research.checkpoint.com Open in urlscan Pro
141.193.213.21  Public Scan

17 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://t.co/ibMnytxFVI Page URL
2. https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 64

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1622723170775&url=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor%2F HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D51830%26time%3D1622723170775%26url%3Dhttps%253A%252F%252Fresearch.checkpoint.com%252F2021%252Fchinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor%252F%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1622723170775&url=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor%2F&liSync=true

188 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	ibMnytxFVI Show response t.co/	526 B 564 B	231ms 153ms	Document text/html	104.244.42.69 TWITTER
General Check archive.org Show headers Download Go to Full URL https://t.co/ibMnytxFVI Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.69 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash 3d9ea60dc904a8185a76684e358d54938c462da9ae70448d3eeaa2da24637a49 Security Headers Name Value Strict-Transport-Security max-age=0 X-Xss-Protection 0 Request headers :method GET :authority t.co :scheme https :path /ibMnytxFVI pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:09 GMT vary Origin server tsa_o expires Thu, 03 Jun 2021 12:31:09 GMT set-cookie muc=374e2c42-192a-4c69-a99a-628ddca0a486; Max-Age=63072000; Expires=Sat, 03 Jun 2023 12:26:09 GMT; Domain=t.co; Secure; SameSite=None content-type text/html; charset=utf-8 cache-control private,max-age=300 content-length 248 content-encoding gzip x-xss-protection 0 strict-transport-security max-age=0 x-connection-hash 89ba3e1329cb9a0fd6fb544f6bf1d92213c106668d073e297bb7bed3263b6c15
GET H2	200	Primary Request / Show response research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/	55 KB 15 KB	238ms 195ms	Document text/html	141.193.213.21 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Requested by Host: t.co URL: https://t.co/ibMnytxFVI Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / WP Engine Resource Hash 870a4abc81254b32b24a3a986fde1394c5245adf7b0d338196f9c5b7d22631a0 Security Headers Name Value X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :method GET :authority research.checkpoint.com :scheme https :path /2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer https://t.co/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer https://t.co/ Response headers date Thu, 03 Jun 2021 12:26:09 GMT content-type text/html; charset=UTF-8 vary Accept-Encoding Accept-Encoding Accept-Encoding,Cookie link <https://research.checkpoint.com/?p=25068>; rel=shortlink x-powered-by WP Engine x-cacheable SHORT cache-control max-age=600, must-revalidate x-cache HIT: 52 x-cache-group normal x-frame-options SAMEORIGIN x-xss-protection 1; mode=block cf-cache-status DYNAMIC cf-request-id 0a736fa5e20000737f1b1e5000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 6598e8830f4e737f-CPH content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
GET H3-29	200	style.min.css research.checkpoint.com/wp-includes/css/dist/block-library/	57 KB 8 KB	84ms 59ms	Stylesheet text/css	141.193.213.21 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/wp-includes/css/dist/block-library/style.min.css?ver=5.7.2 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 2cd9de3dd26246204749cff259bc34e8e6a47ae5d6e4528b9b28c75d68d50cde Request headers :path /wp-includes/css/dist/block-library/style.min.css?ver=5.7.2 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority research.checkpoint.com referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ :scheme https sec-fetch-site same-origin :method GET Referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT content-encoding br cf-cache-status HIT last-modified Tue, 06 Apr 2021 23:50:28 GMT server cloudflare age 21994 etag W/"606cf3c4-e33b" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding Accept-Encoding Accept-Encoding content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 6598e8847ad61d1e-CPH alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 cf-request-id 0a736fa6c800001d1e65a18000000001
GET H3-29	200	style.css research.checkpoint.com/wp-content/themes/research/	18 KB 4 KB	63ms 37ms	Stylesheet text/css	141.193.213.21 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.25 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash b8d2f6e6753c9cd547601314a13ee8539629c6a85b0e9c50f5cc462cf42d60b3 Request headers :path /wp-content/themes/research/style.css?ver=1.25 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority research.checkpoint.com referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ :scheme https sec-fetch-site same-origin :method GET Referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT content-encoding br cf-cache-status HIT last-modified Tue, 14 Jan 2020 00:19:03 GMT server cloudflare age 3568047 etag W/"5e1d08f7-48d7" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding Accept-Encoding Accept-Encoding content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 6598e8847ad71d1e-CPH alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 cf-request-id 0a736fa6c800001d1e53b3c000000001
GET H3-29	200	bootstrap.min.css research.checkpoint.com/wp-content/themes/research/css/	137 KB 19 KB	107ms 81ms	Stylesheet text/css	141.193.213.21 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/wp-content/themes/research/css/bootstrap.min.css?ver=4.1 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 34959e43e6ecf368807a84f92ad9aa6e2dcd5f0c5c1e57da55e8f3248d9d9255 Request headers :path /wp-content/themes/research/css/bootstrap.min.css?ver=4.1 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority research.checkpoint.com referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ :scheme https sec-fetch-site same-origin :method GET Referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT content-encoding br cf-cache-status HIT last-modified Thu, 07 Nov 2019 22:27:49 GMT server cloudflare age 3568047 etag W/"5dc49a65-22485" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding Accept-Encoding Accept-Encoding content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 6598e8847add1d1e-CPH alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 cf-request-id 0a736fa6c900001d1efc0a8000000001
GET H3-29	200	flickity.min.css research.checkpoint.com/wp-content/themes/research/css/	2 KB 903 B	88ms 63ms	Stylesheet text/css	141.193.213.21 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/wp-content/themes/research/css/flickity.min.css?ver=1.1 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash a8da941d8a446516c824ebc9fb77b42e6b92c6deed1daed266bd821ed27bc516 Request headers :path /wp-content/themes/research/css/flickity.min.css?ver=1.1 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority research.checkpoint.com referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ :scheme https sec-fetch-site same-origin :method GET Referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT content-encoding br cf-cache-status HIT last-modified Thu, 07 Nov 2019 22:27:48 GMT server cloudflare age 3022217 etag W/"5dc49a64-71d" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding Accept-Encoding Accept-Encoding content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 6598e8847ad81d1e-CPH alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 cf-request-id 0a736fa6c900001d1ee6a6a000000001
GET H2	200	all.css use.fontawesome.com/releases/v5.6.3/css/	52 KB 13 KB	102ms 35ms	Stylesheet text/css	23.111.9.35 HIGHWINDS2
General Check archive.org Show headers Download Go to Full URL https://use.fontawesome.com/releases/v5.6.3/css/all.css?ver=5.6.3 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.111.9.35 , United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash 481a0574246e281316ffa0e15399bf5388bb81ae550ce0401a0353b6bb2d1e5a Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT content-encoding gzip last-modified Thu, 20 Dec 2018 17:45:13 GMT server NetDNA-cache/2.2 etag W/"dc93d584e41f8417f6b7163320d34329" vary Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding access-control-allow-methods GET content-type text/css access-control-allow-origin * access-control-max-age 3000 cache-control max-age=31556926 x-cache HIT
GET H3-29	200	enlighterjs.min.css research.checkpoint.com/wp-content/plugins/enlighter/cache/	78 KB 8 KB	89ms 64ms	Stylesheet text/css	141.193.213.21 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/wp-content/plugins/enlighter/cache/enlighterjs.min.css?ver=TJ0/7+iAWMKbDKS Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 6048e330c0f362be46b20de45d35a5ace57a04be04a29da10448d6949f6f69ce Request headers :path /wp-content/plugins/enlighter/cache/enlighterjs.min.css?ver=TJ0/7+iAWMKbDKS pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority research.checkpoint.com referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ :scheme https sec-fetch-site same-origin :method GET Referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT content-encoding br cf-cache-status HIT last-modified Mon, 15 Feb 2021 20:35:46 GMT server cloudflare age 3363543 etag W/"602adb22-13686" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding Accept-Encoding Accept-Encoding content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 6598e8847ad91d1e-CPH alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 cf-request-id 0a736fa6c900001d1e5d396000000001
GET H2	200	jquery-3.4.0.min.js Show response code.jquery.com/	86 KB 30 KB	12ms 11ms	Script application/javascript	2001:4de0:ac18::1:a:1b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.4.0.min.js?ver=5.7.2 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash 0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:09 GMT content-encoding gzip last-modified Wed, 10 Apr 2019 19:56:14 GMT server nginx etag W/"5cae4a5e-15857" vary Accept-Encoding x-hw 1622723169.dop164.fr8.t,1622723169.cds277.fr8.hc,1622723169.cds051.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30632
GET H3-29	200	bootstrap.bundle.min.js Show response research.checkpoint.com/wp-content/themes/research/js/lib/	66 KB 18 KB	104ms 79ms	Script application/javascript	141.193.213.21 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/wp-content/themes/research/js/lib/bootstrap.bundle.min.js?ver=4.1 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash bb3d017273ed487674d9766d8401cf458228596adcc0c3a6024f44ae715090db Request headers :path /wp-content/themes/research/js/lib/bootstrap.bundle.min.js?ver=4.1 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority research.checkpoint.com referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ :scheme https sec-fetch-site same-origin :method GET Referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT content-encoding br cf-cache-status HIT last-modified Thu, 07 Nov 2019 22:27:48 GMT server cloudflare age 3363543 etag W/"5dc49a64-1089e" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding Accept-Encoding Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 6598e8847adc1d1e-CPH alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 cf-request-id 0a736fa6c900001d1e4715a000000001
GET H3-29	200	flickity.pkgd.min.js Show response research.checkpoint.com/wp-content/themes/research/js/lib/	54 KB 13 KB	63ms 38ms	Script application/javascript	141.193.213.21 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/wp-content/themes/research/js/lib/flickity.pkgd.min.js?ver=1.0.1 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash fe2df9f6df4b4a8d7174d259f563b8d9e28e4c03f8f4092fd9db6044e0e64c32 Request headers :path /wp-content/themes/research/js/lib/flickity.pkgd.min.js?ver=1.0.1 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority research.checkpoint.com referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ :scheme https sec-fetch-site same-origin :method GET Referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT content-encoding br cf-cache-status HIT last-modified Thu, 07 Nov 2019 22:27:48 GMT server cloudflare age 3022217 etag W/"5dc49a64-d7c9" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding Accept-Encoding Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 6598e8847ada1d1e-CPH alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 cf-request-id 0a736fa6c900001d1e6d2a6000000001
GET H3-29	200	single-post.js Show response research.checkpoint.com/wp-content/themes/research/js/	422 B 543 B	107ms 83ms	Script application/javascript	141.193.213.21 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/wp-content/themes/research/js/single-post.js?ver=1.0.4 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 7f5bd223eafa1c6d1aff21c91c6bfb825f7f36830d97eef41c432681ed671f85 Request headers :path /wp-content/themes/research/js/single-post.js?ver=1.0.4 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority research.checkpoint.com referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ :scheme https sec-fetch-site same-origin :method GET Referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT content-encoding br cf-cache-status HIT last-modified Tue, 14 Jan 2020 00:00:05 GMT server cloudflare age 3363543 etag W/"5e1d0485-1a6" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding Accept-Encoding Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 6598e8847ade1d1e-CPH alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 cf-request-id 0a736fa6c900001d1e391ca000000001
GET H3-29	200	inc-header.js Show response research.checkpoint.com/wp-content/themes/research/header/	1 KB 738 B	108ms 83ms	Script application/javascript	141.193.213.21 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/wp-content/themes/research/header/inc-header.js?v=1.1 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash ae3754c54a0880a98a94c423d3e67f39b5b6f3c63516dafa33866e3e74c9f97d Request headers :path /wp-content/themes/research/header/inc-header.js?v=1.1 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority research.checkpoint.com referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ :scheme https sec-fetch-site same-origin :method GET Referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT content-encoding br cf-cache-status HIT last-modified Thu, 07 Nov 2019 22:27:48 GMT server cloudflare age 3022217 etag W/"5dc49a64-47a" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding Accept-Encoding Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 6598e8847adf1d1e-CPH alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 cf-request-id 0a736fa6ca00001d1e48aac000000001
GET H3-29	200	style.css research.checkpoint.com/wp-content/themes/research/header/	9 KB 2 KB	103ms 79ms	Stylesheet text/css	141.193.213.21 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/wp-content/themes/research/header/style.css Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 0fe8bcbcd24ab838fbbd773001253fc0353956e81c5ba9c8e23951ebdbae305a Request headers :path /wp-content/themes/research/header/style.css pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority research.checkpoint.com referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ :scheme https sec-fetch-site same-origin :method GET Referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT content-encoding br cf-cache-status HIT last-modified Thu, 07 Nov 2019 22:27:48 GMT server cloudflare age 3363543 etag W/"5dc49a64-25cb" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding Accept-Encoding Accept-Encoding content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 6598e8847adb1d1e-CPH alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 cf-request-id 0a736fa6c900001d1ea20e2000000001
GET H2	200	css fonts.googleapis.com/	2 KB 632 B	28ms 28ms	Stylesheet text/css	2a00:1450:4001:802::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 99155f31d46dc469aa872ce824309fae9210fb9357f463b889d617b85b35eb61 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Thu, 03 Jun 2021 11:24:03 GMT server ESF date Thu, 03 Jun 2021 12:26:09 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 03 Jun 2021 12:26:09 GMT
GET H/1.1	200 OK	facebook.gif sc1.checkpoint.com/sc1/inc/html/images/social/	1 KB 2 KB	108ms 31ms	Image image/gif	104.111.231.109 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://sc1.checkpoint.com/sc1/inc/html/images/social/facebook.gif Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.231.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-231-109.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 791d8c8cb135d3d53915096e999d3857b6ee16966c20a019f38699f09f6aa2ff Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:10 GMT Last-Modified Mon, 25 Sep 2017 18:13:31 GMT Server AkamaiNetStorage ETag "7eb7015574801089503dd7095e1d4313:1506366539" Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin * Cache-Control max-age=604800 Connection keep-alive Accept-Ranges bytes Access-Control-Allow-Headers * Content-Length 1254
GET H/1.1	200 OK	google-plus.gif sc1.checkpoint.com/sc1/inc/html/images/social/	2 KB 2 KB	108ms 31ms	Image image/gif	104.111.231.109 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://sc1.checkpoint.com/sc1/inc/html/images/social/google-plus.gif Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.231.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-231-109.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 1998582382fbf956231d65be84b76e08c0c86e5ced8a99c703bdec416d876d76 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:10 GMT Last-Modified Mon, 25 Sep 2017 18:13:31 GMT Server AkamaiNetStorage ETag "eedd0b2cde10b6b1930d57a10c6d0422:1612322629.149034" Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin * Cache-Control max-age=604800 Connection keep-alive Accept-Ranges bytes Access-Control-Allow-Headers * Content-Length 1653
GET H/1.1	200 OK	linkedin.gif sc1.checkpoint.com/sc1/inc/html/images/social/	1 KB 2 KB	108ms 31ms	Image image/gif	104.111.231.109 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://sc1.checkpoint.com/sc1/inc/html/images/social/linkedin.gif Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.231.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-231-109.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash a22d6b8782097b7cd9588ab582e119bfd6290278275661e9d0f96b2baec0cb8e Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:10 GMT Last-Modified Mon, 25 Sep 2017 18:13:31 GMT Server AkamaiNetStorage ETag "6789b034de6591b26bbd9b5fa6b451ca:1506366539" Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin * Cache-Control max-age=604800 Connection keep-alive Accept-Ranges bytes Access-Control-Allow-Headers * Content-Length 1416
GET H/1.1	200 OK	email.gif sc1.checkpoint.com/sc1/inc/html/images/social/	1 KB 2 KB	107ms 31ms	Image image/gif	104.111.231.109 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://sc1.checkpoint.com/sc1/inc/html/images/social/email.gif Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.231.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-231-109.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 3643b2c826a615065303aa44b8f463eb854d77934f5f25dc1f74f60d4698f9f0 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:10 GMT Last-Modified Mon, 25 Sep 2017 18:13:31 GMT Server AkamaiNetStorage ETag "15f1e1004accdbc019365e658249f334:1506366539" Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin * Cache-Control max-age=604800 Connection keep-alive Accept-Ranges bytes Access-Control-Allow-Headers * Content-Length 1407
GET H/1.1	200 OK	rss.gif sc1.checkpoint.com/sc1/inc/html/images/social/	2 KB 2 KB	109ms 31ms	Image image/gif	104.111.231.109 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://sc1.checkpoint.com/sc1/inc/html/images/social/rss.gif Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.231.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-231-109.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash b7cfb1c9430d90b22b3f4497543a4cfef719dc40a3cce130cad766171abe8bbe Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:10 GMT Last-Modified Mon, 25 Sep 2017 18:13:31 GMT Server AkamaiNetStorage ETag "8cc18e3677ea53cc679e33e82bf9497a:1506366539" Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin * Cache-Control max-age=604800 Connection keep-alive Accept-Ranges bytes Access-Control-Allow-Headers * Content-Length 1620
GET H/1.1	200 OK	twitter.gif sc1.checkpoint.com/sc1/inc/html/images/social/	2 KB 2 KB	111ms 31ms	Image image/gif	104.111.231.109 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://sc1.checkpoint.com/sc1/inc/html/images/social/twitter.gif Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.231.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-231-109.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash a59bba774218f207179b30aa8bbd21bad0f7355a52321e08138bd77a308c27d5 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:10 GMT Last-Modified Mon, 25 Sep 2017 18:13:31 GMT Server AkamaiNetStorage ETag "6b05f4fc9522afa0cdbeb1a2c0bccc2c:1506366539" Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin * Cache-Control max-age=604800 Connection keep-alive Accept-Ranges bytes Access-Control-Allow-Headers * Content-Length 1608
GET H/1.1	200 OK	check-point-research-logo.gif sc1.checkpoint.com/sc1/inc/html/images/	3 KB 3 KB	34ms 33ms	Image image/gif	104.111.231.109 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://sc1.checkpoint.com/sc1/inc/html/images/check-point-research-logo.gif Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.231.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-231-109.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash b1fd89254c5a1e26226d533849c501ce8d17f47d4271e907f0084d7a25f1f242 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:10 GMT Last-Modified Mon, 09 Jul 2018 21:15:16 GMT Server AkamaiNetStorage ETag "c425f4400a5c9dfbaecb24275f494931:1531172224" Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin * Cache-Control max-age=604800 Connection keep-alive Accept-Ranges bytes Access-Control-Allow-Headers * Content-Length 2901
GET H3-29	200	under-attack.gif research.checkpoint.com/wp-content/themes/research/img/lib/	458 B 866 B	95ms 93ms	Image image/webp	141.193.213.21 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://research.checkpoint.com/wp-content/themes/research/img/lib/under-attack.gif Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash c0f7ef8329ae6da56bd269492901fb024a05d7b67e977995a82b506af4b3b030 Request headers :path /wp-content/themes/research/img/lib/under-attack.gif pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority research.checkpoint.com referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ :scheme https sec-fetch-site same-origin :method GET Referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT cf-cache-status HIT age 3022217 cf-polished origFmt=gif, origSize=1666 content-disposition inline; filename="under-attack.webp" alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 458 cf-request-id 0a736fa73c00001d1ee2835000000001 last-modified Thu, 07 Nov 2019 22:27:48 GMT server cloudflare etag "5dc49a64-682" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cf-ray 6598e8852c741d1e-CPH cf-bgj imgq:100,h2pri
GET H2	200	gtm.js Show response www.googletagmanager.com/	242 KB 65 KB	37ms 35ms	Script application/javascript	2a00:1450:4001:82a::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash cee74a8b8a09df74f1095429569867700c17bbb3360528ae7168ddd87598ad9a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 66671 x-xss-protection 0 last-modified Thu, 03 Jun 2021 12:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 03 Jun 2021 12:26:10 GMT
GET H3-29	200	email-decode.min.js Show response research.checkpoint.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/	1 KB 936 B	27ms 26ms	Script application/javascript	141.193.213.21 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers :path /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority research.checkpoint.com referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ :scheme https sec-fetch-site same-origin :method GET Referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT content-encoding gzip x-content-type-options nosniff last-modified Fri, 28 May 2021 10:23:11 GMT server cloudflare etag W/"60b0c48f-4d7" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-frame-options DENY content-type application/javascript cache-control max-age=172800 public cf-ray 6598e8850c261d1e-CPH vary Accept-Encoding cf-request-id 0a736fa72800001d1ee7846000000001 expires Sat, 05 Jun 2021 12:26:10 GMT
GET H2	200	sharethis.js Show response platform-api.sharethis.com/js/	101 KB 32 KB	72ms 26ms	Script text/javascript	2600:9000:218f:4c00:1c:8a07:5e80:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://platform-api.sharethis.com/js/sharethis.js Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:218f:4c00:1c:8a07:5e80:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 36225e386f80d3706232990cc4ca5d50c69bfb3dfb8bbf99d89acfd892c158a5 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:22:25 GMT content-encoding gzip age 225 etag W/"19322-6F8eje7mEH07iqf1oc8H7fNRIug" vary Accept-Encoding x-cache Hit from cloudfront content-type text/javascript; charset=utf-8 via 1.1 16a28c0e67da18fa2960e2e414084d77.cloudfront.net (CloudFront) edge-control cache-maxage=60m,downstream-ttl=60m cache-control max-age=600, public x-amz-cf-pop CDG52-P2 x-amz-cf-id Yb6DzudXhr19D0MwF7V0e4RwKIluFaLRzrDlZ-mDo7p-NXTKLG5qZA==
GET H3-29	200	CfP_1021x580_A.jpg research.checkpoint.com/wp-content/uploads/2018/11/	127 KB 128 KB	38ms 36ms	Image image/jpeg	141.193.213.21 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://research.checkpoint.com/wp-content/uploads/2018/11/CfP_1021x580_A.jpg Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash ba8d88ea5f494982cae457a29fd31a03869293680fbf2cf1b17138b8c48d6b69 Request headers :path /wp-content/uploads/2018/11/CfP_1021x580_A.jpg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority research.checkpoint.com referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ :scheme https sec-fetch-site same-origin :method GET Referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT cf-cache-status HIT age 3022217 cf-polished origSize=134980, status=webp_bigger alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 130331 cf-request-id 0a736fa73c00001d1e47167000000001 last-modified Thu, 07 Nov 2019 22:27:41 GMT server cloudflare etag "5dc49a5d-20f44" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cf-ray 6598e8852c751d1e-CPH cf-bgj imgq:100,h2pri
GET H3-29	200	enlighterjs.min.js Show response research.checkpoint.com/wp-content/plugins/enlighter/cache/	57 KB 16 KB	58ms 55ms	Script application/javascript	141.193.213.21 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/wp-content/plugins/enlighter/cache/enlighterjs.min.js?ver=TJ0/7+iAWMKbDKS Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 7e0c4a1ed3d232553d98c82ea0e04cee8975d0a67df819e161f96e7c32179e8c Request headers :path /wp-content/plugins/enlighter/cache/enlighterjs.min.js?ver=TJ0/7+iAWMKbDKS pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority research.checkpoint.com referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ :scheme https sec-fetch-site same-origin :method GET Referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT content-encoding br cf-cache-status HIT last-modified Mon, 15 Feb 2021 20:35:46 GMT server cloudflare age 3568047 etag W/"602adb22-e33f" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding Accept-Encoding Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 6598e8852c731d1e-CPH alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 cf-request-id 0a736fa73c00001d1ef70e2000000001
GET H2	200	OneSignalSDK.js Show response cdn.onesignal.com/sdks/	9 KB 3 KB	29ms 27ms	Script application/javascript	2606:4700::6812:e134 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=5.7.2 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d1fdc83f40b6872fbf82ad027168954ccaa7eee12c7e6fcbe52e26c36bf915de Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT content-encoding gzip cf-cache-status HIT server cloudflare age 984 etag W/"5404400d01d5519bc4a10316e7ed5c9b" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript cache-control public, max-age=259200 cf-ray 6598e8851e7205e4-FRA cf-request-id 0a736fa732000005e4e9347000000001 expires Sun, 06 Jun 2021 12:26:10 GMT
GET H/1.1	200 OK	search-icon.gif sc1.checkpoint.com/sc1/inc/html/images/	2 KB 2 KB	32ms 31ms	Image image/gif	104.111.231.109 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://sc1.checkpoint.com/sc1/inc/html/images/search-icon.gif Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/wp-content/themes/research/header/style.css Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.231.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-231-109.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 953d6908ab55929254e46c77e5c751a6e2df7ab84430f134edc3bb62d8f7d32f Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:10 GMT Last-Modified Mon, 25 Sep 2017 18:13:31 GMT Server AkamaiNetStorage ETag "2e1aa25e7e77e6a393fd38efb413370f:1506366539" Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin * Cache-Control max-age=604800 Connection keep-alive Accept-Ranges bytes Access-Control-Allow-Headers * Content-Length 1755
GET H3-29	200	34CA47_6_0.woff2 research.checkpoint.com/wp-content/themes/research/fonts/	58 KB 58 KB	67ms 67ms	Font font/woff2	141.193.213.21 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/wp-content/themes/research/fonts/34CA47_6_0.woff2 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.25 Protocol H3-29 Security QUIC, , AES_128_GCM Server 141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 0fc686423c26cb1030032fd7e4f2dd664c4b08517a8990c0b46269dd4e01910b Request headers :path /wp-content/themes/research/fonts/34CA47_6_0.woff2 pragma no-cache origin https://research.checkpoint.com accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode cors accept */* cache-control no-cache sec-fetch-dest font :authority research.checkpoint.com referer https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.25 :scheme https sec-fetch-site same-origin :method GET Origin https://research.checkpoint.com Referer https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.25 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT cf-cache-status HIT age 3558770 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 59536 cf-request-id 0a736fa74600001d1ea20ee000000001 last-modified Thu, 07 Nov 2019 22:27:48 GMT server cloudflare etag "5dc49a64-e890" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cf-ray 6598e8853c911d1e-CPH
GET H3-29	200	ChineseThreatGroup_social_FB.jpg research.checkpoint.com/wp-content/uploads/2021/06/	241 KB 242 KB	70ms 69ms	Image image/jpeg	141.193.213.21 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://research.checkpoint.com/wp-content/uploads/2021/06/ChineseThreatGroup_social_FB.jpg Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 7fa21a28b5e70106a0ffb8e97872cddfcfa8b32b7b36e3adc15320c62bd6e284 Request headers :path /wp-content/uploads/2021/06/ChineseThreatGroup_social_FB.jpg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority research.checkpoint.com referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ :scheme https sec-fetch-site same-origin :method GET Referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT cf-cache-status HIT age 6587 cf-polished origSize=257420, status=webp_bigger alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 247090 cf-request-id 0a736fa7bd00001d1e28131000000001 last-modified Thu, 03 Jun 2021 05:45:39 GMT server cloudflare etag "60b86c83-3ed8c" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cf-ray 6598e885fea31d1e-CPH cf-bgj imgq:100,h2pri
GET H3-29	200	image2.png research.checkpoint.com/wp-content/uploads/2021/06/	93 KB 94 KB	61ms 60ms	Image image/webp	141.193.213.21 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://research.checkpoint.com/wp-content/uploads/2021/06/image2.png Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 2aeee3f4b7c5aa29d027b24838934d580c1dc442999b97bc3de93ea9d290a24d Request headers :path /wp-content/uploads/2021/06/image2.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority research.checkpoint.com referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ :scheme https sec-fetch-site same-origin :method GET Referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT cf-cache-status HIT age 6587 cf-polished origFmt=png, origSize=141601 content-disposition inline; filename="image2.webp" alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 95460 cf-request-id 0a736fa7c300001d1e28132000000001 last-modified Thu, 03 Jun 2021 08:13:35 GMT server cloudflare etag "60b88f2f-22921" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cf-ray 6598e885fea41d1e-CPH cf-bgj imgq:100,h2pri
GET H3-29	200	image3.png research.checkpoint.com/wp-content/uploads/2021/06/	6 KB 7 KB	114ms 113ms	Image image/webp	141.193.213.21 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://research.checkpoint.com/wp-content/uploads/2021/06/image3.png Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 7e083e8cc9259bd0c60bf47cd12e36806084913bce3ea0ad0adcc713208dcf65 Request headers :path /wp-content/uploads/2021/06/image3.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority research.checkpoint.com referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ :scheme https sec-fetch-site same-origin :method GET Referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT cf-cache-status HIT age 6547 cf-polished origFmt=png, origSize=18935 content-disposition inline; filename="image3.webp" alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 6592 cf-request-id 0a736fa7bd00001d1e0b2a3000000001 last-modified Thu, 03 Jun 2021 08:13:36 GMT server cloudflare etag "60b88f30-49f7" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cf-ray 6598e885fea51d1e-CPH cf-bgj imgq:100,h2pri
GET H3-29	200	image4.png research.checkpoint.com/wp-content/uploads/2021/06/	57 KB 58 KB	34ms 33ms	Image image/webp	141.193.213.21 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://research.checkpoint.com/wp-content/uploads/2021/06/image4.png Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 4ea9f820116a7f338d8851c8fa3963eb6b44f448ea08a315fde5fd3e01289001 Request headers :path /wp-content/uploads/2021/06/image4.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority research.checkpoint.com referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ :scheme https sec-fetch-site same-origin :method GET Referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT cf-cache-status HIT age 6530 cf-polished origFmt=png, origSize=145980 content-disposition inline; filename="image4.webp" alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 58784 cf-request-id 0a736fa7be00001d1e5d3ac000000001 last-modified Thu, 03 Jun 2021 08:13:36 GMT server cloudflare etag "60b88f30-23a3c" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cf-ray 6598e885fea61d1e-CPH cf-bgj imgq:100,h2pri
GET H3-29	200	image5.png research.checkpoint.com/wp-content/uploads/2021/06/	55 KB 55 KB	53ms 52ms	Image image/webp	141.193.213.21 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://research.checkpoint.com/wp-content/uploads/2021/06/image5.png Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash af054cb000b38cb2fad3242e82968cf0f37d18f1ae7ce10f705e686d143560b6 Request headers :path /wp-content/uploads/2021/06/image5.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority research.checkpoint.com referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ :scheme https sec-fetch-site same-origin :method GET Referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT cf-cache-status HIT age 6447 cf-polished origFmt=png, origSize=93485 content-disposition inline; filename="image5.webp" alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 56006 cf-request-id 0a736fa7c000001d1e47174000000001 last-modified Thu, 03 Jun 2021 08:13:37 GMT server cloudflare etag "60b88f31-16d2d" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cf-ray 6598e885feaa1d1e-CPH cf-bgj imgq:100,h2pri
GET H3-29	200	image6.png research.checkpoint.com/wp-content/uploads/2021/06/	80 KB 80 KB	36ms 35ms	Image image/webp	141.193.213.21 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://research.checkpoint.com/wp-content/uploads/2021/06/image6.png Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 7df19302c2f804212d3cb7aab537a16ba353d953bd8cccd82c195f1f601fa68a Request headers :path /wp-content/uploads/2021/06/image6.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority research.checkpoint.com referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ :scheme https sec-fetch-site same-origin :method GET Referer https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT cf-cache-status HIT age 6287 cf-polished origFmt=png, origSize=131675 content-disposition inline; filename="image6.webp" alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 81690 cf-request-id 0a736fa7be00001d1ee785c000000001 last-modified Thu, 03 Jun 2021 08:06:32 GMT server cloudflare etag "60b88d88-2025b" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cf-ray 6598e885feac1d1e-CPH cf-bgj imgq:100,h2pri
GET H2	200	5a3031770f16c70012a3c297.js Show response buttons-config.sharethis.com/js/	525 B 879 B	84ms 22ms	Script text/javascript	2600:9000:218e:8600:c:abe:f440:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://buttons-config.sharethis.com/js/5a3031770f16c70012a3c297.js Requested by Host: platform-api.sharethis.com URL: https://platform-api.sharethis.com/js/sharethis.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:218e:8600:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash eee6d8fe37122ba1538560131fe5c95f9a4b6c45e2059076a7a92513fcb12f20 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:25:21 GMT via 1.1 bd03106f662746adc3512ff682754ad0.cloudfront.net (CloudFront) last-modified Tue, 12 Dec 2017 19:43:54 GMT server AmazonS3 age 50 etag "29c30155cdf2eaa96943948b94d537b6" x-cache Hit from cloudfront content-type text/javascript cache-control max-age=60,public x-amz-cf-pop CDG52-P1 accept-ranges bytes content-length 525 x-amz-cf-id 4jNPnlRhd887JiM1pWvkxNy9rUD8E26Rb_KEZCJHLWWzJY8tbIG7Aw==
GET H2	200	portal-v2.html Show response c.sharethis.mgr.consensu.org/ Frame D09B	2 KB 1 KB	73ms 23ms	Document text/html	2600:9000:218e:5a00:c:a9b7:ddc0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.sharethis.mgr.consensu.org/portal-v2.html Requested by Host: platform-api.sharethis.com URL: https://platform-api.sharethis.com/js/sharethis.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:218e:5a00:c:a9b7:ddc0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash ac84513c4c5ea7e4458e91c46e33ba71b56e19fabf93cc079ffcb01a975c2e3d Request headers :method GET :authority c.sharethis.mgr.consensu.org :scheme https :path /portal-v2.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://research.checkpoint.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer https://research.checkpoint.com/ Response headers content-type text/html; charset=utf-8 content-encoding gzip date Thu, 03 Jun 2021 12:25:19 GMT cache-control max-age=3600, public etag W/"83a-K1Ex0xzH2LCxSyRnDnyZEg18N68" vary Accept-Encoding x-cache Hit from cloudfront via 1.1 280bb21cc570c951a4ab6ce0d284fba4.cloudfront.net (CloudFront) x-amz-cf-pop CDG52-P1 x-amz-cf-id odgOel6DsKQ_wqs-9bbRRpAMlzZtxdzfAmbqhrbzpKywpIsK2_DfxA== age 51
GET H/1.1	200 OK	6si.min.js Show response j.6sc.co/	23 KB 8 KB	104ms 35ms	Script application/javascript	104.109.89.85 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: t.co URL: https://t.co/ibMnytxFVI Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.109.89.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-89-85.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash da1b60970149580c709bbc357622d24e7029d658e852e74ef1d861ffb22ad219 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:10 GMT Content-Encoding gzip X-Content-Type-Options nosniff Connection keep-alive Vary Accept-Encoding Content-Length 7764 Pragma no-cache Last-Modified Wed, 17 Mar 2021 01:04:50 GMT Server nginx/1.14.0 (Ubuntu) ETag "605155b2-5d6b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type application/javascript Access-Control-Allow-Origin Cache-Control private, no-cache, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Thu, 03 Jun 2021 12:26:10 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	48 KB 19 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:827::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Fri, 09 Apr 2021 23:59:54 GMT server Golfe2 age 4487 date Thu, 03 Jun 2021 11:11:23 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 19569 expires Thu, 03 Jun 2021 13:11:23 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 93 B	20ms 19ms	XHR text/plain	2a00:1450:400c:c0a::9d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j90&tid=UA-194688-3&cid=1134513090.1622723170&jid=632031804&gjid=89196801&_gid=383040952.1622723170&_u=YGBAgEABAAAAAE~&z=1473354990 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c0a::9d Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Thu, 03 Jun 2021 12:26:10 GMT content-type text/plain access-control-allow-origin https://research.checkpoint.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-29	200	collect www.google-analytics.com/	35 B 55 B	9ms 8ms	Image image/gif	2a00:1450:4001:827::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j90&a=542133226&t=pageview&_s=1&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor%2F&dr=https%3A%2F%2Ft.co%2F&ul=en-us&de=UTF-8&dt=SharpPanda%3A%20Chinese%20APT%20Group%20Targets%20Southeast%20Asian%20Government%20With%20Previously%20Unknown%20Backdoor%20-%20Check%20Point%20Research&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAgEAB~&jid=632031804&gjid=89196801&cid=1134513090.1622723170&tid=UA-194688-3&_gid=383040952.1622723170&gtm=2wg5q15JCRGP&z=107303035 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Thu, 03 Jun 2021 04:05:27 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 30043 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H2	200	twitter.svg platform-cdn.sharethis.com/img/	731 B 1 KB	81ms 22ms	Image image/svg+xml	2600:9000:218f:aa00:1d:85c3:6640:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://platform-cdn.sharethis.com/img/twitter.svg Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:218f:aa00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 7c93346d4f681a0be90d1dfc19346382a4700f1810f41caa54415688dee1777f Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Tue, 18 May 2021 09:16:00 GMT via 1.1 ef16cf332760e013a5fd2d10ab2b11ec.cloudfront.net (CloudFront) last-modified Thu, 10 Oct 2019 01:20:13 GMT server AmazonS3 age 1393811 etag "0af2fb38987598376c99e21af17ade45" x-cache Hit from cloudfront content-type image/svg+xml cache-control public, max-age=2592000 x-amz-cf-pop CDG52-P2 accept-ranges bytes content-length 731 x-amz-cf-id 58qmZKSAAdz1U_vYsRgAZxz5gsLchQDAfB5gGLWNaGIr1iKM4f7zRg==
GET H2	200	whatsapp.svg platform-cdn.sharethis.com/img/	832 B 1 KB	81ms 22ms	Image image/svg+xml	2600:9000:218f:aa00:1d:85c3:6640:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://platform-cdn.sharethis.com/img/whatsapp.svg Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:218f:aa00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 847eb36b4dc4b05f94052dcd98077319e74d882334a106bb9ca451ba211c9c2c Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Tue, 18 May 2021 10:59:16 GMT via 1.1 ef16cf332760e013a5fd2d10ab2b11ec.cloudfront.net (CloudFront) last-modified Thu, 10 Oct 2019 01:20:13 GMT server AmazonS3 age 1387615 etag "afe7fc60ed757db39a88d2950fce69c9" x-cache Hit from cloudfront content-type image/svg+xml cache-control public, max-age=2592000 x-amz-cf-pop CDG52-P2 accept-ranges bytes content-length 832 x-amz-cf-id 56TbCP1oiGPAa5jv49UCN8F9W3aCIv5zzSYEjQzNJppfIurLfeOq4Q==
GET H2	200	facebook.svg platform-cdn.sharethis.com/img/	301 B 677 B	84ms 26ms	Image image/svg+xml	2600:9000:218f:aa00:1d:85c3:6640:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://platform-cdn.sharethis.com/img/facebook.svg Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:218f:aa00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Mon, 17 May 2021 02:42:02 GMT via 1.1 ef16cf332760e013a5fd2d10ab2b11ec.cloudfront.net (CloudFront) last-modified Thu, 10 Oct 2019 01:20:12 GMT server AmazonS3 age 1503849 etag "c6e9be45643e197ce1db1d7e24a99adc" x-cache Hit from cloudfront content-type image/svg+xml cache-control public, max-age=2592000 x-amz-cf-pop CDG52-P2 accept-ranges bytes content-length 301 x-amz-cf-id MA0jcIf19Qhs-r0uBpNKn9xVig5IdU_i2E9LOL5JaSa5Y41AtNEWDA==
GET H2	200	linkedin.svg platform-cdn.sharethis.com/img/	456 B 832 B	85ms 26ms	Image image/svg+xml	2600:9000:218f:aa00:1d:85c3:6640:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://platform-cdn.sharethis.com/img/linkedin.svg Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:218f:aa00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash cb8c2b19fd9b56c41db14bd71b5c0616c1ba4e99b08c8e75084cf695f74b7120 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Mon, 17 May 2021 00:13:12 GMT via 1.1 ef16cf332760e013a5fd2d10ab2b11ec.cloudfront.net (CloudFront) last-modified Thu, 10 Oct 2019 01:20:12 GMT server AmazonS3 age 1512779 etag "fa43b4ede18498b114fc7185993f6da7" x-cache Hit from cloudfront content-type image/svg+xml cache-control public, max-age=2592000 x-amz-cf-pop CDG52-P2 accept-ranges bytes content-length 456 x-amz-cf-id gsO7Mi1ufot9-TDJ3fX9UJpYLqim8uJco6iwbsKhhlbSxJ0VAaigvw==
GET H2	200	email.svg platform-cdn.sharethis.com/img/	343 B 720 B	84ms 26ms	Image image/svg+xml	2600:9000:218f:aa00:1d:85c3:6640:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://platform-cdn.sharethis.com/img/email.svg Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:218f:aa00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 5f5012132c752db2433e17712d91ef8689f1bc95167b2720e23224c2ae62e009 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Thu, 13 May 2021 19:38:41 GMT via 1.1 ef16cf332760e013a5fd2d10ab2b11ec.cloudfront.net (CloudFront) last-modified Thu, 10 Oct 2019 01:20:12 GMT server AmazonS3 age 1788450 etag "5977437466e857c7ddcadda6f6d88c2a" x-cache Hit from cloudfront content-type image/svg+xml cache-control public, max-age=2592000 x-amz-cf-pop CDG52-P2 accept-ranges bytes content-length 343 x-amz-cf-id cnDuj9_ovqE-Z5GLDwVEiiT86TE7Ab1c-RXuSbbrrMiG1Veldb21Kg==
GET H2	200	pinterest.svg platform-cdn.sharethis.com/img/	771 B 1 KB	84ms 26ms	Image image/svg+xml	2600:9000:218f:aa00:1d:85c3:6640:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://platform-cdn.sharethis.com/img/pinterest.svg Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:218f:aa00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash efc737b4f58cfe73a9bd0e57d7570365701381da31e628b269e7217a0ce3359d Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Wed, 19 May 2021 15:08:19 GMT via 1.1 ef16cf332760e013a5fd2d10ab2b11ec.cloudfront.net (CloudFront) last-modified Thu, 10 Oct 2019 01:20:13 GMT server AmazonS3 age 1286272 etag "2b10a062e719c64b686e2e8fcdc216dc" x-cache Hit from cloudfront content-type image/svg+xml cache-control public, max-age=2592000 x-amz-cf-pop CDG52-P2 accept-ranges bytes content-length 771 x-amz-cf-id NCHrv_fGfkO-gZM7olqvGoED9swz396vsCrRfFK43QWheIgYwyskOQ==
GET H2	200	sharethis.svg platform-cdn.sharethis.com/img/	514 B 890 B	26ms 21ms	Image image/svg+xml	2600:9000:218f:aa00:1d:85c3:6640:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://platform-cdn.sharethis.com/img/sharethis.svg Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:218f:aa00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 9a83c65bdd0ff9488af9d25720686457ea7295c9c44f9f1d285a0c9ec89bab99 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Sun, 16 May 2021 20:31:22 GMT via 1.1 ef16cf332760e013a5fd2d10ab2b11ec.cloudfront.net (CloudFront) last-modified Thu, 10 Oct 2019 01:20:13 GMT server AmazonS3 age 1526089 etag "deecdaa377907db5cc1722fc831670a1" x-cache Hit from cloudfront content-type image/svg+xml cache-control public, max-age=2592000 x-amz-cf-pop CDG52-P2 accept-ranges bytes content-length 514 x-amz-cf-id gwCKUKseuuekDzOlCi1aqI0FodHxBNAZYESPrzZCa53asttzxMe1DA==
GET H2	200	reddit.svg platform-cdn.sharethis.com/img/	910 B 1 KB	26ms 22ms	Image image/svg+xml	2600:9000:218f:aa00:1d:85c3:6640:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://platform-cdn.sharethis.com/img/reddit.svg Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:218f:aa00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash dadbb59b37bfea4c78c6e15c8cbb96dfba84526e43a0767dc244fd062a841aba Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Tue, 04 May 2021 20:48:09 GMT via 1.1 ef16cf332760e013a5fd2d10ab2b11ec.cloudfront.net (CloudFront) last-modified Thu, 10 Oct 2019 01:20:13 GMT server AmazonS3 age 2561882 etag "78d796ca648d8a5e665b48ed0217c56a" x-cache Hit from cloudfront content-type image/svg+xml cache-control public, max-age=2592000 x-amz-cf-pop CDG52-P2 accept-ranges bytes content-length 910 x-amz-cf-id iUq95U9bC1xFkG3ESb5m-lUn9xxkBe6MXnNDXV4jMPbjkiQ-L2bF2w==
GET H2	200	arrow_left.svg platform-cdn.sharethis.com/img/	565 B 942 B	26ms 22ms	Image image/svg+xml	2600:9000:218f:aa00:1d:85c3:6640:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://platform-cdn.sharethis.com/img/arrow_left.svg Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:218f:aa00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 5c833b1818762f1e134fbb158447fb0b92f2b018b15aa36f2e2405213f830d38 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Tue, 11 May 2021 17:17:44 GMT via 1.1 ef16cf332760e013a5fd2d10ab2b11ec.cloudfront.net (CloudFront) last-modified Thu, 10 Oct 2019 01:20:12 GMT server AmazonS3 age 1969707 etag "b55d8d2b9321e381a3c38a4bddb74037" x-cache Hit from cloudfront content-type image/svg+xml cache-control public, max-age=2592000 x-amz-cf-pop CDG52-P2 accept-ranges bytes content-length 565 x-amz-cf-id VsHR1-7cgkjEVn8TPuprzvvEr2zln1fclG9VTTpP-1O1tiouFOFhNQ==
GET H2	200	arrow_right.svg platform-cdn.sharethis.com/img/	565 B 941 B	35ms 31ms	Image image/svg+xml	2600:9000:218f:aa00:1d:85c3:6640:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://platform-cdn.sharethis.com/img/arrow_right.svg Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:218f:aa00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 1bae747c7fd090f56608956a97c870391e1c43f89d24d5766129b75628985c1e Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Thu, 20 May 2021 21:27:00 GMT via 1.1 ef16cf332760e013a5fd2d10ab2b11ec.cloudfront.net (CloudFront) last-modified Thu, 10 Oct 2019 01:20:12 GMT server AmazonS3 age 1177151 etag "9928d025bd5792b718ee0a185f62e67c" x-cache Hit from cloudfront content-type image/svg+xml cache-control public, max-age=2592000 x-amz-cf-pop CDG52-P2 accept-ranges bytes content-length 565 x-amz-cf-id 34e1QwRQ9RTciEDfQ16DNcdzL50WYpS2_JSpKoVHOcB60OiLYiw4hQ==
GET H2	200	ga-audiences www.google.com/ads/	42 B 107 B	34ms 33ms	Image image/gif	2a00:1450:4001:827::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-194688-3&cid=1134513090.1622723170&jid=632031804&_u=YGBAgEABAAAAAE~&z=1383818241 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Thu, 03 Jun 2021 12:26:10 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 107 B	35ms 34ms	Image image/gif	2a00:1450:4001:827::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-194688-3&cid=1134513090.1622723170&jid=632031804&_u=YGBAgEABAAAAAE~&z=1383818241 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Thu, 03 Jun 2021 12:26:10 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	204 No Content	pview Show response l.sharethis.com/	0 345 B	131ms 35ms	XHR text/plain	52.58.221.124 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://l.sharethis.com/pview?event=pview&hostname=research.checkpoint.com&location=%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor%2F&product=sticky-share-buttons&url=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor%2F&source=sharethis.js&fcmp=false&fcmpv2=false&has_segmentio=false&title=SharpPanda%3A%20Chinese%20APT%20Group%20Targets%20Southeast%20Asian%20Government%20With%20Previously%20Unknown%20Backdoor%20-%20Check%20Point%20Research&refDomain=t.co&cms=unknown&publisher=5a3031770f16c70012a3c297&sop=true&bsamesite=true&consent_cookie_duration=165&consent_duration=165&gdpr_domain=.consensu.org&gdpr_method=cookie&version=st_sop.js&lang=en&description=Introduction%20Check%20Point%20Research%20identified%20an%20ongoing%20surveillance%20operation%20targeting%20a%20Southeast%20Asian%20government.%20The%20attackers%20use%20spear-phishing%20to%20gain%20initial%20access%20and%20leverage%20old%20Microsoft%20Office%20vulnerabilities%20together%20with%20the%20chain%20of%20in-memory%20loaders%20to%20attempt%20and%20install%20a%20previously%20unknown%20backdoor%20on%20victim%E2%80%99s%20machines.%20Our%20investigation%20shows%20the%20operation%20was%20carried%20out%20by...%20Click%20to%20Read%20More Requested by Host: platform-api.sharethis.com URL: https://platform-api.sharethis.com/js/sharethis.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.58.221.124 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-58-221-124.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:10 GMT Access-Control-Max-Age 1728000 Access-Control-Allow-Origin https://research.checkpoint.com Access-Control-Expose-Headers stid Cache-Control no-cache, no-store, must-revalidate Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers *
GET H/1.1	204 No Content	log l.sharethis.com/	0 315 B	139ms 44ms	Image text/plain	52.58.221.124 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://l.sharethis.com/log?event=ibl&url=https%3A%2F%2Ft.co%2F&fcmp=false&fcmpv2=false&has_segmentio=false&product=sticky-share-buttons&publisher=5a3031770f16c70012a3c297&refDomain=t.co&refQuery=&source=sharethis.js&title=SharpPanda%3A%20Chinese%20APT%20Group%20Targets%20Southeast%20Asian%20Government%20With%20Previously%20Unknown%20Backdoor%20-%20Check%20Point%20Research&ts=1622723170441&sop=true&cms=unknown&gdpr_domain=.consensu.org&gdpr_method=cookie&description=Introduction%20Check%20Point%20Research%20identified%20an%20ongoing%20surveillance%20operation%20targeting%20a%20Southeast%20Asian%20government.%20The%20attackers%20use%20spear-phishing%20to%20gain%20initial%20access%20and%20leverage%20old%20Microsoft%20Office%20vulnerabilities%20together%20with%20the%20chain%20of%20in-memory%20loaders%20to%20attempt%20and%20install%20a%20previously%20unknown%20backdoor%20on%20victim%E2%80%99s%20machines.%20Our%20investigation%20shows%20the%20operation%20was%20carried%20out%20by...%20Click%20to%20Read%20More Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.58.221.124 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-58-221-124.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:10 GMT Access-Control-Max-Age 1728000 Access-Control-Allow-Origin * Access-Control-Expose-Headers stid Cache-Control no-cache, no-store, must-revalidate Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers *
GET H/1.1	200 OK	/ Show response c.6sc.co/	47 B 379 B	113ms 32ms	XHR text/plain	104.109.89.85 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.109.89.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-89-85.deploy.static.akamaitechnologies.com Software / Resource Hash 54320eb9d5317e662905581f0a61810ff8473173b8caa631895a88bda2cd1f31 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:10 GMT Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type text/plain Access-Control-Allow-Origin https://research.checkpoint.com Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Content-Length 47
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	284ms 206ms	Image image/gif	104.109.89.85 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&session=825b0b4c-1113-40f8-8420-81ba0feca36a&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2003%20Jun%202021%2012%3A26%3A10%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22SharpPanda%3A%20Chinese%20APT%20Group%20Targets%20Southeast%20Asian%20Government%20With%20Previously%20Unknown%20Backdoor%20-%20Check%20Point%20Research%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor%2F&pageViewId=2ed83740-d408-4a76-86d3-d2f9531769ab Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.109.89.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-89-85.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:10 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
OPTIONS H2	200	details epsilon.6sense.com/v3/company/ Frame	0 0	111ms 33ms	Preflight	3.65.155.204 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Protocol H2 Server 3.65.155.204 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-65-155-204.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Method GET Access-Control-Request-Headers authorization,epsiloncookie Origin https://research.checkpoint.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode cors Response headers date Thu, 03 Jun 2021 12:26:10 GMT server nginx access-control-allow-origin https://research.checkpoint.com access-control-allow-credentials true access-control-max-age 1800 access-control-allow-methods OPTIONS,GET access-control-allow-headers authorization,epsiloncookie
GET H2	200	details Show response epsilon.6sense.com/v3/company/	442 B 470 B	104ms 40ms	XHR application/json	3.65.155.204 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.65.155.204 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-65-155-204.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 43975566bd47361d525e46fb2b570561b172dae7f71bb7c4b18880abad9c6552 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer https://research.checkpoint.com/ Authorization Token 87c67a7c5a9e9b4dd1824f6727ed4e43fadadde4 EpsilonCookie 9fb51002c342000062cab860aa010000b90e1900 Response headers date Thu, 03 Jun 2021 12:26:10 GMT content-encoding gzip server nginx vary Accept-Encoding content-type application/json access-control-allow-origin https://research.checkpoint.com access-control-allow-credentials true content-length 280
GET H/1.1	200 OK	insight.min.js Show response snap.licdn.com/li.lms-analytics/	4 KB 2 KB	9ms 6ms	Script application/x-javascript	2a02:26f0:6c00:28c::25ea AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00:28c::25ea Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 5f3b103a1268f862a5e432d607f8e5220dea9d301d13565b0ecded3ad9c25ab2 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:10 GMT Content-Encoding gzip Last-Modified Mon, 04 Jan 2021 22:14:03 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=76430 Connection keep-alive Accept-Ranges bytes Content-Length 1855
GET H2	200	uwt.js Show response static.ads-twitter.com/	5 KB 2 KB	99ms 30ms	Script application/javascript	199.232.136.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.136.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 4cf52cc73734aa71f26f6a10be9aeec89602af45bf0f9abd5c8445a076c1ae1a Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT via 1.1 varnish last-modified Fri, 04 Dec 2020 00:21:46 GMT age 41664 etag "cbc512946c8abb461c6215ed5b454e5f+gzip" vary Accept-Encoding,Host x-cache HIT p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" content-encoding gzip cache-control no-cache accept-ranges bytes content-type application/javascript; charset=utf-8 content-length 1957 x-timer S1622723171.841864,VS0,VE0 x-served-by cache-hhn11531-HHN
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/	1 KB 1 KB	35ms 34ms	Script application/x-javascript	104.111.234.67 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin.js Requested by Host: t.co URL: https://t.co/ibMnytxFVI Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-234-67.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 026c5db877da222d2316bf1197b8947a96c7623d51a4d462c91bf927dece3429 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:10 GMT Content-Encoding gzip Last-Modified Fri, 28 May 2021 01:40:41 GMT Server AkamaiNetStorage ETag "5379c4a40ff8ae9d2fc6484dd1c57349:1622166041.794746" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 753
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	92 KB 24 KB	8ms 6ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: t.co URL: https://t.co/ibMnytxFVI Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 3ba5369627fc324f2d2c47f44c8da30769d2a3ccbe8110b9bd5eec9585e42a09 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 24155 x-fb-rlafr 0 pragma public x-fb-debug LAu6zTkTnA3RH/0m6Wp43C/RkxE/r2C9qo6uoTRL2bPC4g0RQFwhray8HncAdJIk1XgZIx3nEj/ci3C/9YFuYA== x-fb-trip-id 686109401 x-frame-options DENY date Thu, 03 Jun 2021 12:26:10 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 x-xss-protection 0 cache-control public, max-age=1200 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	collect px.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1622723170775&url=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-u... https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D51830%26time%3D1622723170775%26url%3Dhttps%253A%252F%252Fresearch.checkpoint.com%... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1622723170775&url=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-u...	0 132 B	197ms 197ms	Image application/javascript	2620:119:50e1:101::6cae:b25 LINKEDIN
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1622723170775&url=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor%2F&liSync=true Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:119:50e1:101::6cae:b25 , United States, ASN14413 (LINKEDIN, US), Reverse DNS Software Play / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:11 GMT server Play linkedin-action 1 x-li-fabric prod-lor1 x-li-proto http/2 x-li-pop prod-esv5 content-type application/javascript content-length 0 x-li-uuid r/3AbiAShRZAQiZ+FisAAA== Redirect headers content-security-policy default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self' x-content-type-options nosniff linkedin-action 1 x-cache CONFIG_NOCACHE content-length 0 x-li-uuid iucGYyAShRagCjRGHisAAA== pragma no-cache x-li-pop afd-prod-esv5 x-msedge-ref Ref A: 12F966E2E3C149648D8245E8DBD654C4 Ref B: FRAEDGE1119 Ref C: 2021-06-03T12:26:10Z x-frame-options sameorigin date Thu, 03 Jun 2021 12:26:10 GMT expect-ct max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct" strict-transport-security max-age=31536000 x-li-fabric prod-lor1 location https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1622723170775&url=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor%2F&liSync=true cache-control no-cache, no-store x-li-proto http/2 expires Thu, 01 Jan 1970 00:00:00 GMT
GET H3-29	200	1692853834349189 Show response connect.facebook.net/signals/config/	254 KB 72 KB	10ms 7ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/1692853834349189?v=2.9.40&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash f5c3a3c81e297d35e1237e5ac9ae3a908edb81a6b74d7b2471deb801c40634a1 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c; content-encoding gzip x-content-type-options nosniff x-xss-protection 0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 74042 x-fb-rlafr 0 pragma public x-fb-debug DPpem0+ghzsY8Q2OL235NyT1HrPghoutZ6izmca6hkJPpMkN40WJb20Vip1HdEVGzmTTng/5ojUS1VRO6wSpAg== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Thu, 03 Jun 2021 12:26:10 GMT strict-transport-security max-age=31536000; preload; includeSubDomains report-to {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]} content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
POST H3-29	200	collect Show response www.google-analytics.com/j/	2 B 22 B	26ms 26ms	XHR text/plain	2a00:1450:4001:827::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j90&a=542133226&t=event&ni=1&_s=1&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor%2F&dr=https%3A%2F%2Ft.co%2F&ul=en-us&de=UTF-8&dt=SharpPanda%3A%20Chinese%20APT%20Group%20Targets%20Southeast%20Asian%20Government%20With%20Previously%20Unknown%20Backdoor%20-%20Check%20Point%20Research&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=aGDAAEABAAAAAG~&jid=588239165&gjid=610795741&cid=1134513090.1622723170&tid=UA-194688-3&_gid=383040952.1622723170&_r=1&gtm=2wg5q15JCRGP&cd9=Webbuddy&cd10=webbuddy.dk&cd11=&cd12=&cd13=&cd14=&cd17=Denmark&z=1241426880 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 03 Jun 2021 12:26:10 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://research.checkpoint.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/160/	11 KB 6 KB	33ms 33ms	Script application/x-javascript	104.111.234.67 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/160/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-234-67.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 99fa5a280296b5fc7b63433ee121a359fc68c4a37f04a87d363e751164b96ff1 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:10 GMT Content-Encoding gzip Last-Modified Fri, 19 Feb 2021 02:54:38 GMT Server AkamaiNetStorage ETag "19a9335fd71267d56e65bc19390f3100:1613703278.138281" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Cache-Control max-age=8640000 Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 4811 Expires Sat, 11 Sep 2021 12:26:10 GMT
GET H2	200	/ www.facebook.com/tr/	44 B 147 B	6ms 6ms	Image image/gif	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=1692853834349189&ev=PageView&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor%2F&rl=https%3A%2F%2Ft.co%2F&if=false&ts=1622723170840&sw=1600&sh=1200&v=2.9.40&r=stable&ec=0&o=30&fbp=fb.1.1622723170838.1053803882&it=1622723170796&coo=false&exp=l0&rqm=GET Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 44 expires Thu, 03 Jun 2021 12:26:10 GMT
POST H3-29	200	collect Show response stats.g.doubleclick.net/j/	4 B 25 B	21ms 21ms	XHR text/plain	2a00:1450:400c:c08::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j90&tid=UA-194688-3&cid=1134513090.1622723170&jid=588239165&gjid=610795741&_gid=383040952.1622723170&_u=aGDAAEABAAAAAG~&z=945343358 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:400c:c08::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Thu, 03 Jun 2021 12:26:10 GMT content-type text/plain access-control-allow-origin https://research.checkpoint.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	adsct Show response analytics.twitter.com/i/	31 B 659 B	235ms 153ms	Script application/javascript	104.244.42.3 TWITTER
General Check archive.org Show headers Download Go to Full URL https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0&txn_id=nxi3o&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor%2F Requested by Host: static.ads-twitter.com URL: https://static.ads-twitter.com/uwt.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.3 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf Security Headers Name Value Strict-Transport-Security max-age=631138519 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:11 GMT content-encoding gzip x-content-type-options nosniff p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" status 200 OK x-twitter-response-tags BouncerCompliant content-length 57 x-xss-protection 0 pragma no-cache last-modified Thu, 03 Jun 2021 12:26:11 GMT server tsa_o x-frame-options SAMEORIGIN strict-transport-security max-age=631138519 content-type application/javascript;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash 647f5b4ae1ca6b753b87e3de71122aab23c0fe8f8984c99de3114a8bbf6075ea x-transaction 40c9b74250fc19c6 expires Tue, 31 Mar 1981 05:00:00 GMT
GET H2	200	adsct t.co/i/	43 B 360 B	145ms 144ms	Image image/gif	104.244.42.69 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0&txn_id=nxi3o&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor%2F Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.69 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:10 GMT content-encoding gzip x-content-type-options nosniff status 200 OK x-twitter-response-tags BouncerCompliant content-length 65 x-xss-protection 0 pragma no-cache last-modified Thu, 03 Jun 2021 12:26:10 GMT server tsa_o x-frame-options SAMEORIGIN strict-transport-security max-age=0 content-type image/gif;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash 89ba3e1329cb9a0fd6fb544f6bf1d92213c106668d073e297bb7bed3263b6c15 x-transaction 879a2c6cc7b30f81 expires Tue, 31 Mar 1981 05:00:00 GMT
GET H3-29	200	ga-audiences www.google.com/ads/	42 B 72 B	35ms 34ms	Image image/gif	2a00:1450:4001:827::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-194688-3&cid=1134513090.1622723170&jid=588239165&_u=aGDAAEABAAAAAG~&z=70055984 Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Thu, 03 Jun 2021 12:26:10 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-29	200	ga-audiences www.google.de/ads/	42 B 63 B	35ms 35ms	Image image/gif	2a00:1450:4001:80f::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-194688-3&cid=1134513090.1622723170&jid=588239165&_u=aGDAAEABAAAAAG~&z=70055984 Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Thu, 03 Jun 2021 12:26:10 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H3-29	200	/ www.facebook.com/tr/	0 15 B	7ms 6ms	Ping text/plain	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type multipart/form-data; boundary=----WebKitFormBoundary1BssCBDoGIAsbAOw Response headers strict-transport-security max-age=31536000; includeSubDomains server proxygen-bolt date Thu, 03 Jun 2021 12:26:11 GMT content-type text/plain access-control-allow-origin https://research.checkpoint.com access-control-allow-credentials true cross-origin-resource-policy cross-origin content-length 0 alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 priority u=3,i
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	285ms 284ms	Image image/gif	104.109.89.85 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=9fb51002c342000062cab860aa010000b90e1900&session=825b0b4c-1113-40f8-8420-81ba0feca36a&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2003%20Jun%202021%2012%3A26%3A11%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2003%20Jun%202021%2012%3A26%3A10%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%221003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22SharpPanda%3A%20Chinese%20APT%20Group%20Targets%20Southeast%20Asian%20Government%20With%20Previously%20Unknown%20Backdoor%20-%20Check%20Point%20Research%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor%2F&pageViewId=2ed83740-d408-4a76-86d3-d2f9531769ab Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.109.89.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-89-85.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:11 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	343ms 342ms	Image image/gif	104.109.89.85 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=9fb51002c342000062cab860aa010000b90e1900&session=825b0b4c-1113-40f8-8420-81ba0feca36a&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2003%20Jun%202021%2012%3A26%3A12%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2003%20Jun%202021%2012%3A26%3A11%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22SharpPanda%3A%20Chinese%20APT%20Group%20Targets%20Southeast%20Asian%20Government%20With%20Previously%20Unknown%20Backdoor%20-%20Check%20Point%20Research%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor%2F&pageViewId=2ed83740-d408-4a76-86d3-d2f9531769ab Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.109.89.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-89-85.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:12 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	248ms 247ms	Image image/gif	104.109.89.85 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=9fb51002c342000062cab860aa010000b90e1900&session=825b0b4c-1113-40f8-8420-81ba0feca36a&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2003%20Jun%202021%2012%3A26%3A13%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2003%20Jun%202021%2012%3A26%3A12%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22SharpPanda%3A%20Chinese%20APT%20Group%20Targets%20Southeast%20Asian%20Government%20With%20Previously%20Unknown%20Backdoor%20-%20Check%20Point%20Research%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor%2F&pageViewId=2ed83740-d408-4a76-86d3-d2f9531769ab Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.109.89.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-89-85.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:13 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	240ms 240ms	Image image/gif	104.109.89.85 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=9fb51002c342000062cab860aa010000b90e1900&session=825b0b4c-1113-40f8-8420-81ba0feca36a&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2003%20Jun%202021%2012%3A26%3A14%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2003%20Jun%202021%2012%3A26%3A13%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224006%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22SharpPanda%3A%20Chinese%20APT%20Group%20Targets%20Southeast%20Asian%20Government%20With%20Previously%20Unknown%20Backdoor%20-%20Check%20Point%20Research%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor%2F&pageViewId=2ed83740-d408-4a76-86d3-d2f9531769ab Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.109.89.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-89-85.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:14 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	284ms 222ms	Image image/gif	104.109.89.85 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=9fb51002c342000062cab860aa010000b90e1900&session=825b0b4c-1113-40f8-8420-81ba0feca36a&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2003%20Jun%202021%2012%3A26%3A15%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2003%20Jun%202021%2012%3A26%3A14%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225007%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22SharpPanda%3A%20Chinese%20APT%20Group%20Targets%20Southeast%20Asian%20Government%20With%20Previously%20Unknown%20Backdoor%20-%20Check%20Point%20Research%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor%2F&pageViewId=2ed83740-d408-4a76-86d3-d2f9531769ab Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.109.89.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-89-85.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:15 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	wxbvs5zxy7iy.js Show response js.driftt.com/include/1622723400000/	214 KB 61 KB	228ms 149ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/include/1622723400000/wxbvs5zxy7iy.js Requested by Host: t.co URL: https://t.co/ibMnytxFVI Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 77c75e10a40eaea70d8fa341bec3ec4838d870f50bcf58572b0524aa44c4cb9c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-amz-version-id C0MTiTCZkhGRRaMWI78i3U0NrnxFOsPA content-encoding gzip etag W/"737a53bb9b4d5a41bfd506ab5288e60a" x-amz-cf-pop CDG52-P2 x-amz-server-side-encryption AES256 x-cache RefreshHit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Wed, 02 Jun 2021 14:45:46 GMT server nginx date Thu, 03 Jun 2021 12:26:15 GMT vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control no-cache access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id e20PhLKBhCSjDQxBbcWf26D9j4ae7G7UbhXO1SVGqmjuqwtgmOBEPA==
GET H2	200	core Show response js.driftt.com/ Frame 9745	4 KB 1 KB	135ms 134ms	Document text/html	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT Requested by Host: js.driftt.com URL: https://js.driftt.com/include/1622723400000/wxbvs5zxy7iy.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash d5f5514bb2ea9fdd18cbbe2c7860582d748ac42f5b08733fa36aa380725ac79b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers :method GET :authority js.driftt.com :scheme https :path /core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://research.checkpoint.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer https://research.checkpoint.com/ Response headers content-type text/html; charset=utf-8 server nginx last-modified Wed, 02 Jun 2021 14:45:34 GMT x-amz-server-side-encryption AES256 x-amz-version-id DuEPrUDcp_y0Ao8X_bYzHzm8YDqRAmbQ access-control-allow-origin * access-control-allow-credentials true access-control-allow-methods GET, POST, OPTIONS access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip date Thu, 03 Jun 2021 12:26:16 GMT cache-control no-cache etag W/"2f852f47787316f71514676e2909b16b" vary Accept-Encoding x-cache RefreshHit from cloudfront via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) x-amz-cf-pop CDG52-P2 x-amz-cf-id PR2h7IjTVD-4SY-9bLGL2W1ZEpOJkll7XODRYKWHoohqjAF1MiwUMw==
GET H2	200	chat Show response js.driftt.com/core/ Frame F2B4	4 KB 1 KB	298ms 298ms	Document text/html	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/chat Requested by Host: js.driftt.com URL: https://js.driftt.com/include/1622723400000/wxbvs5zxy7iy.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash d5f5514bb2ea9fdd18cbbe2c7860582d748ac42f5b08733fa36aa380725ac79b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers :method GET :authority js.driftt.com :scheme https :path /core/chat pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://research.checkpoint.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer https://research.checkpoint.com/ Response headers content-type text/html; charset=utf-8 server nginx last-modified Wed, 02 Jun 2021 14:45:34 GMT x-amz-server-side-encryption AES256 x-amz-version-id DuEPrUDcp_y0Ao8X_bYzHzm8YDqRAmbQ access-control-allow-origin * access-control-allow-credentials true access-control-allow-methods GET, POST, OPTIONS access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip date Thu, 03 Jun 2021 12:26:16 GMT cache-control no-cache etag W/"2f852f47787316f71514676e2909b16b" vary Accept-Encoding x-cache RefreshHit from cloudfront via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) x-amz-cf-pop CDG52-P2 x-amz-cf-id 3E5b1d7NLbHTKSkcuhvvnARbg6fC3mhyTHZ1H6QjPqdq4F_yd6hNxg==
GET H2	200	runtime~main.ff407db2.js Show response js.driftt.com/core/assets/js/ Frame 9745	5 KB 3 KB	40ms 39ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 85737d6a0cb8ccec52863cb2dabd429f8b4d760f9c6f959ff3a866d19d6b58a8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 02 Jun 2021 14:45:33 GMT content-encoding gzip age 78043 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Wed, 02 Jun 2021 14:32:03 GMT server nginx etag W/"d2713a758b4ac788d5a99a9321b36978" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id s93CwbXWbT1xq2V3i_DFZNxbFFy5.9xl via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id PfRbLOSbt0veRT-aO2QWXI3nU4nsoPIi4wdUepg9NRMdQiVFloT-lA==
GET H2	200	42.1d3e72f0.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	40 KB 12 KB	40ms 39ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/42.1d3e72f0.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 42b6a4cb0223e8edcf8a735efce1e53d8ab0b2604f31606ea6e4e454755a46de Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:43 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:48 GMT server nginx etag W/"6bafacd7106b1f1a919e0d9db9ac2d45" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id PsraKE5Rqpn1WCq0VTYjZOvkR1qNgwsQ via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id yiNagThcG-nJ9yUrIn6uhaLlrrKV9Pemd48yManrufEU3T8uuVRIFQ==
GET H2	200	25.3ad21d5f.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	42 KB 12 KB	41ms 40ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/25.3ad21d5f.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash e9618225f87a07ea43af2674ce4207adfb0897b1bb6aaf2157b502ee89538aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:43 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:47 GMT server nginx etag W/"505015ae57a46f8d45f6393ec7549ede" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id Mo_zy1ksUoC1wF0C0Kb2Mfkbb80QKle1 via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id tfUbJglOjrU-N0IJZ21nUZnCYEicP0NjJzNQluSjMmzAGHDIC8a5HQ==
GET H2	200	40.f7d72950.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	23 KB 7 KB	41ms 40ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/40.f7d72950.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash f469f0f2ec90c279cfe0e1a54b280d51e700fd6454ca7bffd7202df3dd7d6b3b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:43 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:48 GMT server nginx etag W/"8d32077d11bf130936ad9f6b2796c9e5" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id IztndX_FtIwJA1wjdnknjusFhKQvrAWn via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id GOjYeIuiTFP-JGDsI4Gp8E9sMOL03U1Xin5d3o4pB9XAqulV8ZS2Jg==
GET H2	200	22.9acf1962.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	16 KB 5 KB	43ms 42ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/22.9acf1962.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 0bc5a66e21f8648156fcbc214136ac5ff60d0adc8c9e438a2b769a83f5075d7a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:43 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:47 GMT server nginx etag W/"8270d313e55bc5cda4436c12c7c8efca" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id BDxh3Fo2DoBJW9cBWFp5.5s4o4CX96EV via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id Z8rmUDr2nBInvcGmwad-xOy82o5Je_4KBr2C0enESzJtCki8XAQrzA==
GET H2	200	36.2cef282c.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	17 KB 6 KB	43ms 42ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/36.2cef282c.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 9ae3331ec7a341b12a352038820ade9dfc4f8946ec365397abf5b5a9a6f74b83 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:43 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:48 GMT server nginx etag W/"927e45b8993175159e1e9856122c937c" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id Ao6lr74fcDw5JSJPXySF7ZNwybNy8h6G via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id yvWSMocvv9NmOKYdbPsLZMTRmRTc3H35qwxhuHQ4SDkUoJk-Q7x4cw==
GET H2	200	32.48b4a528.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	48 KB 15 KB	43ms 41ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/32.48b4a528.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 106a6f15d7a3e5d58d45ec5cdc5895303f8d89fb297d7144776d6a61ed43ec88 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:43 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:47 GMT server nginx etag W/"a78e63a18295c0d6b9b738183ec44511" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id u_Z8TtISpqZ_5Q3EUL9.qOa_OzI.rDBV via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id THUf2lzxruXXeqZJvc5DNVllb258RtdE3y95tsCPqvAsaYL3ltIpsg==
GET H2	200	18.afae54c8.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	29 KB 8 KB	47ms 45ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/18.afae54c8.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash e7657b3001a9523fb81152df7eb790ac0e7c7a163d06c31c5052b6e1b25ca77d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 30 Apr 2021 13:54:02 GMT content-encoding gzip age 2932334 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 30 Apr 2021 13:24:11 GMT server nginx etag W/"aa46b8d2411ca710860501cb70b87aa6" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id RsEAITRzirmwXWJLuxexiqSCME3tTtns via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id o4Ym404F8IVEsnF6a5KQJhsRale-IPdcK246Ut2uUpHkyfd_nlaZ6w==
GET H2	200	19.96441b8b.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	39 KB 10 KB	47ms 45ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/19.96441b8b.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 2f5cdaaa7889492b45c17f3fd0d79f8a7f72fccb1bb40ad956b37bf11d8c0175 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 25 Mar 2021 20:55:02 GMT content-encoding gzip age 6017474 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Thu, 25 Mar 2021 20:27:09 GMT server nginx etag W/"854e298ba40cc0c37109059dacdab629" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id MzIZE0mgaY7m.fGb.LX9IlVUAL8cjvev via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id GRuPWywBeM0Q6WhGsr7xtjdHnlJFdsn_aWLW0X2deOmRnNygUsaa2A==
GET H2	200	38.352fecdd.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	52 KB 18 KB	47ms 45ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/38.352fecdd.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 3356dfe5f7449f95f2518779c2cde62577d323f32a8742179400e24d242aa820 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:43 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:47 GMT server nginx etag W/"f5344e718d92b730a8438d79fcbc17e0" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 6tdMMIlFk57Tdpv5c9NuZd0QguYiTalf via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id b7EUK0DnI7AoknPmfeSKOEGV2Lai57xnGiOecZAR9h3WkO1t4xZVLw==
GET H2	200	35.57bc2812.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	24 KB 10 KB	62ms 61ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/35.57bc2812.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 6336f71e33dee69b46657b12675fad734c11b8fb43782f5db75d5cb3ce84d785 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:44 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:48 GMT server nginx etag W/"3749f56217551e2a96eef995213d9832" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id OYsSCDH.OueWQ7Fjc3Wye7OLkxk5vnaR via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id AFCBHYVIHqaXv_HiKTQerLN_icZR8u0z6t2Jpw83M4jqWrLbldL5LA==
GET H2	200	24.7bbe74f0.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	14 KB 5 KB	62ms 61ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/24.7bbe74f0.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 76f73bfe436a71077f252ade8fb13fdd724a8f1a40fa2ec8bcf65b413a0e6939 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:44 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:47 GMT server nginx etag W/"c7ac762c256cb1f0ca73524a8cd0714b" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id nlhdhxhcru.01V0uXFfcDupLe.RJ8qN2 via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 5-tteV4PC2dIVjp8-ONMBqLz48xtANrfvyKJK6cwzg1iv2Z-bzYFRA==
GET H2	200	14.b0278960.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	60 KB 21 KB	62ms 61ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/14.b0278960.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash d75c1823f06b25faffc4d8177e4fbad465186322ee07a862adabf1de9f6606ce Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 30 Apr 2021 13:54:02 GMT content-encoding gzip age 2932334 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 30 Apr 2021 13:24:10 GMT server nginx etag W/"f0ce14b295202c78f02177e314fdf340" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id XvmmE.MlaEpf2uz.SJHuSFnPeHj97JvY via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id McVtpEtTNX9kPfEJtUwpxJC1stKPwNJ6HL36Zi3sZFb4XYghEw6g1g==
GET H2	200	main~493df0b3.c9e16b09.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	21 KB 7 KB	62ms 61ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/main~493df0b3.c9e16b09.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 77af654a0951e9a142e3378e3095fe84c189836e76ffe57cbdebaa179c850c5c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 20 May 2021 20:02:21 GMT content-encoding gzip age 1182234 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Thu, 20 May 2021 19:48:36 GMT server nginx etag W/"01f7cb02a3313d3a0b5f194c6db0705f" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id ktgpRE9pv8lYGI8L6a1AFGZHBA.zK8G1 via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 9PwF57dF6XQrP7Rx4CyaqwwL5NE-sTwJMlbE8VNRxzpdF-ub_ZFdhQ==
GET H2	200	main~970f9218.71e8c6ba.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	64 KB 17 KB	62ms 62ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/main~970f9218.71e8c6ba.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash b729a732630cb2982e263083eda58a88181849bc58bda4f4ab951853e59c2cf2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 24 May 2021 14:21:09 GMT content-encoding gzip age 857107 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 24 May 2021 13:54:56 GMT server nginx etag W/"ddf5ab84d4375a96f166c55f1e9d2364" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id zDhaN0FXiDyXVpYpF48rG8psE_HqeEH2 via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id wCtiwdSslGGcfTeGPW99t3qSMqVXVlNngHmEF3GHi7iY1bzOvSEKOA==
GET H2	200	main~89e24786.e9d91ad8.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	66 KB 18 KB	63ms 62ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/main~89e24786.e9d91ad8.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 9437dcdda8f4d847473c2edc53a4b5c60906e2f549daedf313ae3ad973888737 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 24 May 2021 14:21:09 GMT content-encoding gzip age 857107 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 24 May 2021 13:54:56 GMT server nginx etag W/"295286600ea5534495e9c9770230c3f5" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id guinhlNIISslKBgLAkwgE2Fc.Q4iNQ4v via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id vZroV7YQm_z8fxv527yER9mD9_6lmtQrh15pMHQVSAUChI5z34mNdw==
GET H2	200	main~53ca99a6.55c30b8e.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	30 KB 10 KB	63ms 62ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/main~53ca99a6.55c30b8e.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 4437d8da566f63020c5f94f3e27162916a3262d1f37f1ddd7e746599ec0f8e2d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 02 Jun 2021 14:45:33 GMT content-encoding gzip age 78043 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Wed, 02 Jun 2021 14:32:03 GMT server nginx etag W/"4e0254bc5129366a81a94946016f4ab5" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 4SIg.F6LdkhREaaf9L.ypJlh07rwra48 via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id cbvV-C3X1ju43Y_EHd2mVyabB6oy70Qy6biX2h49_N6bcvR1Nr6TuA==
GET H2	200	39.f00f9225.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	6 KB 3 KB	40ms 39ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/39.f00f9225.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash fb6a54fd0ea4287ed803a20a197516820c7e13ee66649e7c99aeefd06b646543 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:44 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:48 GMT server nginx etag W/"ba8635d920070dde24a0a4a9e3177b21" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id QT91uxvWeWY83BLBOcxyM7AH84IphadG via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id cKrnSs26iSSV26IY5aDY74uQ6Ojkcvl0xo4Ve7qF_x_7RjQmO1jqVA==
GET H2	200	37.44c05d56.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	107 KB 34 KB	41ms 40ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/37.44c05d56.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 2badd5eb27f506ea9c8c6e77ae1f938883ac131e2294c4e02bfbabc70ce9e6a6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:44 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:47 GMT server nginx etag W/"714e6baa2fa3579ac720cb0419c3f11a" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id _Oz3INBC0zU_UOCtnzVzgHjtUphoYphb via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id yyNgaJ9kvVnJ7UJylTvAEQaRzA9Ev7v2uHeFbUS1S009s0XFM-kkBQ==
GET H2	200	30.5caeefdb.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	27 KB 9 KB	41ms 40ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/30.5caeefdb.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash dcc9b82683719d082db3ba8d6927ac8a03dd5c01d80e6fbe9418badf1e27270e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:44 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:47 GMT server nginx etag W/"607a066f07dd87bede92756538ea6d80" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id ZUr_AKrPYQW_2.EmmPhOrtB9Te6gjsz8 via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id SveNT7dc7tK1VhtabZLjYypQC1gv0WyM-q2McgsSXPLKHb-v1H6iEQ==
GET H2	200	33.71167ac0.chunk.css js.driftt.com/core/assets/css/ Frame 9745	1 KB 1 KB	42ms 41ms	Stylesheet text/css	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/33.71167ac0.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash ed56292da2883fe23fa81f64fcedb3c6dff5f09b4f2aed777be50699e7f04ba7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:44 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:45 GMT server nginx etag W/"7362dc7cbde5becc44253ec6d0061465" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 2JMb8NXNN66SQT7RoK4V7YHblmShbdmE via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id Ca2ru-i6g2tcZwk-41Af9QGt3IgCX2Xaq-1yZX8_iiebk8wuIGy0bA==
GET H2	200	33.9ce80c6d.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	5 KB 3 KB	42ms 42ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/33.9ce80c6d.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 3893e6855291b855da42fd61571fedb384ee14653cf1e3d3d51e39670c2ae117 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:44 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:47 GMT server nginx etag W/"58bc8d55464bff3c868c28bb227d9eee" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 4lOEwzxcOLiGAQnBQRS4iZJ3160_Puxf via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 1HAiDAUn_Jz05Ois_4U86xaRAtEwl2TI4DJs_NRnwm_7Bv1-56Fnhg==
GET H2	200	runtime~main.ff407db2.js Show response js.driftt.com/core/assets/js/ Frame F2B4	5 KB 3 KB	39ms 38ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 85737d6a0cb8ccec52863cb2dabd429f8b4d760f9c6f959ff3a866d19d6b58a8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 02 Jun 2021 14:45:33 GMT content-encoding gzip age 78043 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Wed, 02 Jun 2021 14:32:03 GMT server nginx etag W/"d2713a758b4ac788d5a99a9321b36978" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id s93CwbXWbT1xq2V3i_DFZNxbFFy5.9xl via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id blxhX_ilzE5xYviBKshNmkLf2U9JL1rvTpFCLk_GNWdcVk1L1vol2A==
GET H2	200	42.1d3e72f0.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	40 KB 12 KB	41ms 40ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/42.1d3e72f0.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 42b6a4cb0223e8edcf8a735efce1e53d8ab0b2604f31606ea6e4e454755a46de Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:43 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:48 GMT server nginx etag W/"6bafacd7106b1f1a919e0d9db9ac2d45" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id PsraKE5Rqpn1WCq0VTYjZOvkR1qNgwsQ via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id kOq5hjbqRoEOltytPXn8QRNN-Wsu6UgyCPNZrpbVNwkfAaBrdqCRxA==
GET H2	200	25.3ad21d5f.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	42 KB 12 KB	41ms 39ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/25.3ad21d5f.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash e9618225f87a07ea43af2674ce4207adfb0897b1bb6aaf2157b502ee89538aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:43 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:47 GMT server nginx etag W/"505015ae57a46f8d45f6393ec7549ede" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id Mo_zy1ksUoC1wF0C0Kb2Mfkbb80QKle1 via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id ZdLsQV0UrJCUzzqydMdg2OruGAgiFyULvUiRIAAh2fO1aub7K3x6XQ==
GET H2	200	40.f7d72950.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	23 KB 7 KB	41ms 39ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/40.f7d72950.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash f469f0f2ec90c279cfe0e1a54b280d51e700fd6454ca7bffd7202df3dd7d6b3b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:43 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:48 GMT server nginx etag W/"8d32077d11bf130936ad9f6b2796c9e5" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id IztndX_FtIwJA1wjdnknjusFhKQvrAWn via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id Ed7uMG5M5_5rfsDdOVOq83-3cTF-ii_wLv7uZb2ietmHtCTxBmhYaA==
GET H2	200	22.9acf1962.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	16 KB 5 KB	43ms 41ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/22.9acf1962.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 0bc5a66e21f8648156fcbc214136ac5ff60d0adc8c9e438a2b769a83f5075d7a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:43 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:47 GMT server nginx etag W/"8270d313e55bc5cda4436c12c7c8efca" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id BDxh3Fo2DoBJW9cBWFp5.5s4o4CX96EV via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id _JdMvI39ikL1MJLXGk3b7yTXqa1Bog7iE7q_pt-f6R0VnFCujPw_YQ==
GET H2	200	36.2cef282c.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	17 KB 6 KB	43ms 41ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/36.2cef282c.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 9ae3331ec7a341b12a352038820ade9dfc4f8946ec365397abf5b5a9a6f74b83 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:43 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:48 GMT server nginx etag W/"927e45b8993175159e1e9856122c937c" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id Ao6lr74fcDw5JSJPXySF7ZNwybNy8h6G via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id HMn8bGK05UyP1lcopUj4HkGEPfd_P6k8PbaytyLT4yr76DxK3XmNaQ==
GET H2	200	32.48b4a528.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	48 KB 15 KB	43ms 41ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/32.48b4a528.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 106a6f15d7a3e5d58d45ec5cdc5895303f8d89fb297d7144776d6a61ed43ec88 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:43 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:47 GMT server nginx etag W/"a78e63a18295c0d6b9b738183ec44511" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id u_Z8TtISpqZ_5Q3EUL9.qOa_OzI.rDBV via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id TKtRi7rNCFaEuN8JtGO8uL00f10cd5tX0yao3OFAnHkN6wgxAr_vrQ==
GET H2	200	18.afae54c8.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	29 KB 8 KB	43ms 41ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/18.afae54c8.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash e7657b3001a9523fb81152df7eb790ac0e7c7a163d06c31c5052b6e1b25ca77d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 30 Apr 2021 13:54:02 GMT content-encoding gzip age 2932334 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 30 Apr 2021 13:24:11 GMT server nginx etag W/"aa46b8d2411ca710860501cb70b87aa6" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id RsEAITRzirmwXWJLuxexiqSCME3tTtns via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id sQo8dYjKKUNMegqNm82CQKrPXqQlAzDWIejTA7MIimCMifW1Ur-VUw==
GET H2	200	19.96441b8b.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	39 KB 10 KB	43ms 41ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/19.96441b8b.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 2f5cdaaa7889492b45c17f3fd0d79f8a7f72fccb1bb40ad956b37bf11d8c0175 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 25 Mar 2021 20:55:02 GMT content-encoding gzip age 6017474 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Thu, 25 Mar 2021 20:27:09 GMT server nginx etag W/"854e298ba40cc0c37109059dacdab629" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id MzIZE0mgaY7m.fGb.LX9IlVUAL8cjvev via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id xP2sp-0bCDnb9v47sPVZaWmN5paCbZDFb4FvIvebF-ZDhGb8JTxiLw==
GET H2	200	38.352fecdd.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	52 KB 18 KB	43ms 42ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/38.352fecdd.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 3356dfe5f7449f95f2518779c2cde62577d323f32a8742179400e24d242aa820 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:43 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:47 GMT server nginx etag W/"f5344e718d92b730a8438d79fcbc17e0" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 6tdMMIlFk57Tdpv5c9NuZd0QguYiTalf via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id qu5TH3aEBwtZ_40n4z0eFzEbHOA7RWaUkc7HCIEgf-mH--TLU-wK9w==
GET H2	200	35.57bc2812.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	24 KB 10 KB	46ms 45ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/35.57bc2812.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 6336f71e33dee69b46657b12675fad734c11b8fb43782f5db75d5cb3ce84d785 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:44 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:48 GMT server nginx etag W/"3749f56217551e2a96eef995213d9832" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id OYsSCDH.OueWQ7Fjc3Wye7OLkxk5vnaR via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id kPw2oiGfBbBo4agOsVs7CWI4YHQpvPWUTioucz5CXbcdkPn5uDLmGw==
GET H2	200	24.7bbe74f0.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	14 KB 5 KB	47ms 45ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/24.7bbe74f0.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 76f73bfe436a71077f252ade8fb13fdd724a8f1a40fa2ec8bcf65b413a0e6939 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:44 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:47 GMT server nginx etag W/"c7ac762c256cb1f0ca73524a8cd0714b" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id nlhdhxhcru.01V0uXFfcDupLe.RJ8qN2 via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id GPtBukEL2v5Y4Vban8CXURm-SEW-rVi8a2GqlWwMPedHvb0xS8b6mw==
GET H2	200	14.b0278960.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	60 KB 21 KB	47ms 45ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/14.b0278960.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash d75c1823f06b25faffc4d8177e4fbad465186322ee07a862adabf1de9f6606ce Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 30 Apr 2021 13:54:02 GMT content-encoding gzip age 2932334 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 30 Apr 2021 13:24:10 GMT server nginx etag W/"f0ce14b295202c78f02177e314fdf340" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id XvmmE.MlaEpf2uz.SJHuSFnPeHj97JvY via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id B_vjL13xrfn4k80M1z6Y3HbIlEUtJ4Cr4arPVhRagSeKLUiWZHtExw==
GET H2	200	main~493df0b3.c9e16b09.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	21 KB 7 KB	47ms 46ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/main~493df0b3.c9e16b09.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 77af654a0951e9a142e3378e3095fe84c189836e76ffe57cbdebaa179c850c5c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 20 May 2021 20:02:21 GMT content-encoding gzip age 1182234 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Thu, 20 May 2021 19:48:36 GMT server nginx etag W/"01f7cb02a3313d3a0b5f194c6db0705f" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id ktgpRE9pv8lYGI8L6a1AFGZHBA.zK8G1 via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id sOK8lWUatXoImwvZuJLFNY4ZuNatD7KAOb2IOfOvIzDKJDFUVZ1rZQ==
GET H2	200	main~970f9218.71e8c6ba.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	64 KB 17 KB	47ms 46ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/main~970f9218.71e8c6ba.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash b729a732630cb2982e263083eda58a88181849bc58bda4f4ab951853e59c2cf2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 24 May 2021 14:21:09 GMT content-encoding gzip age 857107 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 24 May 2021 13:54:56 GMT server nginx etag W/"ddf5ab84d4375a96f166c55f1e9d2364" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id zDhaN0FXiDyXVpYpF48rG8psE_HqeEH2 via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id k7mD4e-NMOxsvBqhNGRldCYuKDT-INcKrBpx-yaoGZak70Ibpks5Tg==
GET H2	200	main~89e24786.e9d91ad8.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	66 KB 18 KB	52ms 51ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/main~89e24786.e9d91ad8.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 9437dcdda8f4d847473c2edc53a4b5c60906e2f549daedf313ae3ad973888737 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 24 May 2021 14:21:09 GMT content-encoding gzip age 857107 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 24 May 2021 13:54:56 GMT server nginx etag W/"295286600ea5534495e9c9770230c3f5" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id guinhlNIISslKBgLAkwgE2Fc.Q4iNQ4v via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id i_USvVJYWtWOQIFXK9CMMP9RTi_kyxEZZnIme8Cb1UesBGicS0-36A==
GET H2	200	main~53ca99a6.55c30b8e.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	30 KB 10 KB	52ms 51ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/main~53ca99a6.55c30b8e.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 4437d8da566f63020c5f94f3e27162916a3262d1f37f1ddd7e746599ec0f8e2d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Origin https://js.driftt.com Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 02 Jun 2021 14:45:33 GMT content-encoding gzip age 78043 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Wed, 02 Jun 2021 14:32:03 GMT server nginx etag W/"4e0254bc5129366a81a94946016f4ab5" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 4SIg.F6LdkhREaaf9L.ypJlh07rwra48 via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id _L9wcQibxlYYqA0IbuxWitssunNr6V6nBRkRqQ2Ur2UwfUBnPrJvEQ==
GET H2	200	0.45eb4005.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	17 KB 6 KB	50ms 43ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/0.45eb4005.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 65d29e040c59a5e843952c3f0da27028455dc63372440602d129681883891276 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 19 Apr 2021 22:58:04 GMT content-encoding gzip age 3850092 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 19 Apr 2021 19:42:26 GMT server nginx etag W/"7e689afacd5eb298702f393c9c2f70f8" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 1g7Hv6w3YDIKnLSLbX8uZi9cdYzVnmu5 via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id Vcihnekrs02jDvlOBlo9V0VuR1tutHYsEUhEAbLtS0C0sOmNPZ7fzg==
GET H2	200	1.0af467a5.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	68 KB 20 KB	48ms 43ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/1.0af467a5.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 817c7a8de5f73b3bd9358babbbd8f904fa639279f18bc86d320fcfb7fcfa8485 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 06 Feb 2021 01:42:28 GMT content-encoding gzip age 10147428 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 05 Feb 2021 20:58:44 GMT server nginx etag W/"aedd244e100709f43b70a84bb3945ca6" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id kErXw93froxamEp2BnqkXpG57uNk3Qr1 via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id UB1GYlf-jzFcSm0uxxujRXoEjK-cAXx3SBwpbUlUqqXvwY9zQh3xGg==
GET H2	200	29.af23633f.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	42 KB 12 KB	48ms 43ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/29.af23633f.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 7c59ba72953cc99b7cc6735de0285f154a29e30b5fd5d5b04d819ed22d21bc3a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:44 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:47 GMT server nginx etag W/"e44e4be66b3069982f14c73c09e21042" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id fotuwu4LjY0Fjw9Gx8sj1O0oPzVV4rN5 via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id dxGbNgWz-KrvKV2mVGGGRa5rrWVnCmqtkjRJi7ARWTy52EmrNCkRqw==
GET H2	200	2.939f0edf.chunk.css js.driftt.com/core/assets/css/ Frame 9745	2 KB 1 KB	46ms 42ms	Stylesheet text/css	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/2.939f0edf.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 62b33c7813e7ad094f92e3917fa81aff0546a584602763b43ce4bcd4ea7b46c8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 24 Apr 2021 15:19:03 GMT content-encoding gzip age 3445633 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Thu, 22 Apr 2021 15:02:33 GMT server nginx etag W/"49bde0a5fadb142d912e44161f3d4f36" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id i4oLOCo1CoXq5YZVZzPbQhQAY8Tkp_5R via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id xXUMkaYQWpw7qx3eM6MOUEfREVvo22XseTWCkSmIgxze-nHg6VVPyQ==
GET H2	200	2.abf8a8a3.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	33 KB 11 KB	47ms 43ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/2.abf8a8a3.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 1d601abe31015e4cdeda1da5ab3acb4f150bf0cd9a99effc7c8df20fe522f071 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 25 May 2021 19:54:16 GMT content-encoding gzip age 750720 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Tue, 25 May 2021 18:50:56 GMT server nginx etag W/"256e6c2f2bceffef4fd5d8647a100595" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id DwBmRYXoWIVkMWYnZhbgEtDZVis1jADu via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id PCcI-2axcSs7ni65PrFYXp6z_Djbe0FZ-HILnVE_jmF79o1DdOpesw==
GET H2	200	28.44736ae1.chunk.css js.driftt.com/core/assets/css/ Frame 9745	8 KB 2 KB	46ms 43ms	Stylesheet text/css	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/28.44736ae1.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 8c58a438125e389f81b62999773d8d6cb9e25828bb6049248faa04c12d2bc8a7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 26 May 2021 18:22:23 GMT content-encoding gzip age 669833 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Wed, 26 May 2021 17:36:25 GMT server nginx etag W/"8b77004f90a97a8796e83c50f9e084d8" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id VTL7YzENnmWXyCBUsKQb8BXlyKIgAsgS via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id oWW_G9K9TIooNfMmaZlN8cCHnkkYTsYQIQ5eHCr4jwfYX0Z6jpixmg==
GET H2	200	28.31e02368.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	65 KB 19 KB	41ms 40ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/28.31e02368.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 6821aad3bf58aff8960316be8b50066b1e491bfc4c8b0265a9f4e04b32a1dd0e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 27 May 2021 19:54:08 GMT content-encoding gzip age 577928 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Thu, 27 May 2021 19:27:23 GMT server nginx etag W/"c9272830ce3cc9b18fb4cc08dca8c46f" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id Y6hgsIcuzloFLfHpNwBiJGstKvvqtJ47 via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id u8xs-ZeMQ4elJBgzXAmoqxBMlznyHQioRXMNzV9mh056rRhSeW_ZSw==
GET H2	200	39.f00f9225.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	6 KB 3 KB	41ms 40ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/39.f00f9225.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash fb6a54fd0ea4287ed803a20a197516820c7e13ee66649e7c99aeefd06b646543 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:44 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:48 GMT server nginx etag W/"ba8635d920070dde24a0a4a9e3177b21" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id QT91uxvWeWY83BLBOcxyM7AH84IphadG via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id yDUxRtSvLU7HJMCgu_HJRH1HCCzvhlAoFHN15LZHirsQ0V8-of73jA==
GET H2	200	37.44c05d56.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	107 KB 34 KB	41ms 41ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/37.44c05d56.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 2badd5eb27f506ea9c8c6e77ae1f938883ac131e2294c4e02bfbabc70ce9e6a6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:44 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:47 GMT server nginx etag W/"714e6baa2fa3579ac720cb0419c3f11a" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id _Oz3INBC0zU_UOCtnzVzgHjtUphoYphb via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id HWhHN2eYEiOnMmHfydbJQtpGjcpCj6TGI5c56wDEi9gsSXKTSUl4Jw==
GET H2	200	30.5caeefdb.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	27 KB 9 KB	42ms 41ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/30.5caeefdb.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash dcc9b82683719d082db3ba8d6927ac8a03dd5c01d80e6fbe9418badf1e27270e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:44 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:47 GMT server nginx etag W/"607a066f07dd87bede92756538ea6d80" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id ZUr_AKrPYQW_2.EmmPhOrtB9Te6gjsz8 via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id SdNBHd113NKTEu-LWHu5sD2src99ovrMO_U9h_q5j_my8sXYo-nEGw==
GET H2	200	33.71167ac0.chunk.css js.driftt.com/core/assets/css/ Frame F2B4	1 KB 1 KB	41ms 41ms	Stylesheet text/css	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/33.71167ac0.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash ed56292da2883fe23fa81f64fcedb3c6dff5f09b4f2aed777be50699e7f04ba7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:44 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:45 GMT server nginx etag W/"7362dc7cbde5becc44253ec6d0061465" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 2JMb8NXNN66SQT7RoK4V7YHblmShbdmE via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id wDxGD01ZntyvLd5WGJdnSVOHRVlJ5WG9VdXuNI9_8lGXSGGSQnyCIA==
GET H2	200	33.9ce80c6d.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	5 KB 3 KB	42ms 41ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/33.9ce80c6d.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 3893e6855291b855da42fd61571fedb384ee14653cf1e3d3d51e39670c2ae117 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:44 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:47 GMT server nginx etag W/"58bc8d55464bff3c868c28bb227d9eee" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 4lOEwzxcOLiGAQnBQRS4iZJ3160_Puxf via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id jiQhV9j9I6flYR6xRFNzr00R_p3_9_sOzqDlf-I06zM0KyKf2TYq2w==
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	220ms 220ms	Image image/gif	104.109.89.85 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&session=a91b16e8-11fa-4030-864d-094a45585c8e&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2003%20Jun%202021%2012%3A26%3A16%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2003%20Jun%202021%2012%3A26%3A15%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226008%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22SharpPanda%3A%20Chinese%20APT%20Group%20Targets%20Southeast%20Asian%20Government%20With%20Previously%20Unknown%20Backdoor%20-%20Check%20Point%20Research%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor%2F&pageViewId=2ed83740-d408-4a76-86d3-d2f9531769ab Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.109.89.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-89-85.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:16 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	0.45eb4005.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	17 KB 6 KB	41ms 40ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/0.45eb4005.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 65d29e040c59a5e843952c3f0da27028455dc63372440602d129681883891276 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 19 Apr 2021 22:58:04 GMT content-encoding gzip age 3850092 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 19 Apr 2021 19:42:26 GMT server nginx etag W/"7e689afacd5eb298702f393c9c2f70f8" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 1g7Hv6w3YDIKnLSLbX8uZi9cdYzVnmu5 via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id r6rrCJ6JVY8R2Y9ewAlgCuU7wl8YKV7C_lCd9pU3pP8f-FZOHwMGUA==
GET H2	200	34.e776e5b0.chunk.css js.driftt.com/core/assets/css/ Frame F2B4	6 KB 1 KB	40ms 40ms	Stylesheet text/css	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/34.e776e5b0.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash f8e3f110b75b3f1951f50fb7795c6eaf5bee4f07b787a1b535b39e734c7f1723 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:44 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:45 GMT server nginx etag W/"9f36443a9402e1e03bf8070ddc88b8db" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id GojXQVrNiHbX0B3yzg6sYNjY3aFapEc5 via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id pgsoGusLLnSin8nLjrTInFkRKAeEr5isSCRp4b4Z7cBo-MBcsgM8aQ==
GET H2	200	34.4fa1cbbc.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	2 KB 2 KB	40ms 40ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/34.4fa1cbbc.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash dba147571ae378baa0e02df9ae74e2b31e2c98ac93f3ada63eb82c8413ed116c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:44 GMT content-encoding gzip age 1442192 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:47 GMT server nginx etag W/"6f3f5f373c0388a3c51db3a25fc4bfad" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id FeulpfeVlatzfNLgL3hOv1wu.IMZcaIo via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id lZNlyt1lrs5HOwKbBJWTxYW9M58qGJ-Jz5QXrwmocXSxzwC-g0e0vw==
GET H2	200	1.0af467a5.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	68 KB 20 KB	41ms 39ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/1.0af467a5.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 817c7a8de5f73b3bd9358babbbd8f904fa639279f18bc86d320fcfb7fcfa8485 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 06 Feb 2021 01:42:28 GMT content-encoding gzip age 10147428 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 05 Feb 2021 20:58:44 GMT server nginx etag W/"aedd244e100709f43b70a84bb3945ca6" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id kErXw93froxamEp2BnqkXpG57uNk3Qr1 via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 6HTPkGj3WdppG-pzNXazj8tF_Qr9wOQuRcwAIiO-dH6D4n9GFesi5w==
GET H2	200	7.07aa08a5.chunk.css js.driftt.com/core/assets/css/ Frame F2B4	7 KB 2 KB	41ms 39ms	Stylesheet text/css	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/7.07aa08a5.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 30 Apr 2021 13:54:03 GMT content-encoding gzip age 2932333 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 30 Apr 2021 13:24:09 GMT server nginx etag W/"189aeffd571884559dababa22c66d75a" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id qRE432HVQ7Y1w.s9lcCBDT5jZX9YXsTD via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id uoeJ0bwC-avzDxbh6rvjDxO20YnDLBvmlBB5nJZqfcvDwC8bUhV0Yw==
GET H2	200	7.d2b06f0f.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	38 KB 13 KB	41ms 38ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/7.d2b06f0f.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash a700f71fb1bb8fbba02eb3a6e70c73441e24337c4521bacc1c4e2b97d7b191a9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 30 Apr 2021 13:54:03 GMT content-encoding gzip age 2932333 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 30 Apr 2021 13:24:12 GMT server nginx etag W/"d22fa8dd9fdbdcdde74443bcd7a64fa3" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id xnIs15mgedQOb8VhFDNVv2E4rRhqKdBF via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id RMyV4KJ9bWrRZOB5Y5zBn8ZIcN0h9Tb5ZUA4qCWffvn9xatGkczVSQ==
GET H2	200	4.83e6fbb0.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	50 KB 14 KB	43ms 40ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/4.83e6fbb0.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 773e03ac001d0d50aa313e801d59d2acb8e8740d969a218e004effc8f1334ef0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 12 Apr 2021 20:57:30 GMT content-encoding gzip age 4462126 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 12 Apr 2021 20:26:14 GMT server nginx etag W/"1055d5233f397035f9106d9c6067332c" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id VEA2c_RsciIuDC7GppXra6t044BndYBr via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 4OdCq2U-Kx7fupYo0SBFz-g1s6k5WLXrEyZFia4HXEOmpdkGCgLiyA==
GET H2	200	2.939f0edf.chunk.css js.driftt.com/core/assets/css/ Frame F2B4	2 KB 1 KB	42ms 40ms	Stylesheet text/css	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/2.939f0edf.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 62b33c7813e7ad094f92e3917fa81aff0546a584602763b43ce4bcd4ea7b46c8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 24 Apr 2021 15:19:03 GMT content-encoding gzip age 3445633 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Thu, 22 Apr 2021 15:02:33 GMT server nginx etag W/"49bde0a5fadb142d912e44161f3d4f36" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id i4oLOCo1CoXq5YZVZzPbQhQAY8Tkp_5R via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id QnzfpKtpv6c9mficLd1Z_gktdNWc22gZNT47WoA98Ftx0s_XYC_BgQ==
GET H2	200	2.abf8a8a3.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	33 KB 11 KB	43ms 41ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/2.abf8a8a3.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 1d601abe31015e4cdeda1da5ab3acb4f150bf0cd9a99effc7c8df20fe522f071 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 25 May 2021 19:54:16 GMT content-encoding gzip age 750720 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Tue, 25 May 2021 18:50:56 GMT server nginx etag W/"256e6c2f2bceffef4fd5d8647a100595" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id DwBmRYXoWIVkMWYnZhbgEtDZVis1jADu via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id ob_Cp4QZM56XROHVsjSNK_8dNwnjOSKngujnqcDs3IAMLoVx6e9SGg==
GET H2	200	8.35769563.chunk.css js.driftt.com/core/assets/css/ Frame F2B4	11 KB 3 KB	42ms 40ms	Stylesheet text/css	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/8.35769563.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 0c7581bec2ec700183fbe253849ffc7234311c50d7905fd1af9271445a434af0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 26 May 2021 18:22:23 GMT content-encoding gzip age 669833 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Wed, 26 May 2021 17:36:25 GMT server nginx etag W/"b9285a98f726b4f0f8077ee932ff530f" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id .oV7CiNwJ8CKgfv0XV8p80sqxPCMUjAQ via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id EFhkj3YFJ4HB3yrabk4yoNioc4vgY5bdsxt2LRylfORHfEP1u1fItA==
GET H2	200	8.a5f89f37.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	16 KB 6 KB	42ms 40ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/8.a5f89f37.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 8c2f53a0dffc43a8bd648374207f097180295bb3cc5a41eaa8f78e8104b34430 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 02 Jun 2021 14:45:33 GMT content-encoding gzip age 78043 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Wed, 02 Jun 2021 14:32:02 GMT server nginx etag W/"b17da872aa27f5923a2922bc753d82d2" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id ctxynatav6CdHgrjwVALqZXe9Ds0Bdfe via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id _7rSw6w2GsBTNLGn9-x_0DWbg-yqxsA8ms2T_dY148ok2lXtk-wlYQ==
GET H2	200	6.4da00493.chunk.css js.driftt.com/core/assets/css/ Frame F2B4	6 KB 2 KB	42ms 41ms	Stylesheet text/css	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/6.4da00493.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 067a3f3a6d50349a650f9df58b4c118f0ca0a2136ee24163742dea4625b85cff Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 02 Jun 2021 14:45:33 GMT content-encoding gzip age 78043 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Wed, 02 Jun 2021 14:31:59 GMT server nginx etag W/"8c7c720f617083d90026fa60c98b5a13" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id IYBohuBrm4QTzTpH7p2DIkSTjKIvxVZB via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id zhZa7d37Zdulzgxs7NpvDEctLEpP55J0qLlU1B5_3OheKTrFBvYEew==
GET H2	200	6.bf75f137.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	14 KB 6 KB	42ms 41ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/6.bf75f137.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash cdaf9710ff27931eb0f8f8b8e8df97faf4a7791725ef647de6585bbfc8f5909d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 02 Jun 2021 14:45:33 GMT content-encoding gzip age 78043 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Wed, 02 Jun 2021 14:32:02 GMT server nginx etag W/"4afd68421c4dd4e8c9e7706d38352647" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id DPu3gmtUmOj1zuxNCpfvthFRBe_6gzCH via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id HzZLj5wMzJMB6ST6Frp5Uk62egEu0h_JLuyjdCiPERst3PiocOrERQ==
GET H2	200	3.9cea3ddc.chunk.css js.driftt.com/core/assets/css/ Frame F2B4	34 KB 6 KB	42ms 41ms	Stylesheet text/css	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/3.9cea3ddc.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash ed2a286d7a3256b3d11cf6f4436c5216c63b1a38ef91acc6f003e847bb50b767 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 28 May 2021 18:52:06 GMT content-encoding gzip age 495250 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 28 May 2021 18:14:07 GMT server nginx etag W/"3e5fd918561578c12c53a0ca3bb7999f" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id lfE0FpaJuUZD8eqMu_nliGrbUp9iVsN. via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id iLyhqTfhHb3b9fht5ZFur4HLxEGs3uMesmDahMcAcZnAOiGtc5Zd6Q==
GET H2	200	3.d785a9b5.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	65 KB 20 KB	42ms 41ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/3.d785a9b5.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 71dd809a7c69ebff655ec094dc1a44d33511f0cb4dcd63c5d058fbe88c1e742e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 25 May 2021 19:54:16 GMT content-encoding gzip age 750720 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Tue, 25 May 2021 18:50:56 GMT server nginx etag W/"62decfc377cc9291226712e001618e14" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id lFbXV6sAnPJ6u4zhaLlQYYTbYjWU4qk2 via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id hmM1s_lo6JHKA505s9oo0uoqHD0sb8TAs_ZmQvn0C3wshLgOo1IcHQ==
GET H2	200	5.5ac1364e.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	17 KB 7 KB	44ms 42ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/5.5ac1364e.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 8354b460d30b89e36f5e8301d758bbdeae2b2300010f07286e5e0cb0237c9a65 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 02 Jun 2021 14:45:33 GMT content-encoding gzip age 78043 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Wed, 02 Jun 2021 14:32:01 GMT server nginx etag W/"8b271dd36e12497c8d015790a72a8f11" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id f_kFzmUdbjVFguHAnWdidjoMFBOxl0gr via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id BLqNt1thEtapTkWaboTrAwAOCmKAUvzZKUeen6v53Ftkwp9QkCsu7A==
GET H2	200	26.0f3076d4.chunk.css js.driftt.com/core/assets/css/ Frame F2B4	16 KB 3 KB	42ms 41ms	Stylesheet text/css	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/26.0f3076d4.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 6a937cac6c1f73afedba2ff302d69c69560b9413ab327158718fd76bdc66a669 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:45 GMT content-encoding gzip age 1442191 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:45 GMT server nginx etag W/"d668c40d88e269f4226308e1d0dac5b2" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 1NmE2.jNk42iwRWJmhAmHpDe1yTb9t3p via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id P9w2xzzqOl61ZVGf69_siDdC3GdOa0HBiXTdFkw8NlaNkgtdXTxyvA==
GET H2	200	26.2ee66c2f.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	21 KB 7 KB	44ms 42ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/26.2ee66c2f.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash fe9911d502cf7fd206847d156bdf63eb2cdec763d2ab788ff05c2d70baf3e00a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 24 May 2021 14:21:10 GMT content-encoding gzip age 857106 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 24 May 2021 13:54:54 GMT server nginx etag W/"90364f6daa1c9e95cc3b7b4d716eb1b4" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id kllnnSVoFB3p7ZPfYNOuE_rW3Ao748P_ via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id Hqy5fFz82xwKKxZpkXE9gtfxvqThFSZsuicTWQP2r4lqn0VKyD6cKg==
OPTIONS H2	200	v2 metrics.api.drift.com/monitoring/metrics/widget/init/ Frame	0 0	342ms 111ms	Preflight text/plain	54.147.21.139 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://metrics.api.drift.com/monitoring/metrics/widget/init/v2 Protocol H2 Server 54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-147-21-139.compute-1.amazonaws.com Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://js.driftt.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode cors Response headers date Thu, 03 Jun 2021 12:26:16 GMT access-control-allow-origin * access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version access-control-allow-credentials true access-control-expose-headers X-Results-Total-Count,X-Page-Info access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH access-control-max-age 1209600 strict-transport-security max-age=31536000; includeSubDomains content-type text/plain allow POST,OPTIONS requestid driftb1ed39d4730bb238a72baf7350c content-length 13 x-envoy-upstream-service-time 1 server istio-envoy
POST H2	200	v2 Show response metrics.api.drift.com/monitoring/metrics/widget/init/ Frame 9745	25 B 123 B	118ms 118ms	XHR application/json	54.147.21.139 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://metrics.api.drift.com/monitoring/metrics/widget/init/v2 Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/42.1d3e72f0.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-147-21-139.compute-1.amazonaws.com Software istio-envoy / Resource Hash f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ Authorization User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type application/json Response headers date Thu, 03 Jun 2021 12:26:16 GMT server istio-envoy requestid f6641589cf0d9f07 vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type application/json;charset=utf-8 access-control-allow-origin * access-control-max-age 1209600 access-control-allow-credentials true x-envoy-upstream-service-time 10 strict-transport-security max-age=31536000; includeSubDomains access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version content-length 25 access-control-expose-headers X-Results-Total-Count,X-Page-Info
GET H2	200	wxbvs5zxy7iy.json Show response embeds.driftcdn.com/embeds/ Frame 9745	28 KB 9 KB	132ms 52ms	XHR application/json	52.222.158.23 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://embeds.driftcdn.com/embeds/wxbvs5zxy7iy.json Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/42.1d3e72f0.chunk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.23 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-23.cdg52.r.cloudfront.net Software AmazonS3 / Resource Hash 1125e65795c5f7f8929dac42d7637c5435fa4e30288b839aea12247671aa0bd5 Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:16 GMT content-encoding gzip x-amz-cf-pop CDG52-P2 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront access-control-max-age 3000 access-control-allow-origin * last-modified Thu, 03 Jun 2021 12:16:10 GMT server AmazonS3 etag W/"3fe2e42a7c549b403a30d40d978a4f4d" vary Origin,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-methods GET content-type application/json; charset=UTF-8 via 1.1 652331095b841aa2e89ce3a0cd676d05.cloudfront.net (CloudFront) cache-control public, max-age=30 x-amz-cf-id 1ddZQNffZ4mPBRB8yOyT1XtGx985U_guh5oSO32ZD_P7xr2XMC0Y4Q==
GET H2	200	css fonts.googleapis.com/ Frame 9745	4 KB 1 KB	59ms 27ms	Stylesheet text/css	2a00:1450:4001:831::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Open%20Sans|Open%20Sans:bold&display=swap Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/2.abf8a8a3.chunk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 6aa6360b39fe982bd5f7cdf9bd09d2ea596614697679c98ad347111aab2b38dc Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://js.driftt.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Thu, 03 Jun 2021 10:52:24 GMT server ESF date Thu, 03 Jun 2021 12:26:16 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 03 Jun 2021 12:26:16 GMT
POST H2	200	widget_bootstrap Show response bootstrap.api.drift.com/ Frame 9745	4 KB 2 KB	1492ms 606ms	XHR application/json	34.193.113.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://bootstrap.api.drift.com/widget_bootstrap Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/42.1d3e72f0.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-193-113-164.compute-1.amazonaws.com Software istio-envoy / Resource Hash 4cb9474c396b13fc90a4ce021ebd23ab69e86d2ccc97a735628c6b978545ea94 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers date Thu, 03 Jun 2021 12:26:17 GMT content-encoding gzip server istio-envoy requestid dd1e73b37b9548da vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type application/json;charset=utf-8 access-control-allow-origin * access-control-max-age 1209600 access-control-allow-credentials true x-envoy-upstream-service-time 498 strict-transport-security max-age=31536000; includeSubDomains access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version content-length 2003 access-control-expose-headers X-Results-Total-Count,X-Page-Info
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	214ms 214ms	Image image/gif	104.109.89.85 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&session=a91b16e8-11fa-4030-864d-094a45585c8e&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2003%20Jun%202021%2012%3A26%3A17%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2003%20Jun%202021%2012%3A26%3A16%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%227013%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22SharpPanda%3A%20Chinese%20APT%20Group%20Targets%20Southeast%20Asian%20Government%20With%20Previously%20Unknown%20Backdoor%20-%20Check%20Point%20Research%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor%2F&pageViewId=2ed83740-d408-4a76-86d3-d2f9531769ab Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.109.89.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-89-85.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:17 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
OPTIONS H2	200	wxbvs5zxy7iy targeting.api.drift.com/hours/availability/combined/ Frame	0 0	112ms 110ms	Preflight text/plain	34.193.113.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://targeting.api.drift.com/hours/availability/combined/wxbvs5zxy7iy Protocol H2 Server 34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-193-113-164.compute-1.amazonaws.com Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept */* Access-Control-Request-Method GET Access-Control-Request-Headers authorization Origin https://js.driftt.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode cors Response headers date Thu, 03 Jun 2021 12:26:18 GMT access-control-allow-origin * access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version access-control-allow-credentials true access-control-expose-headers X-Results-Total-Count,X-Page-Info access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH access-control-max-age 1209600 strict-transport-security max-age=31536000; includeSubDomains content-type text/plain allow HEAD,GET,OPTIONS requestid drift21c0fd9495aa15fcf08e509b757 content-length 18 x-envoy-upstream-service-time 1 server istio-envoy
GET H2	200	wxbvs5zxy7iy Show response targeting.api.drift.com/hours/availability/combined/ Frame 9745	46 B 110 B	140ms 139ms	XHR application/json	34.193.113.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://targeting.api.drift.com/hours/availability/combined/wxbvs5zxy7iy Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/42.1d3e72f0.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-193-113-164.compute-1.amazonaws.com Software istio-envoy / Resource Hash 8dceb6d58546ac80c154724cdbc747d94fe32c6aacc64be5753933e91ee965c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Authorization Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI5ODY3ODgzODE5IiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTMzMTkwNCIsImV4cCI6MTY1NDI1OTE3NywiaWF0IjoxNjIyNzIzMTc3fQ.t78cVHkzt_NlZHX6oxpc-zPBk43vSlcVTe0rli1DEAxq2KYMDSHY8Wl4NRwwxd1Zf-O4kc6ufY4uKKqw8oPfNA Response headers date Thu, 03 Jun 2021 12:26:18 GMT server istio-envoy requestid 6f60876f11812fe0 vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type application/json;charset=utf-8 access-control-allow-origin * access-control-max-age 1209600 access-control-allow-credentials true x-envoy-upstream-service-time 33 strict-transport-security max-age=31536000; includeSubDomains access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version content-length 46 access-control-expose-headers X-Results-Total-Count,X-Page-Info
OPTIONS H2	200	track event.api.drift.com/ Frame	0 0	324ms 108ms	Preflight text/plain	54.145.60.34 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://event.api.drift.com/track Protocol H2 Server 54.145.60.34 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-145-60-34.compute-1.amazonaws.com Software / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://js.driftt.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode cors Response headers date Thu, 03 Jun 2021 12:26:18 GMT content-type text/plain content-length 13 access-control-allow-origin * access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version access-control-allow-credentials true access-control-expose-headers X-Results-Total-Count,X-Page-Info access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH access-control-max-age 1209600 strict-transport-security max-age=31536000; includeSubDomains allow POST,OPTIONS requestid drift74f8a9d44e6b4537421ec721605
POST H2	200	track Show response event.api.drift.com/ Frame 9745	762 B 1 KB	110ms 110ms	XHR application/json	54.145.60.34 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://event.api.drift.com/track Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/42.1d3e72f0.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.145.60.34 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-145-60-34.compute-1.amazonaws.com Software / Resource Hash 53e105e69ff07778902acee37d70d57b7a117fec234b6fffe9c778db1b93ac1e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ Authorization Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI5ODY3ODgzODE5IiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTMzMTkwNCIsImV4cCI6MTY1NDI1OTE3NywiaWF0IjoxNjIyNzIzMTc3fQ.t78cVHkzt_NlZHX6oxpc-zPBk43vSlcVTe0rli1DEAxq2KYMDSHY8Wl4NRwwxd1Zf-O4kc6ufY4uKKqw8oPfNA User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type application/json Response headers date Thu, 03 Jun 2021 12:26:18 GMT requestid 87e91ce392cd3f54 access-control-max-age 1209600 access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type application/json;charset=utf-8 access-control-allow-origin * access-control-expose-headers X-Results-Total-Count,X-Page-Info access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version content-length 762
GET H2	200	47.d1ec1cad.chunk.js Show response js.driftt.com/core/assets/js/ Frame 9745	17 KB 6 KB	43ms 42ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/47.d1ec1cad.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 4f7b7bbf5225cd88e68285c8d02057dd19cb7e7a12d4465f67c9cd2976aeee29 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:45 GMT content-encoding gzip age 1442193 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:48 GMT server nginx etag W/"df31a79a2de4ba62caa657c97430e66a" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id DMAn20D8bvI5mDi60vBr03OzyuS1ohG6 via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id NxymMsDNHG7yYPZIXaRopTSxxvDyNxk3XdIdNnUoPUcAErMmbyxfRw==
GET H2	200	47.d1ec1cad.chunk.js Show response js.driftt.com/core/assets/js/ Frame F2B4	17 KB 6 KB	40ms 39ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/47.d1ec1cad.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.ff407db2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 4f7b7bbf5225cd88e68285c8d02057dd19cb7e7a12d4465f67c9cd2976aeee29 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 19:49:45 GMT content-encoding gzip age 1442193 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 17 May 2021 19:05:48 GMT server nginx etag W/"df31a79a2de4ba62caa657c97430e66a" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id DMAn20D8bvI5mDi60vBr03OzyuS1ohG6 via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id qsE0Rn2jcMe2xUlgkVcp6pRu2zWftNU_p9ERve95gViH_HK1vOf7tA==
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	207ms 207ms	Image image/gif	104.109.89.85 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&session=a91b16e8-11fa-4030-864d-094a45585c8e&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2003%20Jun%202021%2012%3A26%3A18%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2003%20Jun%202021%2012%3A26%3A17%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%228014%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22SharpPanda%3A%20Chinese%20APT%20Group%20Targets%20Southeast%20Asian%20Government%20With%20Previously%20Unknown%20Backdoor%20-%20Check%20Point%20Research%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor%2F&pageViewId=2ed83740-d408-4a76-86d3-d2f9531769ab Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.109.89.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-89-85.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:18 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
POST H2	200	evaluate_with_log Show response targeting.api.drift.com/targeting/ Frame 9745	2 KB 695 B	111ms 111ms	XHR application/json	34.193.113.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://targeting.api.drift.com/targeting/evaluate_with_log Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/42.1d3e72f0.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-193-113-164.compute-1.amazonaws.com Software istio-envoy / Resource Hash c55a79c4c4c3333e5ef7b6c68847925a2a1251973c58bfcdd0e9ca69d58d97d9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ Authorization Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI5ODY3ODgzODE5IiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTMzMTkwNCIsImV4cCI6MTY1NDI1OTE3NywiaWF0IjoxNjIyNzIzMTc3fQ.t78cVHkzt_NlZHX6oxpc-zPBk43vSlcVTe0rli1DEAxq2KYMDSHY8Wl4NRwwxd1Zf-O4kc6ufY4uKKqw8oPfNA User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type application/json Response headers date Thu, 03 Jun 2021 12:26:18 GMT content-encoding gzip server istio-envoy requestid 16152da0a49615b vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type application/json;charset=utf-8 access-control-allow-origin * access-control-max-age 1209600 access-control-allow-credentials true x-envoy-upstream-service-time 1 strict-transport-security max-age=31536000; includeSubDomains access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version content-length 634 access-control-expose-headers X-Results-Total-Count,X-Page-Info
OPTIONS H2	200	evaluate_with_log targeting.api.drift.com/targeting/ Frame	0 0	107ms 107ms	Preflight text/plain	34.193.113.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://targeting.api.drift.com/targeting/evaluate_with_log Protocol H2 Server 34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-193-113-164.compute-1.amazonaws.com Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://js.driftt.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode cors Response headers date Thu, 03 Jun 2021 12:26:18 GMT access-control-allow-origin * access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version access-control-allow-credentials true access-control-expose-headers X-Results-Total-Count,X-Page-Info access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH access-control-max-age 1209600 strict-transport-security max-age=31536000; includeSubDomains content-type text/plain allow POST,OPTIONS requestid drift79660fe46d5b4148f72538b308c content-length 13 x-envoy-upstream-service-time 0 server istio-envoy
POST H2	200	bulk Show response metrics.api.drift.com/monitoring/metrics/event2/ Frame 9745	25 B 89 B	118ms 118ms	XHR application/json	54.147.21.139 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://metrics.api.drift.com/monitoring/metrics/event2/bulk Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/42.1d3e72f0.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-147-21-139.compute-1.amazonaws.com Software istio-envoy / Resource Hash f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ Authorization Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI5ODY3ODgzODE5IiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTMzMTkwNCIsImV4cCI6MTY1NDI1OTE3NywiaWF0IjoxNjIyNzIzMTc3fQ.t78cVHkzt_NlZHX6oxpc-zPBk43vSlcVTe0rli1DEAxq2KYMDSHY8Wl4NRwwxd1Zf-O4kc6ufY4uKKqw8oPfNA User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type application/json Response headers date Thu, 03 Jun 2021 12:26:18 GMT server istio-envoy requestid c7d598d507262dfa vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type application/json;charset=utf-8 access-control-allow-origin * access-control-max-age 1209600 access-control-allow-credentials true x-envoy-upstream-service-time 11 strict-transport-security max-age=31536000; includeSubDomains access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version content-length 25 access-control-expose-headers X-Results-Total-Count,X-Page-Info
OPTIONS H2	200	bulk metrics.api.drift.com/monitoring/metrics/event2/ Frame	0 0	108ms 108ms	Preflight text/plain	54.147.21.139 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://metrics.api.drift.com/monitoring/metrics/event2/bulk Protocol H2 Server 54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-147-21-139.compute-1.amazonaws.com Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://js.driftt.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode cors Response headers date Thu, 03 Jun 2021 12:26:18 GMT access-control-allow-origin * access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version access-control-allow-credentials true access-control-expose-headers X-Results-Total-Count,X-Page-Info access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH access-control-max-age 1209600 strict-transport-security max-age=31536000; includeSubDomains content-type text/plain allow POST,OPTIONS requestid driftc37beb14f99a6167979f8794701 content-length 13 x-envoy-upstream-service-time 0 server istio-envoy
POST H2	200	render_initial Show response flow.api.drift.com/flows/ Frame 9745	3 KB 2 KB	134ms 133ms	XHR application/json	34.193.113.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://flow.api.drift.com/flows/render_initial Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/42.1d3e72f0.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-193-113-164.compute-1.amazonaws.com Software istio-envoy / Resource Hash 1873cebc73ee1eb71edaa8eadc9a165060572d3e66777a458674b0a5030c0230 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ Authorization Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI5ODY3ODgzODE5IiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTMzMTkwNCIsImV4cCI6MTY1NDI1OTE3NywiaWF0IjoxNjIyNzIzMTc3fQ.t78cVHkzt_NlZHX6oxpc-zPBk43vSlcVTe0rli1DEAxq2KYMDSHY8Wl4NRwwxd1Zf-O4kc6ufY4uKKqw8oPfNA User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type application/json Response headers date Thu, 03 Jun 2021 12:26:18 GMT content-encoding gzip server istio-envoy requestid 557e8809bf732feb vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type application/json;charset=utf-8 access-control-allow-origin * access-control-max-age 1209600 access-control-allow-credentials true x-envoy-upstream-service-time 27 strict-transport-security max-age=31536000; includeSubDomains access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version content-length 1877 access-control-expose-headers X-Results-Total-Count,X-Page-Info
OPTIONS H2	200	render_initial flow.api.drift.com/flows/ Frame	0 0	109ms 107ms	Preflight text/plain	34.193.113.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://flow.api.drift.com/flows/render_initial Protocol H2 Server 34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-193-113-164.compute-1.amazonaws.com Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://js.driftt.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode cors Response headers date Thu, 03 Jun 2021 12:26:18 GMT access-control-allow-origin * access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version access-control-allow-credentials true access-control-expose-headers X-Results-Total-Count,X-Page-Info access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH access-control-max-age 1209600 strict-transport-security max-age=31536000; includeSubDomains content-type text/plain allow POST,OPTIONS requestid drift9ceaaf54bc98ae47cbf8419b2ab content-length 13 x-envoy-upstream-service-time 1 server istio-envoy
OPTIONS H2	200	widget targeting.api.drift.com/impressions/ Frame	0 0	108ms 108ms	Preflight text/plain	34.193.113.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://targeting.api.drift.com/impressions/widget Protocol H2 Server 34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-193-113-164.compute-1.amazonaws.com Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://js.driftt.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode cors Response headers date Thu, 03 Jun 2021 12:26:19 GMT access-control-allow-origin * access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version access-control-allow-credentials true access-control-expose-headers X-Results-Total-Count,X-Page-Info access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH access-control-max-age 1209600 strict-transport-security max-age=31536000; includeSubDomains content-type text/plain allow POST,OPTIONS requestid drift003cff54935a01f3cfac34f8dc2 content-length 13 x-envoy-upstream-service-time 1 server istio-envoy
POST H2	204	widget Show response targeting.api.drift.com/impressions/ Frame 9745	0 38 B	117ms 117ms	XHR text/plain	34.193.113.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://targeting.api.drift.com/impressions/widget Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/42.1d3e72f0.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-193-113-164.compute-1.amazonaws.com Software istio-envoy / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ Authorization Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI5ODY3ODgzODE5IiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTMzMTkwNCIsImV4cCI6MTY1NDI1OTE3NywiaWF0IjoxNjIyNzIzMTc3fQ.t78cVHkzt_NlZHX6oxpc-zPBk43vSlcVTe0rli1DEAxq2KYMDSHY8Wl4NRwwxd1Zf-O4kc6ufY4uKKqw8oPfNA User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type application/json Response headers date Thu, 03 Jun 2021 12:26:19 GMT server istio-envoy requestid 6e078ea1b47758c4 strict-transport-security max-age=31536000; includeSubDomains access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH access-control-allow-origin * access-control-max-age 1209600 access-control-allow-credentials true x-envoy-upstream-service-time 10 access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version access-control-expose-headers X-Results-Total-Count,X-Page-Info
GET H2	200	https%3A%2F%2Fdriftt.imgix.net%2Fhttps%253A%252F%252Fs3.amazonaws.com%252Fcustomer-api-avatars-prod%252F1841818%252Fd4519a1340e418d6d3aa7622549d75e8eka3ccta6swz%3Ffit%3Dmax%26fm%3Dpng%26h%3D200%26w... driftt.imgix.net/ Frame 9745	3 KB 1 KB	21ms 7ms	Image image/svg+xml	2a04:4e42:3::720 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://driftt.imgix.net/https%3A%2F%2Fdriftt.imgix.net%2Fhttps%253A%252F%252Fs3.amazonaws.com%252Fcustomer-api-avatars-prod%252F1841818%252Fd4519a1340e418d6d3aa7622549d75e8eka3ccta6swz%3Ffit%3Dmax%26fm%3Dpng%26h%3D200%26w%3D200%26s%3Dbe0f16a427261f657959aca020697922?fit=max&fm=png&h=200&w=200&s=acc74a6db707f3b4ce9498b82276fc32 Requested by Host: js.driftt.com URL: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&forceShow=false&skipCampaigns=false&sessionId=8e0891d6-3434-48e6-9d27-5830ee058acd&sessionStarted=1622723176&campaignRefreshToken=20532406-6648-471b-ba0e-cd0d0854e10e&hideController=false&pageLoadStartTime=1622723169969&mode=CHAT Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::720 , United States, ASN54113 (FASTLY, US), Reverse DNS Software imgix / Resource Hash 1bea7b5a974337a25883b38d0994c55ddc0835085a09d395809cfa32b8e24355 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://js.driftt.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 03 Jun 2021 12:26:19 GMT content-encoding gzip x-content-type-options nosniff fastly-restarts 1 age 3020008 x-cache MISS, HIT, HIT x-imgix-id df3839ea32194e7822b514b5d6ed604f1f92a5de content-length 795 x-served-by cache-sjc10066-SJC, cache-sjc10052-SJC, cache-fra19125-FRA last-modified Mon, 04 Jan 2021 06:10:44 GMT server imgix vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=315360000 accept-ranges bytes cross-origin-resource-policy cross-origin
GET H2	200	mem8YaGs126MiZpBA-UFVZ0b.woff2 fonts.gstatic.com/s/opensans/v20/ Frame 9745	14 KB 14 KB	41ms 7ms	Font font/woff2	2a00:1450:4001:829::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v20/mem8YaGs126MiZpBA-UFVZ0b.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open%20Sans|Open%20Sans:bold&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://js.driftt.com Referer https://fonts.googleapis.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 01 Jun 2021 22:32:33 GMT x-content-type-options nosniff last-modified Tue, 18 May 2021 21:21:19 GMT server sffe age 136426 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14440 x-xss-protection 0 expires Wed, 01 Jun 2022 22:32:33 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 451 B	58ms 18ms	XHR text/plain	2a00:1450:400c:c08::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j90&tid=UA-194688-3&cid=1134513090.1622723170&jid=1171409905&gjid=1808781737&_gid=383040952.1622723170&_u=aHDAgEABAAAAAG~&z=646543377 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c08::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Thu, 03 Jun 2021 12:26:19 GMT content-type text/plain access-control-allow-origin https://research.checkpoint.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	collect www.google-analytics.com/	35 B 397 B	38ms 6ms	Image image/gif	2a00:1450:4001:831::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j90&a=542133226&t=event&ni=1&_s=2&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor%2F&dr=https%3A%2F%2Ft.co%2F&ul=en-us&de=UTF-8&dt=SharpPanda%3A%20Chinese%20APT%20Group%20Targets%20Southeast%20Asian%20Government%20With%20Previously%20Unknown%20Backdoor%20-%20Check%20Point%20Research&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Drift%20Widget&ea=Playbook%20Fired&el=Playbook%20ID%3A%202110217&_u=aHDAgEABAAAAAG~&jid=1171409905&gjid=1808781737&cid=1134513090.1622723170&tid=UA-194688-3&_gid=383040952.1622723170&gtm=2wg5q15JCRGP&z=2039174817 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Wed, 02 Jun 2021 15:32:22 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 75237 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.com/ads/	42 B 505 B	67ms 34ms	Image image/gif	2a00:1450:4001:809::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-194688-3&cid=1134513090.1622723170&jid=1171409905&_u=aHDAgEABAAAAAG~&z=707158222 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Thu, 03 Jun 2021 12:26:19 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 505 B	67ms 34ms	Image image/gif	2a00:1450:4001:80f::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-194688-3&cid=1134513090.1622723170&jid=1171409905&_u=aHDAgEABAAAAAG~&z=707158222 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Thu, 03 Jun 2021 12:26:19 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	4.7e67eece.chunk.js Show response js.driftt.com/conductor/assets/	158 B 821 B	40ms 40ms	Script application/javascript	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/conductor/assets/4.7e67eece.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/include/1622723400000/wxbvs5zxy7iy.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash 7060ccc4a800448d37027d5c6beb0084ad19061feb48a523e29ea1b7dbc1ae3b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 22 Mar 2021 14:41:19 GMT via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) age 6299100 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront content-length 158 last-modified Mon, 22 Mar 2021 14:08:22 GMT server nginx etag "807a90e9d6c19e174f5905b1d130989a" strict-transport-security max-age=31536000; includeSubDomains access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 2OKAPOEBwmfC7ciZWi3f2oC9TZifZTh1 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 accept-ranges bytes content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 6z8-j5sCBhK2LiYkGePOS7BlVpD50hIQGmLjw4N-f947MGn0cLnmKg==
GET H2	206	notification.d46d7db1.mp3 js.driftt.com/conductor/assets/media/	20 KB 21 KB	45ms 44ms	Media audio/mpeg	52.222.158.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/conductor/assets/media/notification.d46d7db1.mp3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.158.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-158-2.cdg52.r.cloudfront.net Software nginx / Resource Hash ad80ac33ed04b4e6d78167b4162ecd3d2e8c29d17b43eb3df1f35b216b2ac5c5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://research.checkpoint.com/ Accept-Encoding identity;q=1, *;q=0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Range bytes=0- Response headers date Thu, 11 Mar 2021 22:01:41 GMT via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e1.cloudfront.net (CloudFront) age 7223078 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront Content-Range bytes 0-20896/20897 Content-Length 20897 last-modified Thu, 11 Mar 2021 21:29:39 GMT server nginx etag "d46d7db110874da77e094dcbc4bec8e6" strict-transport-security max-age=31536000; includeSubDomains access-control-allow-methods GET, POST, OPTIONS x-amz-version-id Qw4ohBG6iBhPX0HyTJ2OV8nxTFBd8zR_ access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop CDG52-P2 accept-ranges bytes content-type audio/mpeg access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id QOZ1s2Ys2IWlQ24wKTdUiNNfe4-_SLcLfSDwd8DxEcHl66s3ObPSCw==
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	257ms 257ms	Image image/gif	104.109.89.85 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&session=8dc54be4-dbef-444c-8294-45dacbac3e1e&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2003%20Jun%202021%2012%3A26%3A19%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2003%20Jun%202021%2012%3A26%3A18%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%229015%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22SharpPanda%3A%20Chinese%20APT%20Group%20Targets%20Southeast%20Asian%20Government%20With%20Previously%20Unknown%20Backdoor%20-%20Check%20Point%20Research%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor%2F&pageViewId=2ed83740-d408-4a76-86d3-d2f9531769ab Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.109.89.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-89-85.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:19 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:51:25 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e5026ad-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	219ms 218ms	Image image/gif	104.109.89.85 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&session=8dc54be4-dbef-444c-8294-45dacbac3e1e&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2003%20Jun%202021%2012%3A26%3A20%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2003%20Jun%202021%2012%3A26%3A19%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%2210017%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22(1)%20New%20Message!%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor%2F&pageViewId=2ed83740-d408-4a76-86d3-d2f9531769ab Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.109.89.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-89-85.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://research.checkpoint.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 03 Jun 2021 12:26:20 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
POST H2	200	bulk Show response metrics.api.drift.com/monitoring/metrics/add/ Frame 9745	25 B 83 B	109ms 108ms	XHR application/json	54.147.21.139 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://metrics.api.drift.com/monitoring/metrics/add/bulk Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/42.1d3e72f0.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-147-21-139.compute-1.amazonaws.com Software istio-envoy / Resource Hash f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ Authorization Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI5ODY3ODgzODE5IiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTMzMTkwNCIsImV4cCI6MTY1NDI1OTE3NywiaWF0IjoxNjIyNzIzMTc3fQ.t78cVHkzt_NlZHX6oxpc-zPBk43vSlcVTe0rli1DEAxq2KYMDSHY8Wl4NRwwxd1Zf-O4kc6ufY4uKKqw8oPfNA User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type application/json Response headers date Thu, 03 Jun 2021 12:26:21 GMT server istio-envoy requestid a2d46fa46821120b vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type application/json;charset=utf-8 access-control-allow-origin * access-control-max-age 1209600 access-control-allow-credentials true x-envoy-upstream-service-time 1 strict-transport-security max-age=31536000; includeSubDomains access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version content-length 25 access-control-expose-headers X-Results-Total-Count,X-Page-Info
OPTIONS H2	200	bulk metrics.api.drift.com/monitoring/metrics/add/ Frame	0 0	108ms 108ms	Preflight text/plain	54.147.21.139 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://metrics.api.drift.com/monitoring/metrics/add/bulk Protocol H2 Server 54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-147-21-139.compute-1.amazonaws.com Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://js.driftt.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode cors Response headers date Thu, 03 Jun 2021 12:26:21 GMT access-control-allow-origin * access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version access-control-allow-credentials true access-control-expose-headers X-Results-Total-Count,X-Page-Info access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH access-control-max-age 1209600 strict-transport-security max-age=31536000; includeSubDomains content-type text/plain allow POST,OPTIONS requestid drift9fa9af44a86ab4236d53e543bd2 content-length 13 x-envoy-upstream-service-time 1 server istio-envoy
GET		img.gif b.6sc.co/v1/beacon/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

b.6sc.co

URL

https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&session=82821de4-8ce1-4a15-871e-4448d510a198&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2003%20Jun%202021%2012%3A26%3A23%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2003%20Jun%202021%2012%3A26%3A20%20GMT%22%2C%22timeSpent%22%3A%223001%22%2C%22totalTimeSpent%22%3A%2213018%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22SharpPanda%3A%20Chinese%20APT%20Group%20Targets%20Southeast%20Asian%20Government%20With%20Previously%20Unknown%20Backdoor%20-%20Check%20Point%20Research%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fchinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor%2F&pageViewId=2ed83740-d408-4a76-86d3-d2f9531769ab