CustomID: WebTag f3744a5e-342b-429c-9d2c-2c1b7b45310a
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com
content-encoding: gzip
x-6si-region
access-control-allow-credentials: true
access-control-allow-origin: https://redcanary.com
content-length: 328
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: application/json
vary: Origin, Accept-Encoding

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 287ms
98ms Preflight 75.2.108.141
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://redcanary.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://redcanary.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
content-length: 0
date: Thu, 11 Jun 2026 01:17:10 GMT
timing-allow-origin: https://6sense.com
x-6si-region

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
199 B 168ms
162ms Image
image/gif 23.221.227.208
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=921cd863-bff5-4354-851c-58377f40ae2e&session=4fd4a218-7261-45a2-8e2a-51a59309faa6&event=ipv6&q=%7B%22address%22%3A%222001%3A1900%3A2200%3A4e41%3A%3A161%22%7D&isIframe=false&m=%7B%22description%22%3A%22BloodHound%20is%20an%20open%20source%20tool%20that%20provides%20visibility%20into%20Active%20Directory%20environments%20and%20is%20a%20precursor%20to%20follow-on%20activity.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22BloodHound%20-%20Red%20Canary%20Threat%20Detection%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&pageViewId=02ded34b-21b4-41e7-845c-1009235b3888&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A1900%3A2200%3A4e41%3A%3A161&v=1.1.31

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.221.227.208 Sterling, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-221-227-208.deploy.static.akamaitechnologies.com

Software

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 11 Jun 2026 01:17:10 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 11 Jun 2026 01:17:10 GMT
content-type: image/gif

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
199 B 130ms
124ms Image
image/gif 23.221.227.208
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=5025f2a4-a99a-44a6-82f3-8acc6ca103dd&session=d898fd8c-f6a3-492f-8352-dcc8dca36878&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2011%20Jun%202026%2001%3A17%3A10%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22BloodHound%20is%20an%20open%20source%20tool%20that%20provides%20visibility%20into%20Active%20Directory%20environments%20and%20is%20a%20precursor%20to%20follow-on%20activity.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22BloodHound%20-%20Red%20Canary%20Threat%20Detection%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&pageViewId=02ded34b-21b4-41e7-845c-1009235b3888&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A1900%3A2200%3A4e41%3A%3A161&v=1.1.31

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.221.227.208 Sterling, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-221-227-208.deploy.static.akamaitechnologies.com

Software

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 11 Jun 2026 01:17:10 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 11 Jun 2026 01:17:10 GMT
content-type: image/gif

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
199 B 173ms
167ms Image
image/gif 23.221.227.208
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=a9cd271a-9234-4685-8b19-b4766f64f4b7&session=62332efb-762d-4b8c-8aeb-056ebc3dc994&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22565ffb1efc5e75f417d1fe1c2134f835%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2011%20Jun%202026%2001%3A17%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2011%20Jun%202026%2001%3A17%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22e8bebcdaa132f727ae8d16d9967447769318945e%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2011%20Jun%202026%2001%3A17%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2011%20Jun%202026%2001%3A17%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2011%20Jun%202026%2001%3A17%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2011%20Jun%202026%2001%3A17%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setWhiteListFields%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2011%20Jun%202026%2001%3A17%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2011%20Jun%202026%2001%3A17%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%22f3744a5e-342b-429c-9d2c-2c1b7b45310a%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2011%20Jun%202026%2001%3A17%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2011%20Jun%202026%2001%3A17%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCompanyDetailsExpiration%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2011%20Jun%202026%2001%3A17%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableMapCookieCapture%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2011%20Jun%202026%2001%3A17%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2011%20Jun%202026%2001%3A17%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22BloodHound%20is%20an%20open%20source%20tool%20that%20provides%20visibility%20into%20Active%20Directory%20environments%20and%20is%20a%20precursor%20to%20follow-on%20activity.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22BloodHound%20-%20Red%20Canary%20Threat%20Detection%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&pageViewId=02ded34b-21b4-41e7-845c-1009235b3888&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A1900%3A2200%3A4e41%3A%3A161&v=1.1.31

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/threats/bloodhound/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.221.227.208 Sterling, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-221-227-208.deploy.static.akamaitechnologies.com

Software

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 11 Jun 2026 01:17:10 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 11 Jun 2026 01:17:10 GMT
content-type: image/gif

GET
H2 200 p Show response
i.simpli.fi/ 883 B
787 B 23ms
21ms Script
application/javascript 35.245.15.98
Google LLC

General

Check archive.org

Download Go to

Full URL: https://i.simpli.fi/p?cid=532110&cb=sifi_att_77296107446350._hp
Requested by: Host: tag.simpli.fi
URL: https://tag.simpli.fi/sifitag/641ec645-3300-4d04-8dcf-2d7b5e50a8bd
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.245.15.98 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 98.15.245.35.bc.googleusercontent.com
Software: openresty /
Resource Hash: fe8fdbc6db1356ef1606551feca8ac3a80425aadfda34cc7183a8a2e7a5a42c5

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-encoding: gzip
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: openresty

GET
H2

200

c.gif
c.clarity.ms/
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=2CD965EBCC5E44B48EE32264F88472F1&RedC=c.clarity.ms&MXFR=11AFEF76B99267412A68F803BD9269F9
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=2CD965EBCC5E44B48EE32264F88472F1&MUID=0D0CCACBBD6762AF26ACDDBEBCA56351

42 B
721 B

86ms
81ms

Image
image/gif

2603:1061:14:74::1
Microsoft Corpora...

General

Check archive.org

Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=2CD965EBCC5E44B48EE32264F88472F1&MUID=0D0CCACBBD6762AF26ACDDBEBCA56351
Protocol: H2
Server: 2603:1061:14:74::1 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "a72625a6f6d8dc1:0"
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 42
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: image/gif
last-modified: Thu, 30 Apr 2026 23:11:17 GMT
x-powered-by: ASP.NET
x-azure-ref: 20260611T011711Z-18455786969r54wlhC1MIA09r40000000gw0000000004waz

Redirect headers

Cache-Control: private, no-cache, proxy-revalidate, no-store
Location: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=2CD965EBCC5E44B48EE32264F88472F1&MUID=0D0CCACBBD6762AF26ACDDBEBCA56351
Pragma: no-cache
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
X-MSEdge-Ref: Ref A: D068F9BEB95A42CE87FAF95A663AF578 Ref B: NYCEDGE1715 Ref C: 2026-06-11T01:17:11Z
X-Cache: CONFIG_NOCACHE
P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
Content-Length: 0
Date: Thu, 11 Jun 2026 01:17:11 GMT
X-Powered-By: ASP.NET

GET
H2 200 favicon.png
redcanary.com/wp-content/themes/redcanary/assets/img/ 16 KB
16 KB 187ms
186ms Other
image/png 104.198.136.223
Google LLC

General

Check archive.org

Download Go to

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/img/favicon.png

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

8b4532ddd365937e2ee31a95189a447d45881cf4dadf2ab66c850786f87774d8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/threat-detection-report/threats/bloodhound/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
cache-control: public, max-age=31536000
etag: "5c76b1ec-3fb8"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 16312
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: image/png
last-modified: Wed, 27 Feb 2019 15:51:08 GMT
server: nginx
vary: Accept-Encoding

GET
H2

200

utsync.ashx
ml314.com/
Redirect Chain

https://um.simpli.fi/bombora
https://ml314.com/utsync.ashx?et=0&eid=93940&fp=BAD0F1C186764379A7E8F3E2C74AF371

43 B
464 B

114ms
63ms

Image
image/gif

34.117.77.79
Google LLC

General

Check archive.org

Download Go to Show image

Full URL: https://ml314.com/utsync.ashx?et=0&eid=93940&fp=BAD0F1C186764379A7E8F3E2C74AF371
Protocol: H2
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 google
expires: 0, Fri, 12 Jun 2026 01:17:11 GMT
alt-svc: h3=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://ml314.com/utsync.ashx?et=0&eid=93940&fp=BAD0F1C186764379A7E8F3E2C74AF371
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Wed, 10 Jun 2026 01:17:11 GMT
access-control-allow-origin: *
content-length: 142
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

200
OK

pixel.gif
yield-op-idsync.live.streamtheworld.com/
Redirect Chain

https://um.simpli.fi/bidswitch
https://x.bidswitch.net/sync?dsp_id=518&user_id=BAD0F1C186764379A7E8F3E2C74AF371
https://x.bidswitch.net/ul_cb/sync?dsp_id=518&user_id=BAD0F1C186764379A7E8F3E2C74AF371
https://yield-op-idsync.live.streamtheworld.com/pixel.gif?partner=bsw&uid=410650b0-a7b0-4a9a-a6c7-092a4ecec8c6&stn=&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=

43 B
666 B

137ms
62ms

Image
image/gif

208.92.55.248
Triton Digital

General

Check archive.org

Download Go to Show image

Full URL: https://yield-op-idsync.live.streamtheworld.com/pixel.gif?partner=bsw&uid=410650b0-a7b0-4a9a-a6c7-092a4ecec8c6&stn=&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Protocol: HTTP/1.1
Server: 208.92.55.248 , Canada, ASN13360 (TRITONDIGITAL - Triton Digital, CA),
Reverse DNS
Software: istio-envoy /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

content-length: 43
date: Thu, 11 Jun 2026 01:17:10 GMT
x-envoy-upstream-service-time: 1
content-type: image/gif
server: istio-envoy

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //yield-op-idsync.live.streamtheworld.com/pixel.gif?partner=bsw&uid=410650b0-a7b0-4a9a-a6c7-092a4ecec8c6&stn=&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 11 Jun 2026 01:17:11 GMT

GET
H2

200

syncMe
synchroscript.deliveryengine.adswizz.com/
Redirect Chain

https://um.simpli.fi/adswizz
https://synchroscript.deliveryengine.adswizz.com/syncMe?partnerDomain=simpli.fi&idType=cookie&partnerUserId=BAD0F1C186764379A7E8F3E2C74AF371

0
398 B

140ms
91ms

Image
text/plain

18.160.10.47
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://synchroscript.deliveryengine.adswizz.com/syncMe?partnerDomain=simpli.fi&idType=cookie&partnerUserId=BAD0F1C186764379A7E8F3E2C74AF371
Protocol: H2
Server: 18.160.10.47 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-18-160-10-47.iad12.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

x-adswizz-request-id: e05a22b2-0fa0-4972-a65c-7d5a5fd20fac
x-clacks-overhead: GNU Terry Pratchett
via: 1.1 e8eec15d9551dd475d4c478f9fbb5f04.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
x-amz-cf-id: GcRd3x2eDoZAayYb46AmDTYvZqkX1GKdDKQPVGHdgrWYH3HyMjmmUw==
date: Thu, 11 Jun 2026 01:17:11 GMT
x-amz-cf-pop: IAD12-P3

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://synchroscript.deliveryengine.adswizz.com/syncMe?partnerDomain=simpli.fi&idType=cookie&partnerUserId=BAD0F1C186764379A7E8F3E2C74AF371
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Wed, 10 Jun 2026 01:17:11 GMT
access-control-allow-origin: *
content-length: 142
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

200
OK

/
ps.eyeota.net/match/bounce/
Redirect Chain

https://um.simpli.fi/eyeota
https://ps.eyeota.net/match?bid=irm51m1&uid=BAD0F1C186764379A7E8F3E2C74AF371
https://ps.eyeota.net/match/bounce/?bid=irm51m1&uid=BAD0F1C186764379A7E8F3E2C74AF371

70 B
450 B

24ms
22ms

Image
image/gif

44.218.64.233
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match/bounce/?bid=irm51m1&uid=BAD0F1C186764379A7E8F3E2C74AF371
Protocol: HTTP/1.1
Server: 44.218.64.233 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-44-218-64-233.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 11 Jun 2026 01:17:11 GMT
Content-Type: image/gif

Redirect headers

Location: /match/bounce/?bid=irm51m1&uid=BAD0F1C186764379A7E8F3E2C74AF371
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 11 Jun 2026 01:17:11 GMT

GET
H/1.1

200

dcm
s.amazon-adsystem.com/
Redirect Chain

https://um.simpli.fi/smaato
https://s.ad.smaato.net/c/?dspInit=675&dspCookie=BAD0F1C186764379A7E8F3E2C74AF371
https://s.amazon-adsystem.com/dcm?pid=6c6fd2c8-c9f3-4a37-9a77-029dc3cc98b3&id=918f30da07&gdpr=0&gdpr_consent=
https://s.amazon-adsystem.com/dcm?pid=6c6fd2c8-c9f3-4a37-9a77-029dc3cc98b3&id=918f30da07&gdpr=0&gdpr_consent=&dcc=t

43 B
840 B

44ms
42ms

Image
image/gif

98.82.157.231
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=6c6fd2c8-c9f3-4a37-9a77-029dc3cc98b3&id=918f30da07&gdpr=0&gdpr_consent=&dcc=t

Protocol

HTTP/1.1

Server

98.82.157.231 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-98-82-157-231.compute-1.amazonaws.com

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 8370Z18M6RZHF0VC92DF
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 11 Jun 2026 01:17:11 GMT
Content-Type: image/gif
Vary: Accept-Encoding,User-Agent
Server: Server

Redirect headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Location: https://s.amazon-adsystem.com/dcm?pid=6c6fd2c8-c9f3-4a37-9a77-029dc3cc98b3&id=918f30da07&gdpr=0&gdpr_consent=&dcc=t
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: NX812EYXJBT6QB82FWYF
Content-Length: 0
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 11 Jun 2026 01:17:11 GMT
Vary: Accept-Encoding,User-Agent
Server: Server

GET
H2

200

RX-b544f06f-2021-4524-be56-659b06ea0565-005
sync.targeting.unrulymedia.com/csync/
Redirect Chain

https://um.simpli.fi/nexxen
https://sync.1rx.io/usersync/simplifi/BAD0F1C186764379A7E8F3E2C74AF371
https://sync.1rx.io/usersync/simplifi/BAD0F1C186764379A7E8F3E2C74AF371?zcc=1&cb=1781140631306
https://sync.targeting.unrulymedia.com/csync/RX-b544f06f-2021-4524-be56-659b06ea0565-005

43 B
378 B

128ms
77ms

Image
image/gif

69.194.240.13
RhythmOne

General

Check archive.org

Download Go to Show image

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-b544f06f-2021-4524-be56-659b06ea0565-005
Protocol: H2
Server: 69.194.240.13 , United States, ASN26120 (RHYTHMONE - RhythmOne, LLC, US),
Reverse DNS
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
date: Thu, 11 Jun 2026 01:17:11 GMT
content-length: 43

Redirect headers

expires: 0
cache-control: no-store, no-cache, must-revalidate
location: https://sync.targeting.unrulymedia.com/csync/RX-b544f06f-2021-4524-be56-659b06ea0565-005
date: Thu, 11 Jun 2026 01:17:11 GMT
pragma: no-cache
content-type: text/html

GET
H2

200

xuid
eb2.3lift.com/
Redirect Chain

https://um.simpli.fi/triplelift
https://eb2.3lift.com/xuid?mid=7969&xuid=BAD0F1C186764379A7E8F3E2C74AF371&dongle=yf3
https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=BAD0F1C186764379A7E8F3E2C74AF371&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=

37 B
248 B

49ms
48ms

Image
image/gif

34.193.247.218
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=BAD0F1C186764379A7E8F3E2C74AF371&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
Protocol: H2
Server: 34.193.247.218 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-193-247-218.compute-1.amazonaws.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: /xuid?ld=1&mid=7969&xuid=BAD0F1C186764379A7E8F3E2C74AF371&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
content-length: 0
date: Thu, 11 Jun 2026 01:17:11 GMT

GET
H2

200

sync
simplifi.partners.tremorhub.com/
Redirect Chain

https://um.simpli.fi/telaria_p
https://simplifi.partners.tremorhub.com/sync?UISF=BAD0F1C186764379A7E8F3E2C74AF371

43 B
175 B

98ms
38ms

Image
image/gif

2600:1f10:4ce4:4a03:2a62:57c9:2b3a:27f4
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://simplifi.partners.tremorhub.com/sync?UISF=BAD0F1C186764379A7E8F3E2C74AF371
Protocol: H2
Server: 2600:1f10:4ce4:4a03:2a62:57c9:2b3a:27f4 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: image/gif
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://simplifi.partners.tremorhub.com/sync?UISF=BAD0F1C186764379A7E8F3E2C74AF371
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Wed, 10 Jun 2026 01:17:11 GMT
access-control-allow-origin: *
content-length: 142
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

receive
pixel.tapad.com/idsync/ex/
Redirect Chain

https://um.simpli.fi/tapad
https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=BAD0F1C186764379A7E8F3E2C74AF371

95 B
727 B

113ms
60ms

Image
image/png

34.111.113.62
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=BAD0F1C186764379A7E8F3E2C74AF371

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: image/png

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=BAD0F1C186764379A7E8F3E2C74AF371
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Wed, 10 Jun 2026 01:17:11 GMT
access-control-allow-origin: *
content-length: 142
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

empty.gif
um.simpli.fi/
Redirect Chain

https://um.simpli.fi/ad_advisor
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=BAD0F1C186764379A7E8F3E2C74AF371
https://d.agkn.com/pixel/10751/?che=1781140631413&ip=8.46.120.161&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D212680605640001374383
https://um.simpli.fi/aa_px?sk=212680605640001374383
https://um.simpli.fi/empty.gif

43 B
361 B

18ms
18ms

Image
image/gif

34.85.181.204
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://um.simpli.fi/empty.gif

Protocol

Server

34.85.181.204 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

204.181.85.34.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 43
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: image/gif
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
location: /empty.gif
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
content-length: 142
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

ProfilesEngineServlet
syncv4.intentiq.com/profiles_engine/
Redirect Chain

https://um.simpli.fi/intentiq
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=BAD0F1C186764379A7E8F3E2C74AF371
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=BAD0F1C186764379A7E8F3E2C74AF371&ckls=true&ci=XuBqwjHfbC&nc=false&trid=1360377190
https://syncv4.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=BAD0F1C186764379A7E8F3E2C74AF371&ckls=true&ci=XuBqwjHfbC&nc=false&trid=1360377190&ripv6=2001:1900:2200:4e...

43 B
1 KB

122ms
64ms

Image
image/gif

52.85.193.65
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://syncv4.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=BAD0F1C186764379A7E8F3E2C74AF371&ckls=true&ci=XuBqwjHfbC&nc=false&trid=1360377190&ripv6=2001:1900:2200:4e41:0:0:0:161
Protocol: H2
Server: 52.85.193.65 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-52-85-193-65.iad55.r.cloudfront.net
Software: /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

access-control-max-age: 3600
access-control-allow-methods: POST, GET, OPTIONS
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
x-amz-cf-id: vfx2N2H2uL_sk4bFOukkYItAJsNRCMHZVAiU2u2TxQ-aDyS7uEdrxA==
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: image/gif
vary: Origin
access-control-allow-headers: Content-Type, Accept, X-Requested-With, remember-me, DNT,X-CustomHeader,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 434e1d253124c6f9517c35a2c6014518.cloudfront.net (CloudFront)
access-control-allow-origin: https://redcanary.com/
content-length: 43
x-amz-cf-pop: IAD55-P10

Redirect headers

access-control-max-age: 3600
access-control-allow-methods: POST, GET, OPTIONS
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
x-amz-cf-id: q-Wjuf0O6sTTDTx1QU4RbFkYy66np9AjRw7L3ts6Ls4RK92R2vUlMw==
date: Thu, 11 Jun 2026 01:17:11 GMT
vary: Origin
access-control-allow-headers: Content-Type, Accept, X-Requested-With, remember-me, DNT,X-CustomHeader,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control
patent: https://www.almondnet.com/ip
cache-control: no-cache, no-store, must-revalidate
location: https://syncv4.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=BAD0F1C186764379A7E8F3E2C74AF371&ckls=true&ci=XuBqwjHfbC&nc=false&trid=1360377190&ripv6=2001:1900:2200:4e41:0:0:0:161
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 70bb7fd797792ff677b4ec2e2a0ad742.cloudfront.net (CloudFront)
access-control-allow-origin: https://redcanary.com/
content-length: 0
x-amz-cf-pop: IAD61-P13

GET
H2

200

Pug
image2.pubmatic.com/AdServer/
Redirect Chain

https://um.simpli.fi/pubmatic
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:BAD0F1C186764379A7E8F3E2C74AF371

42 B
578 B

63ms
22ms

Image
image/gif

207.65.32.88
PubMatic

General

Check archive.org

Download Go to Show image

Full URL

https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:BAD0F1C186764379A7E8F3E2C74AF371

Protocol

Server

207.65.32.88 , United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),

Reverse DNS

Software

nginx /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

strict-transport-security: max-age=16070400; includeSubDomains
cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:BAD0F1C186764379A7E8F3E2C74AF371
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Wed, 10 Jun 2026 01:17:11 GMT
access-control-allow-origin: *
content-length: 142
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

200
OK

u
user-sync.fwmrm.net/ad/
Redirect Chain

https://um.simpli.fi/freewheel
https://user-sync.fwmrm.net/ad/u?mode=user-register&dspid=24&dspuid=BAD0F1C186764379A7E8F3E2C74AF371&gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=

43 B
504 B

90ms
27ms

Image
image/gif

2600:1f18:6593:f608:d96:5850:6736:187e
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://user-sync.fwmrm.net/ad/u?mode=user-register&dspid=24&dspuid=BAD0F1C186764379A7E8F3E2C74AF371&gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Protocol: HTTP/1.1
Server: 2600:1f18:6593:f608:d96:5850:6736:187e Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
Software: /
Resource Hash: 2ddeade3a8991666b89f2a0c3aaba4508852838488781e260d45bc886f1172a5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

Cache-Control: no-store
Pragma: no-cache
Connection: keep-alive
Expires: 0
X-Fw-Request-Id: ume96b9_1781140631013353584
Content-Length: 43
Keep-Alive: timeout=300
Date: Thu, 11 Jun 2026 01:17:11 GMT
P3P: policyref="https://www.freewheel.tv/w3c/p3p.xml",CP="ALL DSP COR NID"
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://user-sync.fwmrm.net/ad/u?mode=user-register&dspid=24&dspuid=BAD0F1C186764379A7E8F3E2C74AF371&gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Wed, 10 Jun 2026 01:17:11 GMT
access-control-allow-origin: *
content-length: 142
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

engine
pbid.pro-market.net/
Redirect Chain

https://um.simpli.fi/dtnx
https://fei.pro-market.net/engine?du=24;csync=BAD0F1C186764379A7E8F3E2C74AF371;mimetype=img;
https://fei.pro-market.net/engine?du=24;csync=BAD0F1C186764379A7E8F3E2C74AF371;mimetype=img;sr
https://cm.g.doubleclick.net/pixel?google_nid=datonics-ddp&google_cm&google_hm=LTUxMjY0OTM5MjQwNTA5NzYwNDI=
https://pbid.pro-market.net/engine?du=53&mimetype=img&google_gid=CAESEGP6YV4cl3XuGfX_nVjIFtI&google_cver=1

43 B
529 B

60ms
52ms

Image
image/gif

2606:4700:20::681a:5f1
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://pbid.pro-market.net/engine?du=53&mimetype=img&google_gid=CAESEGP6YV4cl3XuGfX_nVjIFtI&google_cver=1
Protocol: H2
Server: 2606:4700:20::681a:5f1 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3331a0486cb3e8a75c8c2fdf02bf80fd8fe2b811dfe5c7b4aa892d38bfcf604a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Ed7AJgB9ghU25xISU2nHJhK0IYrPa68ATXRbal1IT%2Fbx1GzLaQlRSXuGLnTGMM5Oaxv9E7XkyJbiF9UiAwY9DzRKV7Ii1BrKF3ywEHtz78NgEfE9Bq09jQ7NnqbRwgqMt3P8oELiwiss5UrycXiGjcY%3D"}]}
anserver: gapp2
expires: Mon, 1 Jan 1990 0:0:0 GMT
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
cf-ray: a09cc65399d84fa8-EWR
access-control-allow-origin: *
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://pbid.pro-market.net/engine?du=53&mimetype=img&google_gid=CAESEGP6YV4cl3XuGfX_nVjIFtI&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 315
date: Thu, 11 Jun 2026 01:17:11 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

204

/
loadm.exelator.com/load/
Redirect Chain

https://um.simpli.fi/exelatem
https://loadm.exelator.com/load/?p=204&g=2191&simid=BAD0F1C186764379A7E8F3E2C74AF371&j=0

0
768 B

92ms
39ms

Image
text/plain

35.174.135.129
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://loadm.exelator.com/load/?p=204&g=2191&simid=BAD0F1C186764379A7E8F3E2C74AF371&j=0
Protocol: H2
Server: 35.174.135.129 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-35-174-135-129.compute-1.amazonaws.com
Software: nginx / Undertow/1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: no-cache
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
date: Thu, 11 Jun 2026 01:17:11 GMT
x-powered-by: Undertow/1
server: nginx
access-control-allow-credentials: true

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://loadm.exelator.com/load/?p=204&g=2191&simid=BAD0F1C186764379A7E8F3E2C74AF371&j=0
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Wed, 10 Jun 2026 01:17:11 GMT
access-control-allow-origin: *
content-length: 142
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET

sync
ups.analytics.yahoo.com/ups/55964/
Redirect Chain

https://um.simpli.fi/yahoo
https://ups.analytics.yahoo.com/ups/55964/sync?uid=BAD0F1C186764379A7E8F3E2C74AF371
https://ups.analytics.yahoo.com/ups/55964/sync?uid=BAD0F1C186764379A7E8F3E2C74AF371&verify=true

0
0

GET
H2

204

sync
sync.bfmio.com/
Redirect Chain

https://um.simpli.fi/beachfront
https://sync.bfmio.com/sync?pid=141&uid=BAD0F1C186764379A7E8F3E2C74AF371

0
379 B

126ms
58ms

Image
text/plain

35.212.17.176
YOUTUBE Google Ir...

General

Check archive.org

Download Go to Show image

Full URL: https://sync.bfmio.com/sync?pid=141&uid=BAD0F1C186764379A7E8F3E2C74AF371
Protocol: H2
Server: 35.212.17.176 Washington, United States, ASN43515 (YOUTUBE Google Ireland Limited, IE),
Reverse DNS: 176.17.212.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

via: 1.1 google
date: Thu, 11 Jun 2026 01:17:11 GMT

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://sync.bfmio.com/sync?pid=141&uid=BAD0F1C186764379A7E8F3E2C74AF371
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Wed, 10 Jun 2026 01:17:11 GMT
access-control-allow-origin: *
content-length: 142
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

tpid=BAD0F1C186764379A7E8F3E2C74AF371
bcp.crwdcntrl.net/map/c=7625/tp=SIMP/
Redirect Chain

https://um.simpli.fi/crwdcntrl
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=BAD0F1C186764379A7E8F3E2C74AF371

49 B
268 B

119ms
60ms

Image
image/gif

52.206.105.60
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=BAD0F1C186764379A7E8F3E2C74AF371

Protocol

Server

52.206.105.60 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-206-105-60.compute-1.amazonaws.com

Software

Resource Hash

2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
cache-control: no-cache
pragma: no-cache
expires: 0
access-control-allow-origin: *
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 49
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=BAD0F1C186764379A7E8F3E2C74AF371
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Wed, 10 Jun 2026 01:17:11 GMT
access-control-allow-origin: *
content-length: 142
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

merge
ce.lijit.com/
Redirect Chain

https://um.simpli.fi/lj_match
https://ce.lijit.com/merge?pid=2&3pid=BAD0F1C186764379A7E8F3E2C74AF371
https://ce.lijit.com/merge?pid=2&3pid=BAD0F1C186764379A7E8F3E2C74AF371&dnr=1

43 B
390 B

63ms
61ms

Image
image/gif

34.200.91.212
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=2&3pid=BAD0F1C186764379A7E8F3E2C74AF371&dnr=1
Protocol: H2
Server: 34.200.91.212 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-200-91-212.compute-1.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: image/gif
vary: Accept-Encoding

Redirect headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
location: https://ce.lijit.com/merge?pid=2&3pid=BAD0F1C186764379A7E8F3E2C74AF371&dnr=1
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 11 Jun 2026 01:17:11 GMT
vary: Accept-Encoding

GET
H3

200

db_sync
px.ads.linkedin.com/
Redirect Chain

https://um.simpli.fi/liveramp_match
https://idsync.rlcdn.com/419566.gif?partner_uid=BAD0F1C186764379A7E8F3E2C74AF371
https://pippio.com/api/sync?pid=5324&it=1&iv=8e61fa1d39d723952968e5a35ee5dd059b8cdb09414def0633ad1c292eb5df78791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=8e61fa1d39d723952968e5a35ee5dd059b8cdb09414def0633ad1c292eb5df78791426b5417dce21&rand=04931552

0
471 B

117ms
117ms

Image
text/plain

2606:4700:4407::ac40:92d7
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL

https://px.ads.linkedin.com/db_sync?pid=10339&puuid=8e61fa1d39d723952968e5a35ee5dd059b8cdb09414def0633ad1c292eb5df78791426b5417dce21&rand=04931552

Protocol

Server

2606:4700:4407::ac40:92d7 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

linkedin-action: 1
x-li-pop: cf-prod-lor1-x
strict-transport-security: max-age=31536000
cf-cache-status: DYNAMIC
x-li-fabric: prod-lor1
x-content-type-options: nosniff
cf-ray: a09cc6539d81438c-EWR
x-li-uuid: AAZT8B6lE4vFdilcz6l6cg==
x-li-proto: http/3
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 0
date: Thu, 11 Jun 2026 01:17:11 GMT
server: cloudflare
priority: u=3,i

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=8e61fa1d39d723952968e5a35ee5dd059b8cdb09414def0633ad1c292eb5df78791426b5417dce21&rand=04931552
via: 1.1 google
alt-svc: h3=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Thu, 11 Jun 2026 01:17:11 GMT

GET
H3

200

/
www.google.com/pagead/1p-conversion/1026675585/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/1026675585/?random=1781140631136&cv=7&fst=1781140631136&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=150185224&cv=7&fst=1781140631136&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLTe...
https://www.google.com/pagead/1p-conversion/1026675585/?random=150185224&cv=7&fst=1781140631136&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLTesQII8t-xAgit4bECCK7hs...

42 B
64 B

41ms
40ms

Image
image/gif

2001:4860:482c:7700::
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.com/pagead/1p-conversion/1026675585/?random=150185224&cv=7&fst=1781140631136&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLTesQII8t-xAgit4bECCK7hsQIIr-GxAgihuLECCLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgi0xrECCJPasQII29yxAgiH27ECCNPFsQII68yxAgjtzrECCNXPsQII9NqxAgjL47ECCK7lsQIIl9SxAgjJ27ECCLHhsQIIs-GxAgim3bECCLDesQIIgNuxAg&cerd=CgSk870t&fsk=ChEI8Jak0QYQ0vjt2LrIqfzCARIsAOdlATuPBcgZdJeQMHJGy4x2OFjKofzkJrJkzJ3a3dwx6YOtFRNA4n1P-roaAuvC&pscrd=IhMI0ov59IH-lAMVYmVHAR0xvC7DOhZodHRwczovL3JlZGNhbmFyeS5jb20vegwICWIICAAQABgAIAA&is_vtc=1&cid=CAQS-QEAEQoqgdEp22WjmOHbW0FmMo3NjHfe1Z2G7Gt4Xm42urQx3JuVVO1cOr3jYUansBLmBJKukTgexQMHYF5Lpikp1XggGZHp34lDr08Jxi1HOHJSFMezDqvVsWCpL4VqGlGJTHRL-rjmvinOtLvMxlj-WNCPaSOQsNIcuvtRTEAKdZGML4uXkYGwxrQPAlGTYUZ15z5I76f9D3rcyaVjNlncolduHc1uU55Gr-jaKQsfwL-8AeSc8qszfP3_lSEa_aJijFLgUorUgbf8d-0447C9ynQ-hLzbhtQ1_3SZ_m8LIWm60vXYCdKxHd4jkCNmg6wQBiV3we0RAe0&random=690000449

Protocol

Server

2001:4860:482c:7700:: , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 11 Jun 2026 01:17:11 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
location: https://www.google.com/pagead/1p-conversion/1026675585/?random=150185224&cv=7&fst=1781140631136&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLTesQII8t-xAgit4bECCK7hsQIIr-GxAgihuLECCLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgi0xrECCJPasQII29yxAgiH27ECCNPFsQII68yxAgjtzrECCNXPsQII9NqxAgjL47ECCK7lsQIIl9SxAgjJ27ECCLHhsQIIs-GxAgim3bECCLDesQIIgNuxAg&cerd=CgSk870t&fsk=ChEI8Jak0QYQ0vjt2LrIqfzCARIsAOdlATuPBcgZdJeQMHJGy4x2OFjKofzkJrJkzJ3a3dwx6YOtFRNA4n1P-roaAuvC&pscrd=IhMI0ov59IH-lAMVYmVHAR0xvC7DOhZodHRwczovL3JlZGNhbmFyeS5jb20vegwICWIICAAQABgAIAA&is_vtc=1&cid=CAQS-QEAEQoqgdEp22WjmOHbW0FmMo3NjHfe1Z2G7Gt4Xm42urQx3JuVVO1cOr3jYUansBLmBJKukTgexQMHYF5Lpikp1XggGZHp34lDr08Jxi1HOHJSFMezDqvVsWCpL4VqGlGJTHRL-rjmvinOtLvMxlj-WNCPaSOQsNIcuvtRTEAKdZGML4uXkYGwxrQPAlGTYUZ15z5I76f9D3rcyaVjNlncolduHc1uU55Gr-jaKQsfwL-8AeSc8qszfP3_lSEa_aJijFLgUorUgbf8d-0447C9ynQ-hLzbhtQ1_3SZ_m8LIWm60vXYCdKxHd4jkCNmg6wQBiV3we0RAe0&random=690000449
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 42
date: Thu, 11 Jun 2026 01:17:11 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 204 spotx_match
um.simpli.fi/ 0
272 B 29ms
27ms Image
text/plain 34.85.181.204
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://um.simpli.fi/spotx_match

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.85.181.204 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

204.181.85.34.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-methods: GET, POST, OPTIONS
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-origin: *
date: Thu, 11 Jun 2026 01:17:11 GMT
x-content-type-options: nosniff

GET
H2

200

bounce
ib.adnxs.com/
Redirect Chain

https://um.simpli.fi/an
https://ib.adnxs.com/setuid?entity=66&code=BAD0F1C186764379A7E8F3E2C74AF371
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D66%26code%3DBAD0F1C186764379A7E8F3E2C74AF371

43 B
1 KB

46ms
46ms

Image
image/gif

68.67.160.114
Xandr Inc.

General

Check archive.org

Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D66%26code%3DBAD0F1C186764379A7E8F3E2C74AF371

Protocol

Server

68.67.160.114 Feasterville, United States, ASN29990 (ASN-APPNEXUS - Xandr Inc., US),

Reverse DNS

672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.25.5 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 8.46.120.161; 8.46.120.161; 672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 3b618e6e-746a-49f3-8bac-a99822678e70
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 11 Jun 2026 01:17:11 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.25.5

Redirect headers

cache-control: no-store, no-cache, private
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D66%26code%3DBAD0F1C186764379A7E8F3E2C74AF371
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 8.46.120.161; 8.46.120.161; 672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 592df051-08e2-4952-b244-725bc12a298e
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 11 Jun 2026 01:17:11 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.25.5

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://um.simpli.fi/rb_match
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=BAD0F1C186764379A7E8F3E2C74AF371&expires=365

42 B
1 KB

84ms
27ms

Image
image/gif

216.19.192.2
Magnite

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=BAD0F1C186764379A7E8F3E2C74AF371&expires=365
Protocol: HTTP/1.1
Server: 216.19.192.2 , United States, ASN26667 (RUBICONPROJECT - Magnite, Inc., US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 9e3e08ff63639bca362d98e214d3a1da
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=BAD0F1C186764379A7E8F3E2C74AF371&expires=365
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Wed, 10 Jun 2026 01:17:11 GMT
access-control-allow-origin: *
content-length: 142
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://um.simpli.fi/ox_match
https://us-u.openx.net/w/1.0/sd?id=537072966&val=BAD0F1C186764379A7E8F3E2C74AF371
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=BAD0F1C186764379A7E8F3E2C74AF371

43 B
171 B

42ms
38ms

Image
image/gif

34.98.64.218
Google LLC

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=BAD0F1C186764379A7E8F3E2C74AF371
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 8.46.120.161
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: image/gif
vary: Accept

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=BAD0F1C186764379A7E8F3E2C74AF371
x-forwarded-for: 8.46.120.161
via: 1.1 google
alt-svc: h3=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 51 KB
21 KB 73ms
20ms Script
text/javascript 2607:f8b0:4004:c23::65
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c23::65 Washington, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

f1a61277e3f902f50ab42015d8b07218db9b7601bb0967e54a52bfdcb4fa7e81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
age: 5775
report-to: {"group":"ascnsrsgac:225:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Thu, 11 Jun 2026 01:40:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 10 Jun 2026 23:40:56 GMT
last-modified: Tue, 15 Jul 2025 00:44:26 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:225:0
content-length: 20802
server: Golfe2

GET
H2 200 favicon.ico
redcanary.com/wp-content/themes/redcanary/assets/img/ 1 KB
866 B 59ms
48ms Other
image/x-icon 104.198.136.223
Google LLC

General

Check archive.org

Download Go to

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/img/favicon.ico

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

c3096f016b56aa58ea27707e5636618495175ed50b77c09b91c9cb5c014b79e2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/threat-detection-report/threats/bloodhound/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
cache-control: public, max-age=31536000
content-encoding: gzip
etag: W/"65e68ad0-47e"
access-control-allow-origin: *
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: image/x-icon
last-modified: Tue, 05 Mar 2024 03:00:32 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding

GET
H2 200 favicon-32x32.png
redcanary.com/wp-content/themes/redcanary/assets/img/ 1 KB
2 KB 53ms
52ms Other
image/png 104.198.136.223
Google LLC

General

Check archive.org

Download Go to

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/img/favicon-32x32.png

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

a19b17e3c318b115a7531fd404bd12a49d65104d57a1efd064f5ae80b457f52f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/threat-detection-report/threats/bloodhound/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
cache-control: public, max-age=31536000
etag: "65e68ad0-5c9"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1481
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: image/png
last-modified: Tue, 05 Mar 2024 03:00:32 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
199 B 31ms
30ms Image
image/gif 23.221.227.208
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=caa089a0-4c52-4ccd-8b97-ec15ad0f4cff&session=a6d31a46-0bbd-44ca-81c2-dfd8a31aebc7&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2011%20Jun%202026%2001%3A17%3A11%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2011%20Jun%202026%2001%3A17%3A10%20GMT%22%2C%22timeSpent%22%3A%221009%22%2C%22totalTimeSpent%22%3A%221009%22%7D&isIframe=false&m=%7B%22description%22%3A%22BloodHound%20is%20an%20open%20source%20tool%20that%20provides%20visibility%20into%20Active%20Directory%20environments%20and%20is%20a%20precursor%20to%20follow-on%20activity.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22BloodHound%20-%20Red%20Canary%20Threat%20Detection%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&pageViewId=02ded34b-21b4-41e7-845c-1009235b3888&an_uid=0&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A1900%3A2200%3A4e41%3A%3A161&v=1.1.31

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.221.227.208 Sterling, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-221-227-208.deploy.static.akamaitechnologies.com

Software

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 11 Jun 2026 01:17:11 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 11 Jun 2026 01:17:11 GMT
content-type: image/gif

POST
H/1.1 204
No Content collect Show response
v.clarity.ms/ 0
277 B 78ms
76ms XHR
text/plain 52.242.103.142
Microsoft Corpora...

General

Check archive.org

Download Go to

Full URL: https://v.clarity.ms/collect
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 52.242.103.142 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Accept: application/x-clarity-gzip
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Request-Context: appId=cid-v1:a449a586-8786-487f-a449-dc1b282a2628
Access-Control-Allow-Origin: https://redcanary.com
Date: Thu, 11 Jun 2026 01:17:12 GMT
Vary: Origin
Server: nginx
Connection: keep-alive
Access-Control-Allow-Credentials: true

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
199 B 30ms
30ms Image
image/gif 23.221.227.208
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=76c84a8d-5608-404f-8d90-eaa6828103a8&session=b4164059-0393-409c-83f9-2bc0d60cb29f&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2011%20Jun%202026%2001%3A17%3A12%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2011%20Jun%202026%2001%3A17%3A11%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%222011%22%7D&isIframe=false&m=%7B%22description%22%3A%22BloodHound%20is%20an%20open%20source%20tool%20that%20provides%20visibility%20into%20Active%20Directory%20environments%20and%20is%20a%20precursor%20to%20follow-on%20activity.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22BloodHound%20-%20Red%20Canary%20Threat%20Detection%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&pageViewId=02ded34b-21b4-41e7-845c-1009235b3888&an_uid=0&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A1900%3A2200%3A4e41%3A%3A161&v=1.1.31

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.221.227.208 Sterling, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-221-227-208.deploy.static.akamaitechnologies.com

Software

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 11 Jun 2026 01:17:12 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 11 Jun 2026 01:17:12 GMT
content-type: image/gif

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
199 B 83ms
83ms Image
image/gif 23.221.227.208
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=64668642-9c4a-4c65-8567-b976adc9e1da&session=a34efb0b-1549-4f25-8dc1-34c27f993a04&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2011%20Jun%202026%2001%3A17%3A13%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2011%20Jun%202026%2001%3A17%3A12%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%223014%22%7D&isIframe=false&m=%7B%22description%22%3A%22BloodHound%20is%20an%20open%20source%20tool%20that%20provides%20visibility%20into%20Active%20Directory%20environments%20and%20is%20a%20precursor%20to%20follow-on%20activity.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22BloodHound%20-%20Red%20Canary%20Threat%20Detection%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&pageViewId=02ded34b-21b4-41e7-845c-1009235b3888&an_uid=0&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A1900%3A2200%3A4e41%3A%3A161&v=1.1.31

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.221.227.208 Sterling, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-221-227-208.deploy.static.akamaitechnologies.com

Software

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 11 Jun 2026 01:17:13 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 11 Jun 2026 01:17:13 GMT
content-type: image/gif

GET
H2 200 d23c0c4e194430380ef64982f7fd6ecf318cd5881017bc61dec0ef8955cc0079.png
messenger-assets.qualified.com/uploads/ Frame F8DF 13 KB
13 KB 50ms
41ms Image
image/png 104.18.16.5
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://messenger-assets.qualified.com/uploads/d23c0c4e194430380ef64982f7fd6ecf318cd5881017bc61dec0ef8955cc0079.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.16.5 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9a586f0b3e8add35ad17a2eec2cee97cbe175f48d7c47e34492dd973aa0f8381

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://app.qualified.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-amz-id-2: UU3Hn0gkEBkdjDBtoW5eNJvUviiJYeagFOKQVh4JRDwWhLhV+BYnq3oy/oJa8tBLkII8btqax5ALOrb+EWAsRtf7WWHXuwqZ
cache-control: Cache-Control: public, max-age=31536000
cf-cache-status: HIT
etag: "fd481ec600c1b3fad6f9e29aa732a946"
x-amz-version-id: null
age: 2986514
x-amz-request-id: 6TF0FFH2EQW6W03K
cf-ray: a09cc665fa93f4bf-EWR
accept-ranges: bytes
content-length: 12932
date: Thu, 11 Jun 2026 01:17:14 GMT
content-type: image/png
last-modified: Thu, 20 Oct 2022 23:47:27 GMT
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
199 B 30ms
29ms Image
image/gif 23.221.227.208
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=652765c0-85a2-43e9-87ba-2acf23f66336&session=699e8ac4-e348-486f-8711-b8cffcef8ca7&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2011%20Jun%202026%2001%3A17%3A14%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2011%20Jun%202026%2001%3A17%3A13%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%224016%22%7D&isIframe=false&m=%7B%22description%22%3A%22BloodHound%20is%20an%20open%20source%20tool%20that%20provides%20visibility%20into%20Active%20Directory%20environments%20and%20is%20a%20precursor%20to%20follow-on%20activity.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22BloodHound%20-%20Red%20Canary%20Threat%20Detection%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&pageViewId=02ded34b-21b4-41e7-845c-1009235b3888&an_uid=0&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A1900%3A2200%3A4e41%3A%3A161&v=1.1.31

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.221.227.208 Sterling, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-221-227-208.deploy.static.akamaitechnologies.com

Software

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 11 Jun 2026 01:17:14 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 11 Jun 2026 01:17:14 GMT
content-type: image/gif

GET
H2 200 b34302d7d25df402909dab75f43c994eaa9697d42e982abeee77e1d6cb8e2697.png
messenger-assets.qualified.com/uploads/ Frame F8DF 13 KB
13 KB 58ms
57ms Image
image/png 104.18.16.5
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://messenger-assets.qualified.com/uploads/b34302d7d25df402909dab75f43c994eaa9697d42e982abeee77e1d6cb8e2697.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.16.5 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 00bbc66153e493c73e6ee4448a25fac555d74e1fd957f6f804754ff27bb9884f

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://app.qualified.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-amz-id-2: ATf1Rb8wg2K1x1fIHexka7xom3+vbpCxUrDltBd7xi1G+L8m/axgG31M2j7ynUrBJb82oN55msQ=
cache-control: Cache-Control: public, max-age=31536000
cf-cache-status: HIT
etag: "7797b96a7f999ac42de528bede3329af"
x-amz-version-id: null
age: 4797535
x-amz-request-id: AS9NT6HWKFGWHQXS
cf-ray: a09cc6666c19f4bf-EWR
accept-ranges: bytes
content-length: 13099
date: Thu, 11 Jun 2026 01:17:14 GMT
content-type: image/png
last-modified: Thu, 20 Oct 2022 23:48:08 GMT
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 Inter-roman.var.b2129c00.woff2
assets.qualified.com/packs/media/ Frame F8DF 222 KB
222 KB 16ms
15ms Font
font/woff2 104.18.16.5
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://assets.qualified.com/packs/media/Inter-roman.var.b2129c00.woff2
Requested by: Host: assets.qualified.com
URL: https://assets.qualified.com/packs/css/widget/sandboxed/messenger-9fcbda82.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.16.5 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 17fe38ab302c7e5dbfb5c3d87801092d79be958500db6412ed3bc0f126bd53d3

Request headers

Origin: https://app.qualified.com
sec-ch-ua-platform: "Linux"
Referer: https://assets.qualified.com/packs/css/widget/sandboxed/messenger-9fcbda82.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 3600
access-control-expose-headers: ETag, Last-Modified, Cache-Control, Expires, CF-Cache-Status, CF-Ray
cf-cache-status: HIT
etag: "66c6e40883646a7ad993108b2ce2da32"
x-amz-version-id: null
age: 1978
access-control-allow-methods: GET, HEAD
date: Thu, 11 Jun 2026 01:17:14 GMT
content-type: font/woff2
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
last-modified: Fri, 20 Feb 2026 05:43:46 GMT
x-amz-id-2: G3qG81MrK1slrbPdYgmfpgiG/wstvIVUsuPARiiU5V9NF19TQcKsP1uE3FEsM5coHrdwI7J+j0E=
x-amz-request-id: 3ZGNGGF44QTWJP5Q
cf-ray: a09cc666a9a4b7a0-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 227180
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
199 B 25ms
24ms Image
image/gif 23.221.227.208
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=8e0e2c65-a7bc-465d-8817-1f283f86d262&session=f7d41977-93ae-448b-8785-de9715ee64cb&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2011%20Jun%202026%2001%3A17%3A15%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2011%20Jun%202026%2001%3A17%3A14%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%225019%22%7D&isIframe=false&m=%7B%22description%22%3A%22BloodHound%20is%20an%20open%20source%20tool%20that%20provides%20visibility%20into%20Active%20Directory%20environments%20and%20is%20a%20precursor%20to%20follow-on%20activity.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22BloodHound%20-%20Red%20Canary%20Threat%20Detection%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&pageViewId=02ded34b-21b4-41e7-845c-1009235b3888&an_uid=0&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A1900%3A2200%3A4e41%3A%3A161&v=1.1.31

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.221.227.208 Sterling, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-221-227-208.deploy.static.akamaitechnologies.com

Software

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 11 Jun 2026 01:17:15 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 11 Jun 2026 01:17:15 GMT
content-type: image/gif

POST
H/1.1 204
No Content collect Show response
v.clarity.ms/ 0
277 B 80ms
78ms XHR
text/plain 52.242.103.142
Microsoft Corpora...

General

Check archive.org

Download Go to

Full URL: https://v.clarity.ms/collect
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 52.242.103.142 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Accept: application/x-clarity-gzip
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Request-Context: appId=cid-v1:a449a586-8786-487f-a449-dc1b282a2628
Access-Control-Allow-Origin: https://redcanary.com
Date: Thu, 11 Jun 2026 01:17:16 GMT
Vary: Origin
Server: nginx
Connection: keep-alive
Access-Control-Allow-Credentials: true

GET
H2 200 36597172da201e0245198e782ac8110b4b382b998c6ebf785b48ebf4391cd2e6.png
messenger-assets.qualified.com/uploads/7TUwM7shunt8z54WksUhaTzw8iRAHyAXobDVq/ Frame F8DF 6 KB
7 KB 20ms
20ms Image
image/png 104.18.16.5
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://messenger-assets.qualified.com/uploads/7TUwM7shunt8z54WksUhaTzw8iRAHyAXobDVq/36597172da201e0245198e782ac8110b4b382b998c6ebf785b48ebf4391cd2e6.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.16.5 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0080f70311e3286762561240b121921a1d618720b1172a31d61d3beb6bcf8d66

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://app.qualified.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-amz-id-2: Q74W00JtGM/d6oT5goD90zzCyqs6/3FOp8mKnqNkY1LL5VrFCrUJXI+ptr9vav31orj5MAQ5U4uYSGTAfQQ/iDdIf+udgrAl
cache-control: Cache-Control: public, max-age=31536000
cf-cache-status: HIT
etag: "b7c22f4d4999b7304a437963a9a96fb1"
x-amz-version-id: xX2R1yN8sWeojkKv6ZH6r1vchP2yfC68
age: 9611520
x-amz-request-id: H5PH0D3TY4XB11KT
cf-ray: a09cc6728ed4f4bf-EWR
accept-ranges: bytes
content-length: 6613
date: Thu, 11 Jun 2026 01:17:16 GMT
content-type: image/png
last-modified: Wed, 23 Apr 2025 16:20:51 GMT
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
199 B 137ms
137ms Image
image/gif 23.221.227.208
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=d41ed03b-44d5-48d3-8767-80a39a256684&session=9fd9e687-d6ba-4d5c-86f9-d07d2093ac9b&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2011%20Jun%202026%2001%3A17%3A16%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2011%20Jun%202026%2001%3A17%3A15%20GMT%22%2C%22timeSpent%22%3A%221009%22%2C%22totalTimeSpent%22%3A%226028%22%7D&isIframe=false&m=%7B%22description%22%3A%22BloodHound%20is%20an%20open%20source%20tool%20that%20provides%20visibility%20into%20Active%20Directory%20environments%20and%20is%20a%20precursor%20to%20follow-on%20activity.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22BloodHound%20-%20Red%20Canary%20Threat%20Detection%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fbloodhound%2F&pageViewId=02ded34b-21b4-41e7-845c-1009235b3888&an_uid=0&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A1900%3A2200%3A4e41%3A%3A161&v=1.1.31

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.221.227.208 Sterling, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-221-227-208.deploy.static.akamaitechnologies.com

Software

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 11 Jun 2026 01:17:16 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 11 Jun 2026 01:17:16 GMT
content-type: image/gif

GET
H2 206 message-initial.5b361893.mp3
app.qualified.com/packs/media/ 4 KB
4 KB 19ms
19ms Media
audio/mpeg 104.18.17.5
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://app.qualified.com/packs/media/message-initial.5b361893.mp3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.17.5 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b0e68448445650736443211f1299b8c9177fb8052356ed7d1249295c15be26a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Range: bytes=0-
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=63072000; includeSubDomains
cf-cache-status: HIT
x-envoy-upstream-service-time: 3
age: 3305
Content-Range: bytes 0-4341/4342
cf-ray: a09cc6728fcaf569-EWR
x-cache: miss
Content-Length: 4342
date: Thu, 11 Jun 2026 01:17:16 GMT
content-type: audio/mpeg
last-modified: Wed, 10 Jun 2026 19:29:14 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 favicon-96x96.png
redcanary.com/wp-content/themes/redcanary/assets/img/ 5 KB
5 KB 55ms
55ms Other
image/png 104.198.136.223
Google LLC

General

Check archive.org

Download Go to

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/img/favicon-96x96.png

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

2c890f14e6e59d6d1a6ef3ee6b99ba28ca3256c9ee8c21ab663372553f275a73

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://redcanary.com/threat-detection-report/threats/bloodhound/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
cache-control: public, max-age=31536000
etag: "65e68ad0-129a"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4762
date: Thu, 11 Jun 2026 01:17:16 GMT
content-type: image/png
last-modified: Tue, 05 Mar 2024 03:00:32 GMT
server: nginx
vary: Accept-Encoding

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s.ml-attr.com
URL: https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID

Domain: ups.analytics.yahoo.com
URL: https://ups.analytics.yahoo.com/ups/55964/sync?uid=BAD0F1C186764379A7E8F3E2C74AF371&verify=true

Verdicts & Comments Add Verdict or Comment

108 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

103 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
tracking.intentsify.io/page-tracking/intentsify-redcanary	1970-01-22 00:21:40	Name: userId Value: e22feff5-ba40-47b6-bf49-ff9a0923d2c4
.resource.redcanary.com/	1970-01-21 14:45:42	Name: __cf_bm Value: xMWnl4LYxa4V3zlPhg9Gj7qs9pYPkKvoxwambolxyQ8-1781140627.5486305-1.0.1.1-4VypirMkGC53yY4BLZVSmnfzOgiPqxNfthRTFc4DWWdulb4cB5wbK8RGHyhYwj7xjJckMpyEyNhPpLhpFuRyqhCmwlpw_LQ8T2e.pOTCeaQEZ36a6kFJ7xY2MXq9mH8K
.g2crowd.com/	1970-01-21 14:45:42	Name: __cf_bm Value: A2c3VsaJjkLOel8AwrKJmoC2h5x9vtOxcH_8OwgvTJA-1781140627.8634777-1.0.1.1-x8806oGlToo6qTmDaSp0W2yv05.BKm6HRO3Z8z785kfCxUbN9KAvnK409Kmuh3T3hJDMS4bY0llexrqUbaucETgMn80vjZdbbuPqYXwws9v7RIfrls7_Uhmvw97g_GZr
redcanary.com/	1970-01-21 14:45:44	Name: utm_session_set Value: true
.bizible.com/	1970-01-21 23:31:16	Name: _BUID Value: 1ed7fede4b70443bedbeb730001ce892
.g2.com/	1970-01-21 14:45:42	Name: __cf_bm Value: 4LgteHYMh9N_HTs2HPPTf84WcrrXx.B0B3KdmIe7WFk-1781140629.1914449-1.0.1.1-sobD8a_IqPt2SDOObWqrK8zDzXV.VQBtDfBhFep1k8F5Frlr5rLYj.Ri6UQKemPpODkIhHsFB_JbnW6I7YGCqooeyYmD6a5McO23zJs2gFcXiv2dtc3FzerBMj6miPl8
resource.redcanary.com/	1969-12-31 23:59:59	Name: BIGipServer~VS65000-N117~mlm-core-web-0028-prod_9080 Value: !qDuj6FYU8Ny9nEAMoDsz2spDmQZJZCPGqXvnY0CVlN5THVHUsqpZLe7arIZXgw0YZZT9Jj9H6LB5+sqSMLfyZk+SJUKKPTl1qmohi/W1qJcKxw==
.doubleclick.net/	1970-01-22 00:21:40	Name: IDE Value: AHWqTUlKM0QHSmuoOMSohZiGDfm0CbuKQiP2dKA5Mm9mqs8laXknowtewjSg97u1
.simpli.fi/	1970-01-21 23:32:43	Name: suid Value: BAD0F1C186764379A7E8F3E2C74AF371
.redcanary.com/	1970-01-21 14:47:07	Name: _uetsid Value: 449a64a0653311f19d37612a68f5dc31
.redcanary.com/	1970-01-22 00:07:16	Name: _uetvid Value: 449a9340653311f190788352bf10d27e
.bing.com/	1970-01-22 00:07:16	Name: MUID Value: 0D0CCACBBD6762AF26ACDDBEBCA56351
.bat.bing.com/	1970-01-21 14:55:45	Name: MR Value: 0
.redcanary.com/	1970-01-21 23:31:16	Name: rly_consent_app-b971e13b-6813-58b1-95be-36a12d8eb337 Value: eyJtb2RlbCI6IkNPTlNFTlRfTU9ERUxfT1BUSU9OU19PUFRfSU4iLCJjb25zZW50UHVycG9zZXMiOlt7InB1cnBvc2VJZCI6IlBST0NFU1NJTkdfQUNUSVZJVFlfUEVSU09OQUxJWkFUSU9OIiwibmFtZSI6IlBlcnNvbmFsaXphdGlvbiIsInZpc2libGUiOnRydWUsImNoZWNrZWQiOmZhbHNlLCJhbHdheXNBY3RpdmUiOmZhbHNlfSx7InB1cnBvc2VJZCI6IlBST0NFU1NJTkdfQUNUSVZJVFlfREFUQV9QUk9URUNUSU9OIiwibmFtZSI6IkRhdGEgUHJvdGVjdGlvbiIsInZpc2libGUiOnRydWUsImNoZWNrZWQiOmZhbHNlLCJhbHdheXNBY3RpdmUiOmZhbHNlfSx7InB1cnBvc2VJZCI6IlBST0NFU1NJTkdfQUNUSVZJVFlfQURWRVJUSVNJTkciLCJuYW1lIjoiQWR2ZXJ0aXNpbmciLCJ2aXNpYmxlIjp0cnVlLCJjaGVja2VkIjpmYWxzZSwiYWx3YXlzQWN0aXZlIjpmYWxzZX0seyJwdXJwb3NlSWQiOiI2OTk2MWJmMzI3Yzg3ZGIyZTg2ZDc5ZDAiLCJuYW1lIjoiUGVyZm9ybWFuY2UiLCJ2aXNpYmxlIjp0cnVlLCJjaGVja2VkIjpmYWxzZSwiYWx3YXlzQWN0aXZlIjpmYWxzZX0seyJwdXJwb3NlSWQiOiJQUk9DRVNTSU5HX0FDVElWSVRZX0RBVEFfQU5BTFlUSUNTIiwibmFtZSI6IkRhdGEgQW5hbHl0aWNzIiwidmlzaWJsZSI6dHJ1ZSwiY2hlY2tlZCI6ZmFsc2UsImFsd2F5c0FjdGl2ZSI6ZmFsc2V9LHsicHVycG9zZUlkIjoiUFJPQ0VTU0lOR19BQ1RJVklUWV9TVFJJQ1RMWV9ORUNFU1NBUlkiLCJuYW1lIjoiU3RyaWN0bHkgTmVjZXNzYXJ5IiwidmlzaWJsZSI6dHJ1ZSwiY2hlY2tlZCI6dHJ1ZSwiYWx3YXlzQWN0aXZlIjp0cnVlfSx7InB1cnBvc2VJZCI6IlBST0NFU1NJTkdfQUNUSVZJVFlfREFUQV9DT0xMRUNUSU9OIiwibmFtZSI6IkRhdGEgQ29sbGVjdGlvbiIsInZpc2libGUiOnRydWUsImNoZWNrZWQiOmZhbHNlLCJhbHdheXNBY3RpdmUiOmZhbHNlfSx7InB1cnBvc2VJZCI6IjY5OTYxYzE2MjdjODdkYjJlODZkNzlkMiIsIm5hbWUiOiJUYXJnZXRpbmciLCJ2aXNpYmxlIjp0cnVlLCJjaGVja2VkIjpmYWxzZSwiYWx3YXlzQWN0aXZlIjpmYWxzZX0seyJwdXJwb3NlSWQiOiJQUk9DRVNTSU5HX0FDVElWSVRZX01BUktFVElOR19DQU1QQUlHTlMiLCJuYW1lIjoiTWFya2V0aW5nIENhbXBhaWducyIsInZpc2libGUiOnRydWUsImNoZWNrZWQiOmZhbHNlLCJhbHdheXNBY3RpdmUiOmZhbHNlfSx7InB1cnBvc2VJZCI6IjY5OTYxYmMzYjk2ZmY3Yjk4MjM1MzI3MyIsIm5hbWUiOiJGdW5jdGlvbmFsIiwidmlzaWJsZSI6dHJ1ZSwiY2hlY2tlZCI6ZmFsc2UsImFsd2F5c0FjdGl2ZSI6ZmFsc2V9LHsicHVycG9zZUlkIjoiUFJPQ0VTU0lOR19BQ1RJVklUWV9NQVJLRVRJTkciLCJuYW1lIjoiTWFya2V0aW5nIiwidmlzaWJsZSI6dHJ1ZSwiY2hlY2tlZCI6ZmFsc2UsImFsd2F5c0FjdGl2ZSI6ZmFsc2V9XSwidGltZXN0YW1wIjoxNzgxMTQwNjI5NDgwLCJjb25zZW50U3RvcmFnZUVuYWJsZWQiOmZhbHNlLCJpc0RlZmF1bHRDb25zZW50Ijp0cnVlfQ%3D%3D
www.clarity.ms/	1970-01-21 23:31:16	Name: CLID Value: fb5c7dcd1b214f65a48773a512cb60e4.20260611.20270611
.redcanary.com/	1970-01-22 00:07:16	Name: _twpid Value: tw.1781140629617.278865766192623632
.twitter.com/	1970-01-22 00:21:40	Name: guest_id_marketing Value: v1%3A178114062968814560
.twitter.com/	1970-01-22 00:21:40	Name: guest_id_ads Value: v1%3A178114062968814560
.twitter.com/	1970-01-22 00:21:40	Name: personalization_id Value: "v1_sAwYLmufjtllOzONyjVNSw=="
.twitter.com/	1970-01-22 00:21:40	Name: guest_id Value: v1%3A178114062968814560
.twitter.com/	1970-01-21 14:45:42	Name: __cf_bm Value: U5H_rHVidImF0IwqfwWaouU_wjHY0eicWIXIJ4bK9hU-1781140629.670723-1.0.1.1-CpIA56J.NlcQaZSNj_GGCbZvXjIzjGcwtL77.gfjq3lwRAZ.zy2S.WsfnFO2kQdceF0RH__BGT6FMRbuBjPxyome2.4VCZDXzu56ceEp6y3LMNyDh3h0O1b92fA_7yyP
.t.co/	1970-01-22 00:21:40	Name: muc_ads Value: e4bb60e8-ee6a-4905-9aaf-83a5db71a209
.t.co/	1970-01-21 14:45:42	Name: __cf_bm Value: YtYIoEoov3F1LosJeQLBlmyz0tsczTQ0Dty0008iw_o-1781140629.67598-1.0.1.1-9ClHhKzIYh0B5KiR4bnfAFJmlfDRxHmSBqYD9DtIFa.wt.ySERnBoyCH7YHmXKZcm1UlAMsM9O07JmtjNesgFkU7thvR8nfilxoljo6WA1EN31shv7MD9Z2CY0JumXL0
.a.usbrowserspeed.com/	1970-01-21 23:31:16	Name: tuid Value: fe61c237-7302-4004-b3e9-161e4d486e7e
.bttrack.com/	1970-01-21 16:55:16	Name: GLOBALID Value: 2uKlc8-sIBd5-bFnX3q_HeB9eQ8CXyqCC3E4nXPII7sOPEFocIu7KfrNZR_X545WImr2Zl_pcZQC4TM1
.sitescout.com/	1970-01-21 23:31:16	Name: ssi Value: b03d89eb-d60b-4fd8-b177-462ca43604af#1781140630291
.sitescout.com/	1970-01-21 15:28:52	Name: _ssuma Value: eyIyIjoxNzgxMTQwNjMwMzIwLCI0IjoxNzgxMTQwNjMwMzIwLCIzOSI6MTc4MTE0MDYzMDMyMCwiNyI6MTc4MTE0MDYzMDMyMCwiOCI6MTc4MTE0MDYzMDMyMH0
.demdex.net/	1970-01-21 19:04:52	Name: demdex Value: 57534623465189073342701526445687611624
.exelator.com/	1970-01-21 17:38:28	Name: EE Value: "856e56e89294fe345517532eb3ea668b"
.linkedin.com/	1970-01-21 16:55:16	Name: li_sugr Value: 56ff73b6-b543-4045-9434-a591c2506620
.tapad.com/	1970-01-21 16:12:04	Name: TapAd_TS Value: 1781140630662
.tapad.com/	1970-01-21 16:12:04	Name: TapAd_DID Value: a7440f39-29ac-4421-8483-280d4e685e32
.crwdcntrl.net/	1970-01-21 21:14:27	Name: _cc_dc Value: 0
.crwdcntrl.net/	1970-01-21 21:14:27	Name: _cc_id Value: 71618d8e8f255819887d828beab6d651
.crwdcntrl.net/	1970-01-21 21:14:28	Name: _cc_cc Value: "ACZ4nGNQMDc0M7RIsUi1SDMyNbUwtLSwME%2BxMLJISk1MMksxMzVkAIIsLZ5pDHDAc%2B%2BDJeNbLob%2FjIwMJ08esICxzy%2BewwJjnzt6iBnGPowk3r7uKTeMfePUIzYYu%2BG%2FJox5r0sLxryEpOLNzANMMPbvjVPgJgIAwvI7WQ%3D%3D"
.crwdcntrl.net/	1970-01-21 21:14:28	Name: _cc_aud Value: "ABR4nGNgYGDI0uKZxgAHAA8CATc%3D"
.linkedin.com/	1970-01-21 15:28:52	Name: UserMatchHistory Value: AQIQUP_u_vMT6gAAAZ60QSy9KHQ6Y-YXYim2DwtLuDMXAnMDLcDGO8ei-koNr98z6ASy9ACtJ9DSig
.linkedin.com/	1970-01-21 15:28:52	Name: AnalyticsSyncHistory Value: AQJWpI8Qsuu6HwAAAZ60QSy9AaPGe796YxHqLMIP8ZzwtJQFdKUst8o8FvC0H3w_v0lVcD0ePjWvIQ_JuqW5-Q
.exelator.com/	1970-01-21 17:38:28	Name: ud Value: "eJxrXxzq6XKLQcHC1CwViCwsjSxN0lKNTUxNDc1NjY1Sk4xTE83MLJIWl6UWLVhaWpyaknRoSUVOSU7T6rL4UMd4N0dfT5%252FIZc4ZRfm5qSvAQmGuQYsNTSyX5Bdlpi8KDV5clJLGsKik%252BFTw%252BShFAHgVKZA%253D"
.dpm.demdex.net/	1970-01-21 19:04:52	Name: dpm Value: 57534623465189073342701526445687611624
.tapad.com/	1970-01-21 16:12:04	Name: TapAd_3WAY_SYNCS Value:
.linkedin.com/	1970-01-21 23:31:16	Name: bcookie Value: "v=2&50c8620b-0448-4ea8-8d5d-ab9546c48729"
.linkedin.com/	1970-01-21 14:47:07	Name: lidc Value: "b=OGST09:s=O:r=O:a=O:p=O:g=3387:u=1:x=1:i=1781140630:t=1781227030:v=2:sig=AQGNz9TiQSdGNcAS1FN07GHOUMuPdzDZ"
redcanary.com/	1970-01-21 14:55:45	Name: _an_uid Value: 0
.www.linkedin.com/	1970-01-21 23:31:16	Name: bscookie Value: "v=1&202606110117108c926dd6-5629-4a7a-8373-813488bc835bAQH3FQWlP79kjl8OPYa2MmshXNv2rfqu"
.simpli.fi/	1970-01-21 14:55:45	Name: uid_syncd_secure Value: true
.1rx.io/	1970-01-21 23:31:16	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-b544f06f-2021-4524-be56-659b06ea0565-005%22%7D
.eyeota.net/	1970-01-21 23:31:16	Name: mako_uid Value: 19eb4412f1a-4e7e0000010a491f
.eyeota.net/	1970-01-21 14:45:41	Name: SERVERID Value: 18719~DM
.ml314.com/	1970-01-21 14:45:40	Name: u Value: aHR0cHM6Ly9yZWRjYW5hcnkuY29tLw%3D%3D
.ml314.com/	1970-01-21 23:31:16	Name: pi Value: 3517605950054727722
.smaato.net/	1970-01-21 15:15:55	Name: SCM Value: 918f30da07
.smaato.net/	1970-01-21 15:15:55	Name: SCM675 Value: 918f30da07
.smaato.net/	1970-01-21 15:15:55	Name: SCMaps Value: 918f30da07
.adnxs.com/	1970-01-21 16:55:16	Name: XANDR_PANID Value: QA2LApLRcxDaO9DqgKpIYQ9WfC-8OepXgBy8DPHarDivlvu90GBWYQBDWBHChp070R83WLtKlspQ7j1SD_3bP1_d2Mls6pd1xdpFu_8SJEo.
.adnxs.com/	1970-01-21 16:55:16	Name: uuid2 Value: 2414869088685507809
.pubmatic.com/	1970-01-21 15:28:52	Name: KRTBCOOKIE_148 Value: 19421-uid:BAD0F1C186764379A7E8F3E2C74AF371&KRTB&23489-uid:BAD0F1C186764379A7E8F3E2C74AF371&KRTB&23539-uid:BAD0F1C186764379A7E8F3E2C74AF371&KRTB&23824-uid:BAD0F1C186764379A7E8F3E2C74AF371
.pubmatic.com/	1970-01-21 15:28:52	Name: PugT Value: 1781140631
.adnxs.com/	1970-01-21 16:55:16	Name: anj Value: dTM7k!M4.FE:2jUF']wIg2GU(iyP9)!]tbPl1N!7On*M$=BWeyeTFfJl!MY`lx!cmlx]Y-jabWejbCK!e9qncljdHXgW>wM/X%W#.wL4W1Qw1KXK2YR
.3lift.com/	1970-01-21 16:55:16	Name: tluid Value: 1833425483510791072870
.rubiconproject.com/	1970-01-21 23:31:16	Name: audit_p Value: 1\|EeX8abxpxzY0+qkHW/gyBRLaVLxNtjUyiqcufb/yrthirsSQmqSYeGHtRUWjgosF+Y85P72LITWM1KxoLazIt04KBbjzRD/Y5dDZuxGLGk/z2/2wsk68toC8WLMmKpd+sOv4+jf9sOYJR+FIVVxJJtWzlB6rjAz4SpxNqhhzGypRm99a3bMoP35/bkYCLFZe
.rubiconproject.com/	1970-01-21 23:31:16	Name: khaos Value: MQ8T56YH-1P-LCXS
.rubiconproject.com/	1970-01-21 23:31:16	Name: khaos_p Value: MQ8T56YH-1P-LCXS
.rubiconproject.com/	1970-01-21 23:31:16	Name: audit Value: 1\|EeX8abxpxzY0+qkHW/gyBRLaVLxNtjUyiqcufb/yrthirsSQmqSYeGHtRUWjgosF+Y85P72LITWM1KxoLazIt04KBbjzRD/Y5dDZuxGLGk/z2/2wsk68toC8WLMmKpd+sOv4+jf9sOYJR+FIVVxJJtWzlB6rjAz4SpxNqhhzGypRm99a3bMoP35/bkYCLFZe
.rubiconproject.com/	1970-01-21 16:55:16	Name: receive-cookie-deprecation Value: 1
.fwmrm.net/	1970-01-21 19:04:52	Name: _uid Value: ume96b9_7651158331924512002
.lijit.com/	1970-01-21 23:31:16	Name: ljt_reader Value: M0Nt0QZHMKKc3_jWToaAd6R8
.bidswitch.net/	1970-01-21 23:31:16	Name: tuuid Value: 410650b0-a7b0-4a9a-a6c7-092a4ecec8c6
.bidswitch.net/	1970-01-21 23:31:16	Name: c Value: 1781140631
.bidswitch.net/	1970-01-21 23:31:16	Name: tuuid_lu Value: 1781140631
.agkn.com/	1970-01-21 23:31:16	Name: ab Value: 0001%3AY4VKDAKrVhBQLYx2oiDZ68rufDDanQVB
.rlcdn.com/	1970-01-21 23:31:16	Name: rlas3 Value: 9jwqAptTj97S66/65DRZtFy0QMUqlHbDV2eFmWlc678=
.rlcdn.com/	1970-01-21 16:12:04	Name: pxrc Value: CJaZqNEGEgUI6AcQABIFCOhHEAE=
.yahoo.com/	1970-01-21 23:31:38	Name: A3 Value: d=AQABBJcMKmoCENgCEW_v3rVHwUvvKOxpXJ8FEgEBAQFeK2ozatxH0iMA_eMDAA&S=AQAAAoBWNtkMjpCwomR8yUm8kWI
.openx.net/	1970-01-21 23:31:16	Name: i Value: 0a309464-4573-463d-ba2c-75bf1060e54d\|1781140631
.intentiq.com/	1970-01-22 00:21:40	Name: intentIQ Value: XuBqwjHfbC
.intentiq.com/	1970-01-22 00:21:40	Name: IQver Value: 1.9
.intentiq.com/	1970-01-22 00:21:40	Name: intentIQCDate Value: 1781140631424
.bfmio.com/	1970-01-21 23:31:16	Name: __141_cid Value: BAD0F1C186764379A7E8F3E2C74AF371
.bfmio.com/	1970-01-21 14:55:45	Name: __141_exp Value: 1
.bfmio.com/	1970-01-21 23:31:16	Name: __io_cid Value: 96f278c790b8a4537a14b2c7455d1649d7dfcf7b
.targeting.unrulymedia.com/	1970-01-21 23:31:16	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-b544f06f-2021-4524-be56-659b06ea0565-005%22%7D
.c.bing.com/	1970-01-21 14:55:45	Name: MR Value: 0
.c.bing.com/	1970-01-22 00:07:16	Name: SRM_B Value: 0D0CCACBBD6762AF26ACDDBEBCA56351
.analytics.yahoo.com/	1970-01-21 23:31:16	Name: IDSYNC Value: 176k~2wg1
.pro-market.net/	1970-01-21 15:28:52	Name: anHistory Value: "-12y5ifgh19356+2+!#7%.#m!ANB"
.amazon-adsystem.com/	1970-01-21 19:39:26	Name: ad-id Value: A8L7k85UiEeRskkORlxNy-0
.amazon-adsystem.com/	1970-01-22 00:21:40	Name: ad-privacy Value: 0
.intentiq.com/	1970-01-21 15:28:52	Name: IQMID Value: 0#1781140631514
.c.clarity.ms/	1969-12-31 23:59:59	Name: SM Value: C
.clarity.ms/	1970-01-22 00:07:16	Name: MUID Value: 0D0CCACBBD6762AF26ACDDBEBCA56351
.c.clarity.ms/	1970-01-21 14:55:45	Name: MR Value: 0
.c.clarity.ms/	1970-01-21 14:45:41	Name: ANONCHK Value: 0
.agkn.com/	1970-01-21 23:31:16	Name: u Value: C\|0AAAAAAAAMbzJFwAAAAAA
.pippio.com/	1970-01-21 23:31:16	Name: did Value: tv1UBvU_B5sANN53
.pippio.com/	1970-01-21 23:31:16	Name: didts Value: 1781140631
.pippio.com/	1970-01-21 16:12:04	Name: nnls Value:
.pippio.com/	1970-01-21 16:12:04	Name: pxrc Value: CJeZqNEGEgYIgr0rEAA=
.live.streamtheworld.com/	1970-01-21 14:55:45	Name: idsync-bsw-uid-s Value: 410650b0-a7b0-4a9a-a6c7-092a4ecec8c6
yield-op-idsync.live.streamtheworld.com/	1969-12-31 23:59:59	Name: 3c1c7d854b3877e7d4a1f6eaedd9ee16 Value: bf0c5e70014d9cf75967c62a60c9fff5
.intentiq.com/	1970-01-22 00:21:40	Name: IQPData Value: 137263265#1781140631611#0#1781140631512
.pro-market.net/	1970-01-21 19:04:52	Name: anProfile Value: "-12y5ifgh19356+1+4=8z+1f=1+1g=1+1j=57:1+rs=s+rt=2001190022004E410000000000000161+s0=(4h)+s2=(tgg0wn)+vm=24-BAD0F1C186764379A7E8F3E2C74AF371:53-CAESEGP6YV4cl3XuGfX_nVjIFtI"
.linkedin.com/	1970-01-21 14:45:42	Name: __cf_bm Value: QFsd0PoT1qeq4tohqSqLlwbkt_TWNPQkbOVDjvLRtYA-1781140631.6145468-1.0.1.1-g6cmu12mCK_jnyafXWJz0DgDdAv7H1Tt6XDfHHOuRwK_rYT86M0VDciqXvpuwMd5ZrWdqD0YIxwwgdG4frb0v84uapBT7r9Nm06cEO4ozPBs4V5NhEFeSOavg2edbYmU

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://redcanary.com/wp-content/themes/redcanary/assets/build/fonts/CanarySans-Text-400.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://redcanary.com/wp-content/themes/redcanary/assets/build/fonts/CanarySans-Text-300.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://redcanary.com/wp-content/themes/redcanary/assets/build/fonts/CanarySans-Text-400.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://redcanary.com/wp-content/themes/redcanary/assets/build/fonts/CanarySans-Text-300.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://bttrack.com/Pixel/Retarget/3547 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://bttrack.com/Pixel/Retarget/3546 Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self' explore.redcanary.com
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN deny
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

003-yru-314.mktoresp.com
a.usbrowserspeed.com
aa.agkn.com
ad.doubleclick.net
ajax.googleapis.com
alb.reddit.com
analytics.ahrefs.com
analytics.twitter.com
app.qualified.com
assets.qualified.com
b.6sc.co
bam.nr-data.net
bat.bing.com
bcp.crwdcntrl.net
bttrack.com
c.bing.com
c.clarity.ms
cdn-app.pathfactory.com
cdn.bizible.com
cdn.bizibly.com
cdn.bttrack.com
cdn.jsdelivr.net
cdn01.basis.net
cdnjs.cloudflare.com
ce.lijit.com
cm.g.doubleclick.net
connect.facebook.net
consent.app.relyance.ai
d.agkn.com
dev.visualwebsiteoptimizer.com
dpm.demdex.net
eb2.3lift.com
epsilon.6sense.com
fei.pro-market.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
i.simpli.fi
ib.adnxs.com
idsync.rlcdn.com
image2.pubmatic.com
ipv6.6sc.co
j.6sc.co
js-agent.newrelic.com
js.qualified.com
load77.exelator.com
loadm.exelator.com
messenger-assets.qualified.com
ml314.com
munchkin.marketo.net
o209747.ingest.us.sentry.io
pbid.pro-market.net
pippio.com
pixel-sync.sitescout.com
pixel.rubiconproject.com
pixel.sitescout.com
pixel.tapad.com
ps.eyeota.net
px.ads.linkedin.com
px4.ads.linkedin.com
redcanary.com
resource.redcanary.com
s.ad.smaato.net
s.amazon-adsystem.com
s.ml-attr.com
s3-us-west-2.amazonaws.com
scripts.clarity.ms
secure.adnxs.com
simplifi.partners.tremorhub.com
snap.licdn.com
static.ads-twitter.com
static.cloudflareinsights.com
sync.1rx.io
sync.bfmio.com
sync.crwdcntrl.net
sync.intentiq.com
sync.targeting.unrulymedia.com
synchroscript.deliveryengine.adswizz.com
syncv4.intentiq.com
t.co
tag.simpli.fi
tracking-api.g2.com
tracking.g2crowd.com
tracking.intentsify.io
um.simpli.fi
ups.analytics.yahoo.com
us-u.openx.net
user-sync.fwmrm.net
v.clarity.ms
ws1.qualified.com
www.clarity.ms
www.facebook.com
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.redditstatic.com
x.bidswitch.net
yield-op-idsync.live.streamtheworld.com
s.ml-attr.com
ups.analytics.yahoo.com
104.17.74.206
104.18.16.5
104.18.17.5
104.18.41.41
104.198.136.223
107.178.254.65
142.251.167.155
142.251.179.148
146.75.36.157
16.15.35.30
162.247.243.29
172.66.0.227
173.194.45.154
18.160.10.47
192.132.33.68
192.28.164.179
2001:4860:482c:7700::
207.65.32.88
208.92.55.248
216.157.106.133
216.19.192.2
23.13.173.12
23.221.227.208
2600:1408:a:53::170f:355
2600:1408:c400:26::17da:d929
2600:1408:c400:5a::addf:a3c6
2600:1408:c400:5a::addf:a3d4
2600:1408:c400:5a::addf:a3db
2600:1408:c400:d::17cd:6a49
2600:1901:0:5e8a::
2600:1901:0:7f7d::
2600:1f10:4ce4:4a03:2a62:57c9:2b3a:27f4
2600:1f18:6593:f608:d96:5850:6736:187e
2600:9000:201f:e00:1b:6b7d:2300:93a1
2600:9000:27c5:4200:19:fc2c:a140:93a1
2602:816:5001::39
2603:1061:14:74::1
2606:4700:20::681a:34f
2606:4700:20::681a:5f1
2606:4700:4404::ac40:9473
2606:4700:4407::ac40:92d7
2606:4700::6810:4f49
2606:4700::6810:bb29
2606:4700::6811:190e
2606:4700::6812:1eb0
2607:f8b0:4004:c09::9b
2607:f8b0:4004:c1d::61
2607:f8b0:4004:c1f::5f
2607:f8b0:4004:c23::5e
2607:f8b0:4004:c23::65
2620:1ec:33:1::10
2620:1ec:33::10
2a03:2880:f338:1:face:b00c:0:25de
2a03:2880:f338:80:face:b00c:0:3
2a04:4e42:1000::485
2a04:4e42:200::396
2a04:4e42::396
3.167.112.115
3.170.3.122
34.111.113.62
34.117.77.79
34.193.247.218
34.200.91.212
34.36.216.150
34.85.181.204
34.98.64.218
35.174.135.129
35.211.202.130
35.212.120.65
35.212.17.176
35.244.154.8
35.245.15.98
4.153.187.221
44.208.117.202
44.218.64.233
44.233.73.129
52.206.105.60
52.242.103.142
52.85.193.65
54.183.159.18
54.209.86.203
54.87.233.173
68.67.160.114
69.194.240.13
75.2.108.141
98.82.157.231
0080f70311e3286762561240b121921a1d618720b1172a31d61d3beb6bcf8d66
00bbc66153e493c73e6ee4448a25fac555d74e1fd957f6f804754ff27bb9884f
01b266c8f4da9c337556438cc023dbbcb18085c96c1b0515cbcc904a2dcdc4ed
04c460157758fc7cf9748c5c142417a9791fe3c80c4dbf04df8dafb47414313c
06b675a649489d21b7fd33f19b1c6d37e8bd778ded07ecfec26bbc8f11e694f4
0b96905923d1c096be22beb729fe7f5e4b7f1ca4e8787c5a412c28986094c28f
0bd23f74f23102aa057696b22f06751c932e319ff0a21b53e8d66f17fa17ea80
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300
0df2e20fff12147eaae1c3cee1a32d80f62b12fb993a02ae0de5aa995c4b8fb7
0e43094bb352e0044aa4dfe3130ef75452abe87d6970a3629553da4040bf0773
0faf90022f9fa72f79da2187f4a5b5f832e84583e2fe8452e73a88adb8eb7f54
10f87ded7ce26406344832aa6bcd1bfc0f203f369992c68d0a7005f7e2a07ef9
12e53a4ef1c178726c50f804a6fd551eec0e7ac8d1409d324162f373d37048c6
14e536a30a273683a637117823c8cb4780fcc3fbf3898362eb81943766e85d14
152261291c938aa5aad6a56d52b47ffcb893d1c0387e76d7f270a7382ff786d5
166733f82cf41f33586d49c530dcb26015fc2e5f0fd1903e3dcd9eb555453f44
17e2808b4349a08c4f770cacf481d4803adb21fb958f050579cfe716204951aa
17fe38ab302c7e5dbfb5c3d87801092d79be958500db6412ed3bc0f126bd53d3
1841968e84bd3fdf8d7cf2ec5af55238e50bb3f6a8f6552a19b7c447ed6150aa
2246c91e028dd5e9127de56300e675abffb7d07fdbd3f165304cb740368505e3
246646a9adecc53ddd648f6073306ccb3ad17e926d9ef5ccfffd6975c092feb5
261f6febbe1b970782d4680512944816a84f037134abb40f14fa5dc25c70131e
26290221230d18bd4b202a20bb0bf2d1f9a9d9a9495b35af3b0ed7a959697e50
2678f7766bba46715a0e635ea5878d55dfdcff15f746a9299110a222c6d654b5
2bad7f5d14684de5ca3bdde7b9b99a8d2e96969a29f3103b275301847e3c7609
2c890f14e6e59d6d1a6ef3ee6b99ba28ca3256c9ee8c21ab663372553f275a73
2ddeade3a8991666b89f2a0c3aaba4508852838488781e260d45bc886f1172a5
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
30d29bec2dffa0400fa6dd0623e6c7768a56a511f5cd41051056ed6290e14816
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
31d157475734629d2e46c2a6bede91ac5c0a36d43347edc6e46fb78fa34cf751
32185e846976c2e1c3a39b5d4b4b48dad55ca07fa39aff36c687a8cd03d5e23d
3331a0486cb3e8a75c8c2fdf02bf80fd8fe2b811dfe5c7b4aa892d38bfcf604a
374087c3056d96a733ba5c4383e1c3af526444dffe5c6aed84b544e48a6a808c
3d87310582ba2a51b5fabbd081e349c3bcc89cc9f76277da6a5d397dd3b4f937
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
433f268f71df56717ec557789644719f4d7cf1dc190d21b85a3c0b39d7ce3d1a
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
44428afa0827a9d9209a3e7dca200155bb6475e9cac503e45ed4e87786292e32
46d6a0984aa795b764141232671160e61bdcc49e900de67ca6b35bae25b1ebdd
476961502744986081e82755dc5c78bb75c811d61811942ac3830a430674101b
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4eb4779718a74a4209375a47456cde1a92e274d1757e45baa03e04281d8f8856
5002430970a4f72568f30a8495f8569e055a689b1e998282df1f7d844f6dcca5
51339437afce2e5acd06bfa0f514b8aa3381bf7aeadc1b9a50c3f1164d279cf7
5379cc07e1c683ca5b3edd90da73b2363489c2db855f42bd63043935106c6b17
543a2bc3bdebec6bc98871c2f227d07e725618df26154df87e5504b1d73f2c63
5578be2549624d90439f96ec64d34bdb5d049124dea892a176ed6fd31767672d
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5684151efeb65bfeff27c460399467d754b476bc64cb4e78246bc2eebb5ef132
57718756531202ca204f7c0bd0e63f9787777d12dae7a80dce59f37483012168
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
5b377f76e98999426a39cc96af13706daaa0083da740cee2e020fe8e25627966
5fef814edcb8411511996c8d5c559c2a5a1bee348fc15edb8d0e18a3cfab83ea
6432f93541d5ecc55532ce3179c698322f876d188eebb665cd947982a47f4181
691491f1fc8badab623e1be56f92cc2d98c462b16617c67e1e288d6b061444bc
6e0408f7fbaf5216b577287b7654be1388d933b9b41dbd95dc733d5b5020f67a
6e187798f38903d98819498dfa7d58da47db4e8fcfd5f76bb27e6abe90bda262
731fcb30d45f2e35aaa139a7a964410a7c2bcdbfbb48a837c9d56dec7cc3732f
7712303d9c52b323a6ccc8db66f6558c0520acf0fba2b70fdd401abffd66c8ff
77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6
7b386ad2debb9b701ec71427b4ec08dce25b898555d9c5d42e6d70bd2bf39fcc
7b48595afb89093d7306c1a2d3555b088f195f1a898837dfe0bf7b8593d353e8
805ce4322a9be88ec58266cf40c95f62920aadea2a0d00f6ddeda8f82df66b09
855230e1321917153b6859521e1ccfab0dce7497f88645e73d7e6db9c4bbe3b1
89fde8fd7b0ad034128435bc21892e617683afdfb5cd4fef39c0bd6ff7d53723
8b4532ddd365937e2ee31a95189a447d45881cf4dadf2ab66c850786f87774d8
8edbf02936f4bbda931a228bd84f7b668522af07f3dfc33b5caee429e7febb85
91c20c70d36b608cf919e894b0ac9e32298d6b3ac3ca59c45a85e7c44161d170
91e72350ad025d66f6f6651d636942a8a3d280bf04cf84345065930ed9f93535
940a30cc5a6f62d07d11907a2046a98159278ba570f33f1662d2d2d07488f9c3
9429b97bbbb888d78537493ad43f8f0351b11dbc7cdb535db2d930dd88b05ecd
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9a586f0b3e8add35ad17a2eec2cee97cbe175f48d7c47e34492dd973aa0f8381
9b9e1688a0124d7252439be6cd3be347cfac5328e74d12b9f8f392421f6d2da8
9ee3f1033cd0661c6cf86bedd7da2bd2cd3a967410b50466952ad8c2431a4e39
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a19b17e3c318b115a7531fd404bd12a49d65104d57a1efd064f5ae80b457f52f
a2246fb1d340b6fac379b467e849a59f902bdfdd7c406d1d4b61015f3eb6c8e7
a2d216891690b783996c8296496cf0dc9c101d4f532befd5342921ee86e024ef
a4959332faa5065301c5d90ce5b23549c2150bb2c52680a9945d2a42d70beb6b
a6cb54052b059e6487abafcc0d4e33138639fcce2aa511f26cd23634517f1276
a85866392118d4e9d6474f16c8d3654b039859e2085d6c01785129fd21422eb4
a9df61f6196adb2d59f88a72241d587b32ebe4cc349c939324109739ab6a8e27
ab6277dadbd2151d76bd5e9627d73f0cf5f1f59a853fab189726185928ebb51d
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aca73fc574e12740e3368860b88a284d01b643456f3ed6a06322ecb47750563f
af15306be707d140f27a8d04bccf5763110d62d7ee332932626f6001ff74d9df
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b0e68448445650736443211f1299b8c9177fb8052356ed7d1249295c15be26a4
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b270afc5f9df7bcd9239c22857fb1511bba1398a28b1c3548272d720cb433c62
b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a
bad580c9649fd2b94581d73b47d7e4c620d0efd603f6830c0f20101cf09ef96a
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bbdb0a56c8eb30d3b915526ca2bf873b4f73b05bb06be0ba790c9006abeb44fc
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c3096f016b56aa58ea27707e5636618495175ed50b77c09b91c9cb5c014b79e2
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0fc0d74559d5db3cd085d9d4450e9abc7bd47dfdc6d838cb0028d691f506a43
d2708f532e2389edc680bab6bae3f952e08413c672dceb75ef03b3f3346df6a8
d2f545bb226e5bcc1d50af37b345d245dce63bc07aaeba2243e0f1ea87b2dcb9
d42d95676a5fb59c33cf368c1c8fc71930805c1f4111bb007f02ca6bc05ed42a
d4aa1f65a1a12d9fb4c71fd1538e0a6b871fbbd6558ad36e10134a50d38281c5
d612f1212b452af07f1a5defb2b672e76a91f7139e7499fa48bb9b2b985c22d6
d6d04ca5639d6cb737de1cfcc6030b96dcc3bdad824942556b01915f8b575d82
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
e11ac71f6335623b82890e0390bc0bd0673e0154a935e7ef46da5fcf6a34bb47
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3cc36c64ef86bed21592653daac82fd7e4c364c32c8344336aa13f7dbf52c90
e689dfb73e1049f703f0c28fbcb91b038caeab063d878933d05b0fb30dfb6b9a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efa187625053a93995802ce699cb2ff4a8ec9e8d36a63e8c9483bcbc45563011
f0255e984f987d1402db5f2a8426f5174bca1cd50ee0ca10abab75d33cd90d67
f1a61277e3f902f50ab42015d8b07218db9b7601bb0967e54a52bfdcb4fa7e81
f46a6c472b8609dc34d2aa4c613d46760f47ab264895bc34f1c44965dfb12fa0
f5aec9320f7ba6050172736d730c97e3a743e136eaa67cbe23be52df15245d80
f6233fa488c999209dbdabe59d894d04642906ee5c9fb85b6da59537f5a5fa0d
f868f70c106fb972895d9de2bba1e29dc79723e887cb7c75fdb384cf22ffb79b
fa87904726726364ad19a7c4b2f2b20ee10637325601b5aa88ed8bfdcb7117a7
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a
fd538f2e8b207133b0ae87d87e777db9fc0e65d293f0d7be4a1022811f5397f0
fe8fdbc6db1356ef1606551feca8ac3a80425aadfda34cc7183a8a2e7a5a42c5
fed344940a52670af96d23cd88e8fedf17c4db4adfeb66e284f36df2b14c1219

redcanary.com 104.198.136.223 Public Scan Open in urlscan Pro

Internal

Effective Hostname

Submitted URL

Effective IP

Summary

urlscan.io Verdict: No classification

Domain & IP information

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

redcanary.com
104.198.136.223 Public Scan Open in urlscan Pro