www.splunk.com Open in urlscan Pro
72.247.179.120 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://s1528.t.en25.com/e/er?s=1528&lid=24738&elqTrackId=0F147ED02E384777A7A07100DCBAFE70&elq=223f11dc2fea4ece8c68b4970a...
Effective URL:
https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?ut...
Submission: On October 08 via api (October 8th 2020, 12:33:51 am UTC) from SG

Summary HTTP 137 Redirects Links 21 Behaviour Indicators

Summary

This website contacted 46 IPs in 8 countries across 35 domains to perform 137 HTTP transactions. The main IP is 72.247.179.120, located in Netherlands and belongs to AKAMAI-ASN1, EU. The main domain is www.splunk.com.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on May 6th 2020. Valid for: a year.

This is the only time www.splunk.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	209.167.231.27 209.167.231.27	7160 (NETDYNAMICS) (NETDYNAMICS)
1 1	209.167.231.17 209.167.231.17	7160 (NETDYNAMICS) (NETDYNAMICS)
43	72.247.179.120 72.247.179.120	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3 18	151.101.113.181 151.101.113.181	54113 (FASTLY) (FASTLY)
3	93.184.221.26 93.184.221.26	15133 (EDGECAST) (EDGECAST)
6	2606:4700::68... 2606:4700::6810:9440	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	2a00:1450:400... 2a00:1450:4001:819::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81f::2008	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:6c0... 2a02:26f0:6c00:298::11a6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 1	216.58.212.134 216.58.212.134	15169 (GOOGLE) (GOOGLE)
1	216.58.207.38 216.58.207.38	15169 (GOOGLE) (GOOGLE)
1	2606:4700:10:... 2606:4700:10::6814:15ef	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:10:... 2606:4700:10::6814:b944	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:6c0... 2a02:26f0:6c00:192::11a6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	68.232.35.12 68.232.35.12	15133 (EDGECAST) (EDGECAST)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2a02:26f0:6c0... 2a02:26f0:6c00:296::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	147.75.100.245 147.75.100.245	54825 (PACKET) (PACKET)
1	99.86.243.29 99.86.243.29	16509 (AMAZON-02) (AMAZON-02)
1	99.86.240.169 99.86.240.169	16509 (AMAZON-02) (AMAZON-02)
1	52.84.112.20 52.84.112.20	16509 (AMAZON-02) (AMAZON-02)
2	3.120.63.212 3.120.63.212	16509 (AMAZON-02) (AMAZON-02)
2	99.86.243.59 99.86.243.59	16509 (AMAZON-02) (AMAZON-02)
1	205.185.216.10 205.185.216.10	20446 (HIGHWINDS3) (HIGHWINDS3)
1	99.86.243.95 99.86.243.95	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:815::2008	15169 (GOOGLE) (GOOGLE)
3	104.109.70.122 104.109.70.122	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	104.16.168.82 104.16.168.82	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	209.167.231.15 209.167.231.15	7160 (NETDYNAMICS) (NETDYNAMICS)
1	93.184.220.42 93.184.220.42	15133 (EDGECAST) (EDGECAST)
1	99.86.245.27 99.86.245.27	16509 (AMAZON-02) (AMAZON-02)
1	52.84.112.76 52.84.112.76	16509 (AMAZON-02) (AMAZON-02)
2 2	52.212.22.61 52.212.22.61	16509 (AMAZON-02) (AMAZON-02)
1 2	52.84.112.119 52.84.112.119	16509 (AMAZON-02) (AMAZON-02)
2 3	37.252.172.38 37.252.172.38	29990 (ASN-APPNEX) (ASN-APPNEX)
1	147.75.33.131 147.75.33.131	54825 (PACKET) (PACKET)
1 2	2a05:f500:11:... 2a05:f500:11:101::b93f:9005	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	54.217.118.25 54.217.118.25	16509 (AMAZON-02) (AMAZON-02)
3	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	37.252.172.36 37.252.172.36	29990 (ASN-APPNEX) (ASN-APPNEX)
2	2a00:1450:400... 2a00:1450:400c:c06::9b	15169 (GOOGLE) (GOOGLE)
1	52.208.77.122 52.208.77.122	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:81c::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:81c::2003	15169 (GOOGLE) (GOOGLE)
1 2	3.121.145.84 3.121.145.84	16509 (AMAZON-02) (AMAZON-02)
1	18.203.124.74 18.203.124.74	16509 (AMAZON-02) (AMAZON-02)
1	34.250.128.129 34.250.128.129	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:f1:... 2a02:26f0:f1:288::11a6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
137	46

1 209.167.231.27 (United States) 1 redirects

ASN7160 (NETDYNAMICS, US)
PTR: e027.en25.com

s1528.t.en25.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 209.167.231.17 (United States) 1 redirects

ASN7160 (NETDYNAMICS, US)
PTR: e017.en25.com

s1528.t.eloqua.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

43 72.247.179.120 (Netherlands)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a72-247-179-120.deploy.static.akamaitechnologies.com

www.splunk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 151.101.113.181 (Frankfurt am Main, Germany) 3 redirects

ASN54113 (FASTLY, US)

play.vidyard.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 93.184.221.26 (London, United Kingdom)

ASN15133 (EDGECAST, US)

cdn.vidyard.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6810:9440 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:819::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:298::11a6 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

s.go-mpulse.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.212.134 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: ams15s21-in-f134.1e100.net

fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.207.38 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: fra16s24-in-f6.1e100.net

3801996.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6814:15ef (United States)

ASN13335 (CLOUDFLARENET, US)

rum-static.pingdom.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6814:b944 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:192::11a6 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

c.go-mpulse.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 68.232.35.12 (United States)

ASN15133 (EDGECAST, US)

cdn.bizible.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:6c00:296::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 147.75.100.245 (Central, Hong Kong)

ASN54825 (PACKET, US)
PTR: pkt-ams-k2-shared-ingress2

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.243.29 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-243-29.vie50.r.cloudfront.net

scripts.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.240.169 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-240-169.vie50.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.84.112.20 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-84-112-20.sof50.r.cloudfront.net

px.airpr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.120.63.212 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-120-63-212.eu-central-1.compute.amazonaws.com

tm.vendemore.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
analytics.vendemore.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.86.243.59 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-243-59.vie50.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.185.216.10 (Phoenix, United States)

ASN20446 (HIGHWINDS3, US)
PTR: map2.hwcdn.net

metadata-static-files.sfo2.cdn.digitaloceanspaces.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.243.95 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-243-95.vie50.r.cloudfront.net

t.contentsquare.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:815::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.109.70.122 (Netherlands)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a104-109-70-122.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.168.82 (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 209.167.231.15 (United States)

ASN7160 (NETDYNAMICS, US)
PTR: now.eloqua.com

secure.eloqua.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 93.184.220.42 (London, United Kingdom)

ASN15133 (EDGECAST, US)

cdn.bizibly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.245.27 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-245-27.vie50.r.cloudfront.net

d2hya7iqhf5w3h.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.84.112.76 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-84-112-76.sof50.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.212.22.61 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-212-22-61.eu-west-1.compute.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.84.112.119 (Seattle, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-52-84-112-119.sof50.r.cloudfront.net

segments.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 37.252.172.38 (Ascension Island) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 690.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.33.131 (Amsterdam, Netherlands)

ASN54825 (PACKET, US)
PTR: pkt-ams-k2-shared-ingress9

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:11:101::b93f:9005 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.217.118.25 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-217-118-25.eu-west-1.compute.amazonaws.com

c.contentsquare.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.252.172.36 (Ascension Island)

ASN29990 (ASN-APPNEX, US)
PTR: 692.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c06::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.208.77.122 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-208-77-122.eu-west-1.compute.amazonaws.com

in.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81c::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81c::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.121.145.84 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-121-145-84.eu-central-1.compute.amazonaws.com

dpx.airpr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.203.124.74 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-203-124-74.eu-west-1.compute.amazonaws.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.250.128.129 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-250-128-129.eu-west-1.compute.amazonaws.com

rum-collector-2.pingdom.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:f1:288::11a6 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

6852bd11.akstat.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
43	splunk.com www.splunk.com	575 KB
21	vidyard.com 3 redirects play.vidyard.com cdn.vidyard.com	390 KB
8	google-analytics.com www.google-analytics.com	83 KB
6	cookielaw.org cdn.cookielaw.org	105 KB
4	adnxs.com 2 redirects secure.adnxs.com ib.adnxs.com	3 KB
4	contentsquare.net t.contentsquare.net c.contentsquare.net	43 KB
4	hotjar.com static.hotjar.com script.hotjar.com vars.hotjar.com in.hotjar.com	74 KB
4	doubleclick.net 1 redirects fls.doubleclick.net 3801996.fls.doubleclick.net stats.g.doubleclick.net	752 B
3	facebook.com www.facebook.com	525 B
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	3 KB
3	company-target.com 1 redirects api.company-target.com segments.company-target.com	2 KB
3	6sc.co j.6sc.co c.6sc.co b.6sc.co	8 KB
3	airpr.com 1 redirects px.airpr.com dpx.airpr.com	3 KB
3	bizible.com cdn.bizible.com	34 KB
3	googletagmanager.com www.googletagmanager.com	145 KB
3	eloqua.com 1 redirects s1528.t.eloqua.com secure.eloqua.com	2 KB
2	google.de www.google.de	193 B
2	google.com www.google.com	193 B
2	bidr.io 2 redirects match.prod.bidr.io	1019 B
2	driftt.com js.driftt.com	45 KB
2	vendemore.com tm.vendemore.com analytics.vendemore.com	954 B
2	adsrvr.org js.adsrvr.org insight.adsrvr.org	2 KB
2	bing.com bat.bing.com	8 KB
2	licdn.com snap.licdn.com	3 KB
2	facebook.net connect.facebook.net	91 KB
2	pingdom.net rum-static.pingdom.net rum-collector-2.pingdom.net	3 KB
2	go-mpulse.net s.go-mpulse.net c.go-mpulse.net	52 KB
1	akstat.io 6852bd11.akstat.io	390 B
1	cloudfront.net d2hya7iqhf5w3h.cloudfront.net	4 KB
1	bizibly.com cdn.bizibly.com	189 B
1	zoominfo.com ws.zoominfo.com	427 B
1	digitaloceanspaces.com metadata-static-files.sfo2.cdn.digitaloceanspaces.com	5 KB
1	demandbase.com scripts.demandbase.com	16 KB
1	onetrust.com geolocation.onetrust.com	355 B
1	en25.com 1 redirects s1528.t.en25.com	459 B
137	35

	Domain	Requested by
43	www.splunk.com	www.splunk.com
18	play.vidyard.com	3 redirects www.splunk.com
8	www.google-analytics.com	www.splunk.com www.google-analytics.com www.googletagmanager.com
6	cdn.cookielaw.org	www.splunk.com cdn.cookielaw.org
3	www.facebook.com	www.splunk.com connect.facebook.net
3	c.contentsquare.net	www.splunk.com
3	secure.adnxs.com	2 redirects www.splunk.com
3	cdn.bizible.com	www.splunk.com cdn.bizible.com
3	www.googletagmanager.com	www.splunk.com www.googletagmanager.com
3	cdn.vidyard.com	www.splunk.com
2	dpx.airpr.com	1 redirects
2	www.google.de	www.splunk.com
2	www.google.com	www.splunk.com
2	stats.g.doubleclick.net	www.splunk.com
2	px.ads.linkedin.com	1 redirects www.splunk.com
2	segments.company-target.com	1 redirects www.splunk.com
2	match.prod.bidr.io	2 redirects
2	secure.eloqua.com	www.splunk.com
2	js.driftt.com	www.splunk.com js.driftt.com
2	bat.bing.com	www.googletagmanager.com www.splunk.com
2	snap.licdn.com	www.googletagmanager.com snap.licdn.com
2	connect.facebook.net	www.splunk.com connect.facebook.net
1	6852bd11.akstat.io	s.go-mpulse.net
1	rum-collector-2.pingdom.net	www.splunk.com
1	insight.adsrvr.org	www.splunk.com
1	analytics.vendemore.com	www.splunk.com
1	in.hotjar.com	www.splunk.com
1	ib.adnxs.com	www.splunk.com
1	b.6sc.co	www.splunk.com
1	www.linkedin.com	1 redirects
1	vars.hotjar.com	www.splunk.com
1	c.6sc.co	www.splunk.com
1	api.company-target.com	www.splunk.com
1	d2hya7iqhf5w3h.cloudfront.net	www.splunk.com
1	script.hotjar.com	www.splunk.com
1	cdn.bizibly.com	www.splunk.com
1	ws.zoominfo.com	www.splunk.com
1	j.6sc.co	www.splunk.com
1	t.contentsquare.net	www.splunk.com
1	metadata-static-files.sfo2.cdn.digitaloceanspaces.com	www.splunk.com
1	tm.vendemore.com	www.splunk.com
1	px.airpr.com	www.splunk.com
1	js.adsrvr.org	www.googletagmanager.com
1	scripts.demandbase.com	www.splunk.com
1	static.hotjar.com	www.googletagmanager.com
1	c.go-mpulse.net	s.go-mpulse.net
1	geolocation.onetrust.com	www.splunk.com
1	rum-static.pingdom.net	www.splunk.com
1	3801996.fls.doubleclick.net	www.splunk.com
1	fls.doubleclick.net	1 redirects
1	s.go-mpulse.net	www.splunk.com
1	s1528.t.eloqua.com	1 redirects
1	s1528.t.en25.com	1 redirects
137	53

This site contains links to these domains. Also see Links.

Domain
login.splunk.com
community.splunk.com
docs.splunk.com
lantern.splunk.com
investors.splunk.com
conf.splunk.com
dev.splunk.com
splunkbase.splunk.com
www.mylogocloud.com
usergroups.splunk.com
twitter.com
www.facebook.com
www.linkedin.com
www.youtube.com
www.instagram.com
cookiepedia.co.uk
onetrust.com

Subject Issuer	Validity	Valid
www.splunk.com DigiCert SHA2 Secure Server CA	`2020-05-06` - `2021-05-11`	a year	crt.sh
*.vidyard.com DigiCert SHA2 Secure Server CA	`2020-04-08` - `2022-07-01`	2 years	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2020-07-01` - `2021-07-01`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
akstat.io DigiCert Secure Site ECC CA-1	`2020-05-06` - `2021-08-05`	a year	crt.sh
*.doubleclick.net GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.pingdom.net DigiCert SHA2 High Assurance Server CA	`2019-11-08` - `2021-01-19`	a year	crt.sh
*.onetrust.com DigiCert SHA2 Secure Server CA	`2020-05-21` - `2022-07-27`	2 years	crt.sh
io.bizible.com DigiCert SHA2 Secure Server CA	`2020-10-07` - `2021-11-08`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-09-11` - `2020-12-10`	3 months	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
www.bing.com Microsoft IT TLS CA 2	`2019-04-30` - `2021-04-30`	2 years	crt.sh
static.hotjar.com Let's Encrypt Authority X3	`2020-08-16` - `2020-11-14`	3 months	crt.sh
*.demandbase.com Go Daddy Secure Certificate Authority - G2	`2018-09-20` - `2020-11-19`	2 years	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh
*.airpr.com Amazon	`2020-02-10` - `2021-03-10`	a year	crt.sh
*.vendemore.com Trusted Secure Certificate Authority 5	`2020-02-20` - `2022-02-19`	2 years	crt.sh
drift.com Amazon	`2020-09-21` - `2021-10-23`	a year	crt.sh
*.sfo2.cdn.digitaloceanspaces.com DigiCert SHA2 Secure Server CA	`2020-03-11` - `2021-04-14`	a year	crt.sh
t.contentsquare.net Amazon	`2020-01-10` - `2021-02-10`	a year	crt.sh
*.6sc.co DigiCert SHA2 Secure Server CA	`2020-01-07` - `2021-04-07`	a year	crt.sh
zoominfo.com Cloudflare Inc ECC CA-3	`2020-07-04` - `2021-07-04`	a year	crt.sh
*.eloqua.com DigiCert SHA2 Secure Server CA	`2019-12-23` - `2021-12-22`	2 years	crt.sh
s2.wac.edgecastcdn.net DigiCert SHA2 Secure Server CA	`2019-05-01` - `2020-11-18`	2 years	crt.sh
script.hotjar.com Let's Encrypt Authority X3	`2020-08-17` - `2020-11-15`	3 months	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2020-05-26` - `2021-04-21`	a year	crt.sh
*.company-target.com Go Daddy Secure Certificate Authority - G2	`2019-06-19` - `2021-08-18`	2 years	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
vars.hotjar.com Let's Encrypt Authority X3	`2020-08-15` - `2020-11-13`	3 months	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2020-08-05` - `2021-02-05`	6 months	crt.sh
c.contentsquare.net Amazon	`2020-09-28` - `2021-10-28`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.hotjar.com Amazon	`2020-08-29` - `2021-09-28`	a year	crt.sh
www.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
p.ssl.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-09-03` - `2021-02-22`	a year	crt.sh
*.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.google.de GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh

This page contains 9 frames:

Primary Page: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
Frame ID: 0C51CC577CD0F7612640653D51057C49
Requests: 129 HTTP requests in this frame

Frame: https://s.go-mpulse.net/boomerang/M7Q82-FTRNS-TEZ4E-UCSZ2-NQJ9C
Frame ID: 01AB260CB54383017E5C9750EBE8B217
Requests: 2 HTTP requests in this frame

Frame: https://3801996.fls.doubleclick.net/activityi;dc_pre=CNGOwNvfo-wCFclE5QodVVkJXw;src=3801996;type=landi397;cat=splun025;ord=9382829862423.87
Frame ID: D1598D2F433077D1D37EB48DBE810099
Requests: 1 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Frame ID: BE60FAD6151285733035206CCDE6AA60
Requests: 1 HTTP requests in this frame

Frame: https://play.vidyard.com/tvSx692mGEcWThuE9nKFa7?v=4.2.14&type=inline&cc=en&disable_popouts=1
Frame ID: D59225EC53BDAA881407CBB71A692C0C
Requests: 1 HTTP requests in this frame

Frame: https://play.vidyard.com/LQkUcTwcyZHHwcDgDhApMn?v=4.2.14&type=inline&cc=en&disable_popouts=1
Frame ID: C49520BBDBE53482CC150CA7C511ACAB
Requests: 1 HTTP requests in this frame

Frame: https://play.vidyard.com/3S6wbYGAJ4cKkegMYspviz?v=4.2.14&type=inline&cc=en&disable_popouts=1
Frame ID: C5E4211C40F4EA52088ED8C69FF44DA8
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=65d5w9m&ref=https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DAPAC_FY21Q2_Oct20%26utm_content%3DDetecting-Malware-WP&upid=zfbopfz&upv=1.1.0
Frame ID: 8FBAF4A005DCC42B647BCB7988629F99
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/deploy/assets/index.html
Frame ID: 271BB33CD1A719C8A1ACCFF8B3055D46
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://s1528.t.en25.com/e/er?s=1528&lid=24738&elqTrackId=0F147ED02E384777A7A07100DCBAFE70&elq=223f11... HTTP 302
https://s1528.t.eloqua.com/e/er?s=1528&lid=24738&elqTrackId=0F147ED02E384777A7A07100DCBAFE70&elq=223f11... HTTP 302
https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/get... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

137
Requests

98 %
HTTPS

36 %
IPv6

35
Domains

53
Subdomains

46
IPs

8
Countries

1696 kB
Transfer

5318 kB
Size

36
Cookies

21 Outgoing links

These are links going to different origins than the main page.

URL: http://login.splunk.com/page/sso_redirect?type=portal
Title: Support Portal

Search URL Search Domain Scan URL

URL: https://community.splunk.com/t5/Splunk-Answers/ct-p/en-us-splunk-answers
Title: Splunk Answers

Search URL Search Domain Scan URL

URL: https://docs.splunk.com/Documentation
Title: Documentation

Search URL Search Domain Scan URL

URL: https://login.splunk.com/?module=roles&func=showloginform&redirecturl=https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DAPAC_FY21Q2_Oct20%26utm_content%3DDetecting-Malware-WP
Title: Login

Search URL Search Domain Scan URL

URL: http://lantern.splunk.com/
Title: Best Practices Guides

Search URL Search Domain Scan URL

URL: https://login.splunk.com/en_us/index.php?module=roles&func=showloginform&redirecturl=https%3A%2F%2Flogin.splunk.com%2Fpage%2Fsso_redirect%3Ftype%3Dimpartner%26_ga%3D2.141546678.545619620.1542647058-990810913.1539107675&artid=partner
Title: Partner Login

Search URL Search Domain Scan URL

URL: http://login.splunk.com/page/sso_redirect?type=portal&_ga=2.183606950.1875983365.1543257349-990810913.1539107675
Title: Support Portal

Search URL Search Domain Scan URL

URL: https://investors.splunk.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://community.splunk.com/
Title: Splunk Answers

Search URL Search Domain Scan URL

URL: https://conf.splunk.com/
Title: .conf

Search URL Search Domain Scan URL

URL: https://dev.splunk.com/
Title: Developers

Search URL Search Domain Scan URL

URL: https://splunkbase.splunk.com/
Title: Splunkbase

Search URL Search Domain Scan URL

URL: https://www.mylogocloud.com/splunk
Title: T-shirt Store

Search URL Search Domain Scan URL

URL: https://usergroups.splunk.com/
Title: User Groups

Search URL Search Domain Scan URL

URL: https://twitter.com/splunk

Search URL Search Domain Scan URL

URL: https://www.facebook.com/splunk

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/splunk

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/splunkvideos

Search URL Search Domain Scan URL

URL: https://www.instagram.com/splunk/

Search URL Search Domain Scan URL

URL: https://cookiepedia.co.uk/giving-consent-to-cookies
Title: More information

Search URL Search Domain Scan URL

URL: https://onetrust.com/poweredbyonetrust

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://s1528.t.en25.com/e/er?s=1528&lid=24738&elqTrackId=0F147ED02E384777A7A07100DCBAFE70&elq=223f11dc2fea4ece8c68b4970acbda65&elqaid=33149&elqat=1 HTTP 302
https://s1528.t.eloqua.com/e/er?s=1528&lid=24738&elqTrackId=0F147ED02E384777A7A07100DCBAFE70&elq=223f11dc2fea4ece8c68b4970acbda65&elqaid=33149&elqat=1 HTTP 302
https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 35

https://play.vidyard.com/tvSx692mGEcWThuE9nKFa7.jpg HTTP 302
https://cdn.vidyard.com/thumbnails/RlyvZ9Tp_kLhxVmjMEi1pA/4173f14c71ea02491f7d6b.jpg

Request Chain 36

https://play.vidyard.com/LQkUcTwcyZHHwcDgDhApMn.jpg HTTP 302
https://cdn.vidyard.com/thumbnails/sG7gGes3ZgWcvkwFOwraEQ/d40fdab29698482ac0fcc4.jpg

Request Chain 37

https://play.vidyard.com/3S6wbYGAJ4cKkegMYspviz.jpg HTTP 302
https://cdn.vidyard.com/thumbnails/KG_YJGFhMUbZz4cRg-VFeg/cc980e2e6b8f732c1238ec.jpg

Request Chain 49

https://fls.doubleclick.net/activityi;src=3801996;type=landi397;cat=splun025;ord=9382829862423.87 HTTP 302
https://3801996.fls.doubleclick.net/activityi;dc_pre=CNGOwNvfo-wCFclE5QodVVkJXw;src=3801996;type=landi397;cat=splun025;ord=9382829862423.87

Request Chain 86

https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
https://segments.company-target.com/log?vendor=choca&user_id=AAED8U6-_L0AABBvPsWYOg HTTP 303
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAED8U6-_L0AABBvPsWYOg&verifyHash=4d113eb6415ecf2a2a8c0daf43eb9de866913448

Request Chain 91

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=66727&time=1602117214459&url=https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DAPAC_FY21Q2_Oct20%26utm_content%3DDetecting-Malware-WP HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D66727%26time%3D1602117214459%26url%3Dhttps%253A%252F%252Fwww.splunk.com%252Fen_us%252Fsolutions%252Fsolution-areas%252Fsecurity-and-fraud%252Fsecurity-investigation%252Fgetting-started.html%253Futm_medium%253Demail%2526utm_source%253Dsplunk%2526utm_campaign%253DAPAC_FY21Q2_Oct20%2526utm_content%253DDetecting-Malware-WP%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=66727&time=1602117214459&url=https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DAPAC_FY21Q2_Oct20%26utm_content%3DDetecting-Malware-WP&liSync=true

Request Chain 124

https://dpx.airpr.com/px?hostname=www.splunk.com&profile=443780&ga_account_id=UA-399680-1&ga_account_type=UA&ga_c=305123563.1602117214&an=true HTTP 302
https://secure.adnxs.com/getuid?https://dpx.airpr.com/anpx?adnxs_uid=$UID&airpr_id=3212079466 HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fdpx.airpr.com%2Fanpx%3Fadnxs_uid%3D%24UID%26airpr_id%3D3212079466 HTTP 302
https://dpx.airpr.com/anpx?adnxs_uid=1185818055712851132&airpr_id=3212079466

137 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request getting-started.html Show response
www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/
Redirect Chain

http://s1528.t.en25.com/e/er?s=1528&lid=24738&elqTrackId=0F147ED02E384777A7A07100DCBAFE70&elq=223f11dc2fea4ece8c68b4970acbda65&elqaid=33149&elqat=1
https://s1528.t.eloqua.com/e/er?s=1528&lid=24738&elqTrackId=0F147ED02E384777A7A07100DCBAFE70&elq=223f11dc2fea4ece8c68b4970acbda65&elqaid=33149&elqat=1
https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=De...

112 KB
24 KB

138ms
77ms

Document
text/html

72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

a886586321c9ab22c09475a29dccd4f1f18e807ce655364cb5d80c23cb4b274e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:method: GET
:authority: www.splunk.com
:scheme: https
:path: /en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
content-type: text/html;charset=utf-8
server: Apache
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-language: en-US
content-encoding: gzip
serverid: prod-web02
x-akamai-transformed: 9 - 0 pmb=mNONE,1mRUM,2
cache-control: max-age=3600
expires: Thu, 08 Oct 2020 01:33:33 GMT
date: Thu, 08 Oct 2020 00:33:33 GMT
content-length: 22375
vary: Accept-Encoding
set-cookie: AKA_A2=A; expires=Thu, 08-Oct-2020 01:33:33 GMT; path=/; domain=splunk.com; secure; HttpOnly
server-timing: cdn-cache; desc=HIT edge; dur=4
x-akam-sw-version: 0.5.0
link: <https://www.splunk.com/etc/clientlibs/splunk/splunk-core/source/fonts/splunkdatasans/woff2/splunkdatasans_w_rg.woff2>;rel="preload";as="font";type="font/woff2";crossorigin,<https://www.splunk.com/etc/clientlibs/splunk/splunk-core/source/fonts/splunkdatasans/woff2/splunkdatasans_w_md.woff2>;rel="preload";as="font";type="font/woff2";crossorigin,<https://www.splunk.com/etc/clientlibs/splunk/splunk-core/source/fonts/splunkdatasans/woff2/splunkdatasans_w_bd.woff2>;rel="preload";as="font";type="font/woff2";crossorigin,<https://www.splunk.com/etc/clientlibs/splunk/splunk-core/source/fonts/icomoon/icomoon.ttf>;rel="preload";as="font";type="font/ttf";crossorigin

Redirect headers

Cache-Control: private,no-cache, no-store
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Location: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
Set-Cookie: ELOQUA=GUID=D05DDA7A755E4CCFA760889181D18E57; domain=.eloqua.com; expires=Mon, 08-Nov-2021 01:33:33 GMT; path=/;SameSite=None; secure ELQSTATUS=OK; domain=.eloqua.com; expires=Mon, 08-Nov-2021 01:33:33 GMT; path=/;SameSite=None; secure
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
X-Content-Type-Options: nosniff
Date: Thu, 08 Oct 2020 00:33:32 GMT
Content-Length: 344

GET
H2 200 splunkdatasans_w_rg.woff2
www.splunk.com/etc/clientlibs/splunk/splunk-core/source/fonts/splunkdatasans/woff2/ 21 KB
21 KB 34ms
33ms Font
font/woff2 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.splunk.com/etc/clientlibs/splunk/splunk-core/source/fonts/splunkdatasans/woff2/splunkdatasans_w_rg.woff2

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

dc6dc98cca0dd4df6b20f3813bb9f7da0b6bf8e0abb42653c0ee673880caecfd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Origin: https://www.splunk.com
Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
last-modified: Wed, 23 Sep 2020 01:16:37 GMT
server: Apache
status: 200
date: Thu, 08 Oct 2020 00:33:33 GMT
serverid: prod-web02
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=5184000
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 21052
expires: Mon, 07 Dec 2020 00:33:33 GMT

GET
H2 200 splunkdatasans_w_md.woff2
www.splunk.com/etc/clientlibs/splunk/splunk-core/source/fonts/splunkdatasans/woff2/ 20 KB
21 KB 35ms
34ms Font
font/woff2 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.splunk.com/etc/clientlibs/splunk/splunk-core/source/fonts/splunkdatasans/woff2/splunkdatasans_w_md.woff2

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

b6757c564305ac26f444cf3b00f5bfdce1e0684ae40b80706e5d9cffb2d81176

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Origin: https://www.splunk.com
Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
last-modified: Wed, 23 Sep 2020 01:15:35 GMT
server: Apache
status: 200
date: Thu, 08 Oct 2020 00:33:33 GMT
serverid: prod-web02
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=5184000
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 20876
expires: Mon, 07 Dec 2020 00:33:33 GMT

GET
H2 200 splunkdatasans_w_bd.woff2
www.splunk.com/etc/clientlibs/splunk/splunk-core/source/fonts/splunkdatasans/woff2/ 21 KB
21 KB 37ms
36ms Font
font/woff2 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.splunk.com/etc/clientlibs/splunk/splunk-core/source/fonts/splunkdatasans/woff2/splunkdatasans_w_bd.woff2

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

6607d39e43283ed0bb6e98c94d643344392be4086426e171c96df8a3ac1f40b9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Origin: https://www.splunk.com
Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
last-modified: Wed, 23 Sep 2020 01:16:14 GMT
server: Apache
status: 200
date: Thu, 08 Oct 2020 00:33:33 GMT
serverid: prod-web02
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=5184000
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 21288
expires: Mon, 07 Dec 2020 00:33:33 GMT

GET
H2 200 icomoon.ttf
www.splunk.com/etc/clientlibs/splunk/splunk-core/source/fonts/icomoon/ 37 KB
38 KB 37ms
36ms Font
font/ttf 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.splunk.com/etc/clientlibs/splunk/splunk-core/source/fonts/icomoon/icomoon.ttf

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

72c54e10197220c41df6aa7a2a4ba36c7dc6a910db9ff0251a983a02c06c2bd8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Origin: https://www.splunk.com
Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
last-modified: Wed, 23 Sep 2020 01:15:17 GMT
server: Apache
status: 200
date: Thu, 08 Oct 2020 00:33:33 GMT
serverid: prod-web01
content-type: font/ttf
access-control-allow-origin: *
cache-control: max-age=5184000
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 37888
expires: Mon, 07 Dec 2020 00:33:33 GMT

GET
H2 200 splunk-jquery.min.0fca26b5a37a66d68d0f4406976be4b5.js Show response
www.splunk.com/etc.clientlibs/splunk/clientlibs/ 95 KB
30 KB 5ms
0ms Script
application/javascript 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.splunk.com/etc.clientlibs/splunk/clientlibs/splunk-jquery.min.0fca26b5a37a66d68d0f4406976be4b5.js

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

8c2812ded6436715279f8fd8db58de307aa39ab0296fe3cf0e879067c51e9b18

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web02
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 30320
x-akamai-http2-push: 1
last-modified: Tue, 06 Oct 2020 15:25:02 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:33 GMT
content-type: application/javascript
expires: Thu, 15 Oct 2020 00:33:33 GMT
cache-control: max-age=604800
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 clientlib.min.448dbdae6dfa8f9bfb56bc41e62cc5b9.css
www.splunk.com/etc/clientlibs/splunk/legacy/designs/splunk/ 281 KB
38 KB 2ms
0ms Stylesheet
text/css 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.splunk.com/etc/clientlibs/splunk/legacy/designs/splunk/clientlib.min.448dbdae6dfa8f9bfb56bc41e62cc5b9.css

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

7a2334e568c9689046f0465df6067630a2e222f32478e37b794a9c6827252b92

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web01
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 38315
x-akamai-http2-push: 1
last-modified: Thu, 01 Oct 2020 04:02:06 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:33 GMT
content-type: text/css
expires: Thu, 15 Oct 2020 00:33:33 GMT
cache-control: max-age=604800
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 source.min.ca5ac006c6a4d8acea927bda7d082503.css
www.splunk.com/etc/clientlibs/splunk/splunk-com/ 821 KB
84 KB 4ms
0ms Stylesheet
text/css 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.splunk.com/etc/clientlibs/splunk/splunk-com/source.min.ca5ac006c6a4d8acea927bda7d082503.css

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

3b595fb0d95350953f7deb30135240364184967b460bb42827cf759bb596122a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web01
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 85301
x-akamai-http2-push: 1
last-modified: Wed, 30 Sep 2020 08:20:59 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:33 GMT
content-type: text/css
expires: Thu, 15 Oct 2020 00:33:33 GMT
cache-control: max-age=604800
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 clientlib-site.min.9ff8c96fdf034ffda70109151d8eca94.css
www.splunk.com/etc.clientlibs/splunk/clientlibs/ 7 KB
2 KB 4ms
0ms Stylesheet
text/css 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.splunk.com/etc.clientlibs/splunk/clientlibs/clientlib-site.min.9ff8c96fdf034ffda70109151d8eca94.css

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

6f876034ba4d35c700fde3a5a439bd9d1d60e924b43fc236f52c0d7724212d49

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web02
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 1418
x-akamai-http2-push: 1
last-modified: Fri, 25 Sep 2020 03:51:53 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:33 GMT
content-type: text/css
expires: Thu, 15 Oct 2020 00:33:33 GMT
cache-control: max-age=604800
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 source.min.7d8bd9ece95fd4856ae7367dc8225b04.js Show response
www.splunk.com/etc/clientlibs/splunk/splunk-core/ 343 KB
87 KB 6ms
0ms Script
application/javascript 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.splunk.com/etc/clientlibs/splunk/splunk-core/source.min.7d8bd9ece95fd4856ae7367dc8225b04.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

a810118a0ab9ab90e9acd36978cbf80ff11e9acbb20a47af7b11f782626bcd44

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web02
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 88742
x-akamai-http2-push: 1
last-modified: Sat, 26 Sep 2020 18:14:20 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:33 GMT
content-type: application/javascript
expires: Thu, 15 Oct 2020 00:33:33 GMT
cache-control: max-age=604800
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 clientlib-site.min.3c28748656932886ba72f1157ab2ee3c.js Show response
www.splunk.com/etc.clientlibs/splunk/clientlibs/ 2 KB
1 KB 6ms
0ms Script
application/javascript 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.splunk.com/etc.clientlibs/splunk/clientlibs/clientlib-site.min.3c28748656932886ba72f1157ab2ee3c.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

f46a35a641796cf74c1c248c93f8aa7829059cd946ccefbd3ddc4ee7e9ce4971

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web02
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 568
x-akamai-http2-push: 1
last-modified: Sun, 04 Oct 2020 05:35:05 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:33 GMT
content-type: application/javascript
expires: Thu, 15 Oct 2020 00:33:33 GMT
cache-control: max-age=604800
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 utils.js Show response
www.splunk.com/etc.clientlibs/clientlibs/granite/ 47 KB
9 KB 6ms
0ms Script
application/javascript 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.splunk.com/etc.clientlibs/clientlibs/granite/utils.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

446cb2c77c2807618caf4de745e133e0893780c448f2ce8b1b0266f08f9dfc83

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web02
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 8846
x-akamai-http2-push: 1
last-modified: Mon, 28 Sep 2020 02:00:21 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:33 GMT
content-type: application/javascript
expires: Thu, 15 Oct 2020 00:33:33 GMT
cache-control: max-age=604800
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 geoipservice.js Show response
www.splunk.com/etc/clientlibs/splunk/splunk-com/source/js/ 959 B
872 B 6ms
0ms Script
application/javascript 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.splunk.com/etc/clientlibs/splunk/splunk-com/source/js/geoipservice.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

2f951f43f836ad8919b067a5c7eae9b43d8753619efe55740adf3a0cf71be207

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web02
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 331
x-akamai-http2-push: 1
last-modified: Tue, 29 Sep 2020 00:39:07 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:33 GMT
content-type: application/javascript
expires: Thu, 15 Oct 2020 00:33:33 GMT
cache-control: max-age=604800
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 csrf.min.652a558c3774088b61b0530c184710d1.js Show response
www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/ 4 KB
2 KB 37ms
30ms Script
application/javascript 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

90a9acaa2b73d4e87bc59beb161a8e9771d517ae8577ba38f6724f40d3461073

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
last-modified: Thu, 01 Oct 2020 08:35:02 GMT
server: Akamai Resource Optimizer
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
date: Thu, 08 Oct 2020 00:33:33 GMT
serverid: prod-web01
content-type: application/javascript
status: 200
cache-control: max-age=604800
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 1327
expires: Thu, 15 Oct 2020 00:33:33 GMT

GET
H2 200 splunk-logo.svg
www.splunk.com/content/dam/splunk2/images/logos/ 4 KB
2 KB 44ms
35ms Image
image/svg+xml 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.splunk.com/content/dam/splunk2/images/logos/splunk-logo.svg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

1514407cddcffb22e626d44e54c991867fd7b0ef049f6bbb351b5aa63baf32de

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web01
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 1320
last-modified: Thu, 24 Sep 2020 00:30:43 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:33 GMT
content-type: image/svg+xml
access-control-allow-origin: *
expires: Mon, 07 Dec 2020 00:33:33 GMT
cache-control: max-age=5184000
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 nav-core-icon.svg
www.splunk.com/content/dam/splunk2/images/icons/header-v3/flyout/ 704 B
893 B 44ms
36ms Image
image/svg+xml 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.splunk.com/content/dam/splunk2/images/icons/header-v3/flyout/nav-core-icon.svg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

9d233d4ebf342d0f9341e7b0c53a062fb97c0d640d1c19ad69c3f7cb9be789e4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web02
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 370
last-modified: Thu, 24 Sep 2020 00:33:51 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:33 GMT
content-type: image/svg+xml
access-control-allow-origin: *
expires: Mon, 07 Dec 2020 00:33:33 GMT
cache-control: max-age=5184000
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 nav-ITops-pink-icon.svg
www.splunk.com/content/dam/splunk2/images/icons/header-v3/flyout/ 2 KB
1 KB 45ms
37ms Image
image/svg+xml 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.splunk.com/content/dam/splunk2/images/icons/header-v3/flyout/nav-ITops-pink-icon.svg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

694512bcca0131f7af7cd3cded5fb7cdd109e11d095ca1cc7e7aad3bc30fa4c7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web02
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 814
last-modified: Thu, 24 Sep 2020 00:30:37 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:33 GMT
content-type: image/svg+xml
access-control-allow-origin: *
expires: Mon, 07 Dec 2020 00:33:33 GMT
cache-control: max-age=5184000
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 nav-security-icon.svg
www.splunk.com/content/dam/splunk2/images/icons/header-v3/flyout/ 783 B
957 B 45ms
38ms Image
image/svg+xml 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.splunk.com/content/dam/splunk2/images/icons/header-v3/flyout/nav-security-icon.svg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

e41786c6c10652eff300e9b257253e78089629b4fffdbff060667aa995f5b5dd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web02
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 434
last-modified: Thu, 24 Sep 2020 00:30:03 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:33 GMT
content-type: image/svg+xml
access-control-allow-origin: *
expires: Mon, 07 Dec 2020 00:33:33 GMT
cache-control: max-age=5184000
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 nav-appdev-icon.svg
www.splunk.com/content/dam/splunk2/images/icons/header-v3/flyout/ 2 KB
1 KB 48ms
40ms Image
image/svg+xml 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.splunk.com/content/dam/splunk2/images/icons/header-v3/flyout/nav-appdev-icon.svg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

12778349333458c41e8b79bfa66004cd352de74ddf6000f5ca08ba6ad1a14cf0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web02
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 860
last-modified: Thu, 24 Sep 2020 00:34:58 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:33 GMT
content-type: image/svg+xml
access-control-allow-origin: *
expires: Mon, 07 Dec 2020 00:33:33 GMT
cache-control: max-age=5184000
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 nav-tools-covid-19-pink.svg
www.splunk.com/content/dam/splunk2/images/icons/header-v3/ 901 B
890 B 48ms
40ms Image
image/svg+xml 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.splunk.com/content/dam/splunk2/images/icons/header-v3/nav-tools-covid-19-pink.svg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

e27218633d360d848acb958a72f1c87f1ef090c40c0c4ad8096a4172d52a8345

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web01
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 367
last-modified: Thu, 24 Sep 2020 00:28:50 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:33 GMT
content-type: image/svg+xml
access-control-allow-origin: *
expires: Mon, 07 Dec 2020 00:33:33 GMT
cache-control: max-age=5184000
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 nav-tools-pricing-pink.svg
www.splunk.com/content/dam/splunk2/images/icons/header-v3/flyout/ 1013 B
1 KB 54ms
47ms Image
image/svg+xml 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.splunk.com/content/dam/splunk2/images/icons/header-v3/flyout/nav-tools-pricing-pink.svg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

6e3ebb53aff58aaf432601a5bb9a62c4ab76791c027c5610943936cbb1453777

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web01
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 503
last-modified: Thu, 24 Sep 2020 00:33:56 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:33 GMT
content-type: image/svg+xml
access-control-allow-origin: *
expires: Mon, 07 Dec 2020 00:33:33 GMT
cache-control: max-age=5184000
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 nav-value-calculator-pink.svg
www.splunk.com/content/dam/splunk2/images/icons/header-v3/flyout/ 906 B
966 B 55ms
47ms Image
image/svg+xml 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.splunk.com/content/dam/splunk2/images/icons/header-v3/flyout/nav-value-calculator-pink.svg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

35bb5024b826965ec5398049d72af123d6d315abe4f60bbc15d73f9c3cb4ebf6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web01
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 443
last-modified: Thu, 24 Sep 2020 00:32:37 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:33 GMT
content-type: image/svg+xml
access-control-allow-origin: *
expires: Mon, 07 Dec 2020 00:33:33 GMT
cache-control: max-age=5184000
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 nav-tools-blogs-pink.svg
www.splunk.com/content/dam/splunk2/images/icons/header-v3/flyout/ 932 B
994 B 57ms
50ms Image
image/svg+xml 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.splunk.com/content/dam/splunk2/images/icons/header-v3/flyout/nav-tools-blogs-pink.svg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

a4a47555ffdfd89567616e27b5d9bc5979b5ec7227ad217410f614b4c4973df1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web01
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 471
last-modified: Thu, 24 Sep 2020 00:28:51 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:33 GMT
content-type: image/svg+xml
access-control-allow-origin: *
expires: Mon, 07 Dec 2020 00:33:33 GMT
cache-control: max-age=5184000
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 nav-tools-free-pink.svg
www.splunk.com/content/dam/splunk2/images/icons/header-v3/flyout/ 1 KB
1007 B 57ms
51ms Image
image/svg+xml 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.splunk.com/content/dam/splunk2/images/icons/header-v3/flyout/nav-tools-free-pink.svg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

89a89105479ea70792afbd97e7faf55f5a2fabf41c9ade06b5d5f8c8f736fc42

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web01
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 484
last-modified: Thu, 24 Sep 2020 00:28:50 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:33 GMT
content-type: image/svg+xml
access-control-allow-origin: *
expires: Mon, 07 Dec 2020 00:33:33 GMT
cache-control: max-age=5184000
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 nav-tools-resources-pink.svg
www.splunk.com/content/dam/splunk2/images/icons/header-v3/flyout/ 3 KB
1 KB 60ms
54ms Image
image/svg+xml 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.splunk.com/content/dam/splunk2/images/icons/header-v3/flyout/nav-tools-resources-pink.svg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

526650a66909eb4f0264c70ff8cd5f51ab3683a9208d06c033a428f5d6bc8af7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web02
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 986
last-modified: Thu, 24 Sep 2020 00:33:55 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:33 GMT
content-type: image/svg+xml
access-control-allow-origin: *
expires: Mon, 07 Dec 2020 00:33:33 GMT
cache-control: max-age=5184000
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 clientlib.min.6242a83b2cce11c12caf2484c7fdf7f5.js Show response
www.splunk.com/etc.clientlibs/splunk/components/content/globalHeader-v3/ 276 B
644 B 33ms
33ms Script
application/javascript 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.splunk.com/etc.clientlibs/splunk/components/content/globalHeader-v3/clientlib.min.6242a83b2cce11c12caf2484c7fdf7f5.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

c496dfb0cb0a54ec27fd1cebe51edd18a5e781c7644ce11bd94b90a8271ce84a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
last-modified: Fri, 02 Oct 2020 16:38:16 GMT
server: Akamai Resource Optimizer
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
date: Thu, 08 Oct 2020 00:33:33 GMT
serverid: prod-web01
content-type: application/javascript
status: 200
cache-control: max-age=604800
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 122
expires: Thu, 15 Oct 2020 00:33:33 GMT

GET
H2 200 nav-tools-covid-19-white.svg
www.splunk.com/content/dam/splunk2/images/icons/header-v3/ 898 B
892 B 61ms
54ms Image
image/svg+xml 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.splunk.com/content/dam/splunk2/images/icons/header-v3/nav-tools-covid-19-white.svg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

25727b382b6028afe672fed6f2f04fc2047a0f66289c890f514147462e511187

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web01
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 369
last-modified: Thu, 24 Sep 2020 00:36:11 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:33 GMT
content-type: image/svg+xml
access-control-allow-origin: *
expires: Mon, 07 Dec 2020 00:33:33 GMT
cache-control: max-age=5184000
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 nav-tools-pricing-white.svg
www.splunk.com/content/dam/splunk2/images/icons/header-v3/ 1 KB
1 KB 64ms
57ms Image
image/svg+xml 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.splunk.com/content/dam/splunk2/images/icons/header-v3/nav-tools-pricing-white.svg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

4b6c3188274d8950829ed0a5dc26c64c7f02c563d00742e0f182389084ae3ace

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web01
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 507
last-modified: Wed, 23 Sep 2020 01:18:57 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:33 GMT
content-type: image/svg+xml
access-control-allow-origin: *
expires: Mon, 07 Dec 2020 00:33:33 GMT
cache-control: max-age=5184000
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 nav-tools-value-calculator-white.svg
www.splunk.com/content/dam/splunk2/images/icons/header-v3/ 917 B
956 B 64ms
58ms Image
image/svg+xml 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.splunk.com/content/dam/splunk2/images/icons/header-v3/nav-tools-value-calculator-white.svg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

7f57c3e2ef4fe36fb4e3ddec6b6d3236fbd76b04749d7e0af5ceecdd59081ec6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web02
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 433
last-modified: Thu, 24 Sep 2020 00:28:49 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:33 GMT
content-type: image/svg+xml
access-control-allow-origin: *
expires: Mon, 07 Dec 2020 00:33:33 GMT
cache-control: max-age=5184000
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 nav-tools-blogs-white.svg
www.splunk.com/content/dam/splunk2/images/icons/header-v3/ 934 B
1013 B 67ms
61ms Image
image/svg+xml 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.splunk.com/content/dam/splunk2/images/icons/header-v3/nav-tools-blogs-white.svg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

2c096b63819fbd5f5a384de76186519ef1f63aab1e49b003df9c67f889ec7b0d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web02
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 490
last-modified: Wed, 23 Sep 2020 01:16:34 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:33 GMT
content-type: image/svg+xml
access-control-allow-origin: *
expires: Mon, 07 Dec 2020 00:33:33 GMT
cache-control: max-age=5184000
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 nav-tools-free-white.svg
www.splunk.com/content/dam/splunk2/images/icons/header-v3/ 1 KB
984 B 67ms
61ms Image
image/svg+xml 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.splunk.com/content/dam/splunk2/images/icons/header-v3/nav-tools-free-white.svg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

e14c6cc87d125650579daef012b939ee4ef85891042a7adb0a568ebfd70023b9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web01
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 461
last-modified: Wed, 23 Sep 2020 01:18:37 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:33 GMT
content-type: image/svg+xml
access-control-allow-origin: *
expires: Mon, 07 Dec 2020 00:33:33 GMT
cache-control: max-age=5184000
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 nav-tools-resources-white.svg
www.splunk.com/content/dam/splunk2/images/icons/header-v3/ 3 KB
1 KB 70ms
65ms Image
image/svg+xml 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.splunk.com/content/dam/splunk2/images/icons/header-v3/nav-tools-resources-white.svg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

e30b8666a7f4aa8b4067e95b01a1e0611fbd1b817228b382a3f8867c4e186bf1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web02
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 772
last-modified: Wed, 23 Sep 2020 01:16:41 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:33 GMT
content-type: image/svg+xml
access-control-allow-origin: *
expires: Mon, 07 Dec 2020 00:33:33 GMT
cache-control: max-age=5184000
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 security-started-account.png
www.splunk.com/content/dam/splunk2/images/illustrations/security-started/ 2 KB
2 KB 70ms
65ms Image
image/png 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.splunk.com/content/dam/splunk2/images/illustrations/security-started/security-started-account.png
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a72-247-179-120.deploy.static.akamaitechnologies.com
Software: Akamai Image Manager /
Resource Hash: e9ab17238de283187dfc99a1fa9eb9af534c882c8a0dde7206a120fbd5687397

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:33 GMT
last-modified: Fri, 11 Sep 2020 20:05:13 GMT
server: Akamai Image Manager
content-type: image/png
status: 200
cache-control: private, no-transform, max-age=329536
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 2055
expires: Sun, 11 Oct 2020 20:05:49 GMT

GET
H2 200 security-started-endpoint.png
www.splunk.com/content/dam/splunk2/images/illustrations/security-started/ 2 KB
2 KB 75ms
69ms Image
image/png 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.splunk.com/content/dam/splunk2/images/illustrations/security-started/security-started-endpoint.png
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a72-247-179-120.deploy.static.akamaitechnologies.com
Software: Akamai Image Manager /
Resource Hash: f1d4cb061a8e35b325a022112bb6eb969a93ef1e938bf97e47192be476ccd8b7

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:33 GMT
x-check-cacheable: YES
x-serial: 1556
content-type: image/png
status: 200
cache-control: private, no-transform, max-age=1879466
last-modified: Tue, 29 Sep 2020 18:38:24 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 1925
server: Akamai Image Manager
expires: Thu, 29 Oct 2020 18:37:59 GMT

GET
H2 200 security-started-network.png
www.splunk.com/content/dam/splunk2/images/illustrations/security-started/ 3 KB
3 KB 75ms
70ms Image
image/png 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.splunk.com/content/dam/splunk2/images/illustrations/security-started/security-started-network.png
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a72-247-179-120.deploy.static.akamaitechnologies.com
Software: Akamai Image Manager /
Resource Hash: cea2b5003cfa170cde8f250c9cdbba9884937c9225cd0113c82c260466349ad6

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:33 GMT
last-modified: Fri, 11 Sep 2020 15:08:27 GMT
server: Akamai Image Manager
content-type: image/png
status: 200
cache-control: private, no-transform, max-age=311660
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 2694
expires: Sun, 11 Oct 2020 15:07:53 GMT

GET
H2 200 videos.min.04456862369b99668274bd765af3d2d7.js Show response
www.splunk.com/etc/clientlibs/splunk/components/ 4 KB
2 KB 33ms
33ms Script
application/javascript 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.splunk.com/etc/clientlibs/splunk/components/videos.min.04456862369b99668274bd765af3d2d7.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

6a9d9343aad35bd6ace0482f5091902750a3cad588ec61989150860079d58f43

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
last-modified: Thu, 01 Oct 2020 16:00:03 GMT
server: Akamai Resource Optimizer
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
date: Thu, 08 Oct 2020 00:33:33 GMT
serverid: prod-web02
content-type: application/javascript
status: 200
cache-control: max-age=604800
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 1067
expires: Thu, 15 Oct 2020 00:33:33 GMT

GET
H2

200

4173f14c71ea02491f7d6b.jpg
cdn.vidyard.com/thumbnails/RlyvZ9Tp_kLhxVmjMEi1pA/
Redirect Chain

https://play.vidyard.com/tvSx692mGEcWThuE9nKFa7.jpg
https://cdn.vidyard.com/thumbnails/RlyvZ9Tp_kLhxVmjMEi1pA/4173f14c71ea02491f7d6b.jpg

108 KB
108 KB

579ms
493ms

Image
image/jpeg

93.184.221.26
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.vidyard.com/thumbnails/RlyvZ9Tp_kLhxVmjMEi1pA/4173f14c71ea02491f7d6b.jpg
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.221.26 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 78434b739c4013cc3c51ac35a7b3a8c2aede650d9f2f7a282d0db427bdcc06c3

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:35 GMT
x-amz-request-id: 780929941670C98A
x-amz-server-side-encryption: AES256
x-cache: HIT
status: 200
content-length: 110241
x-amz-id-2: P0ipGm7yB8wH/fc2p3/u09AQUaaZIRDK1T5nr9KMLgglrEj5zKafs6mirocbsb9InhXShHe7hY0=
last-modified: Wed, 13 Jun 2018 19:29:19 GMT
server: AmazonS3
etag: "f2c41be349943c4dd26fdce3c4c599ef"
access-control-max-age: 3000
access-control-allow-methods: GET, PUT, POST
x-amz-version-id: null
access-control-allow-origin: *
accept-ranges: bytes
content-type: image/jpeg

Redirect headers

date: Thu, 08 Oct 2020 00:33:33 GMT
via: 1.1 varnish
age: 1178583
x-cache: HIT
status: 302
content-length: 106
x-served-by: cache-hhn4020-HHN
x-china: 0
access-control-allow-origin: *
referrer-policy: no-referrer-when-downgrade
x-timer: S1602117214.992889,VS0,VE1
x-frame-options: ALLOWALL
vary: Accept, X-ThumbnailAB, X-China, accept-language
content-type: text/plain; charset=utf-8
location: https://cdn.vidyard.com/thumbnails/RlyvZ9Tp_kLhxVmjMEi1pA/4173f14c71ea02491f7d6b.jpg
cache-control: no-store, no-cache, must-revalidate
accept-ranges: bytes
x-cache-hits: 1

GET
H2

200

d40fdab29698482ac0fcc4.jpg
cdn.vidyard.com/thumbnails/sG7gGes3ZgWcvkwFOwraEQ/
Redirect Chain

https://play.vidyard.com/LQkUcTwcyZHHwcDgDhApMn.jpg
https://cdn.vidyard.com/thumbnails/sG7gGes3ZgWcvkwFOwraEQ/d40fdab29698482ac0fcc4.jpg

155 KB
155 KB

463ms
462ms

Image
image/jpeg

93.184.221.26
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.vidyard.com/thumbnails/sG7gGes3ZgWcvkwFOwraEQ/d40fdab29698482ac0fcc4.jpg
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.221.26 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 290875dfc6e8b955b599c421fbc423729980387677d1d7922bd13eecf1304950

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:35 GMT
x-amz-request-id: B1C1CED44E927F94
x-amz-server-side-encryption: AES256
x-cache: HIT
status: 200
content-length: 158923
x-amz-id-2: 7DPxz4Ko+4i3lKgE4RMjx8XFL058pEwy02193a3FjxEnxCC8aS2Ixg/1hDBM5/ujnzAxlKnc9ck=
last-modified: Wed, 13 Jun 2018 19:32:49 GMT
server: AmazonS3
etag: "6ec04794e06f6e7d11ead2aa9b931251"
access-control-max-age: 3000
access-control-allow-methods: GET, PUT, POST
x-amz-version-id: null
access-control-allow-origin: *
accept-ranges: bytes
content-type: image/jpeg
x-amz-storage-class: STANDARD_IA

Redirect headers

date: Thu, 08 Oct 2020 00:33:34 GMT
via: 1.1 varnish
age: 0
x-cache: MISS
status: 302
content-length: 106
x-served-by: cache-hhn4020-HHN
x-china: 0
access-control-allow-origin: *
referrer-policy: no-referrer-when-downgrade
x-timer: S1602117214.992887,VS0,VE198
x-frame-options: ALLOWALL
vary: Accept, X-ThumbnailAB, X-China, accept-language
content-type: text/plain; charset=utf-8
location: https://cdn.vidyard.com/thumbnails/sG7gGes3ZgWcvkwFOwraEQ/d40fdab29698482ac0fcc4.jpg
cache-control: no-store, no-cache, must-revalidate
accept-ranges: bytes
x-cache-hits: 0

GET
H2

200

cc980e2e6b8f732c1238ec.jpg
cdn.vidyard.com/thumbnails/KG_YJGFhMUbZz4cRg-VFeg/
Redirect Chain

https://play.vidyard.com/3S6wbYGAJ4cKkegMYspviz.jpg
https://cdn.vidyard.com/thumbnails/KG_YJGFhMUbZz4cRg-VFeg/cc980e2e6b8f732c1238ec.jpg

118 KB
118 KB

532ms
446ms

Image
image/jpeg

93.184.221.26
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.vidyard.com/thumbnails/KG_YJGFhMUbZz4cRg-VFeg/cc980e2e6b8f732c1238ec.jpg
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.221.26 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cebf4cbf1630311071f998632cb8d4079b8d11491f71b826ae999d4732b380f4

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:35 GMT
x-amz-request-id: E1A4B1D5B7DA1576
x-amz-server-side-encryption: AES256
x-cache: HIT
status: 200
content-length: 120434
x-amz-id-2: tPnhm4RYKvKTUxGiGTz3rP1ZIi+b3wdliNDdSeTO/eP/SCcUTaJsSyiIoHbUjaiA3+p+uwRPEp0=
last-modified: Wed, 13 Jun 2018 19:25:34 GMT
server: AmazonS3
etag: "b99a783da8c539f8b501617e76f21982"
access-control-max-age: 3000
access-control-allow-methods: GET, PUT, POST
x-amz-version-id: null
access-control-allow-origin: *
accept-ranges: bytes
content-type: image/jpeg

Redirect headers

date: Thu, 08 Oct 2020 00:33:33 GMT
via: 1.1 varnish
age: 2912538
x-cache: HIT
status: 302
content-length: 106
x-served-by: cache-hhn4020-HHN
x-china: 0
access-control-allow-origin: *
referrer-policy: no-referrer-when-downgrade
x-timer: S1602117214.993058,VS0,VE1
x-frame-options: ALLOWALL
vary: Accept, X-ThumbnailAB, X-China, accept-language
content-type: text/plain; charset=utf-8
location: https://cdn.vidyard.com/thumbnails/KG_YJGFhMUbZz4cRg-VFeg/cc980e2e6b8f732c1238ec.jpg
cache-control: no-store, no-cache, must-revalidate
accept-ranges: bytes
x-cache-hits: 1

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 12 KB
4 KB 18ms
9ms Script
application/javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

396197a350c5f917f454cb764fa31f624d64f8fbac73445c4d2862bad7ca22bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Oct 2020 00:33:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: Jao9NEADO7fIr5d6S3evQw==
age: 5344
status: 200
vary: Accept-Encoding
content-length: 3891
cf-request-id: 05a739b6d900002c01bb20a200000001
x-ms-lease-status: unlocked
last-modified: Tue, 06 Oct 2020 01:58:55 GMT
server: cloudflare
etag: 0x8D8699B6200A302
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 9821ed2a-501e-0168-328d-9bc0e2000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 5debc56afe652c01-FRA

GET
H2 200 footer-2019.js Show response
www.splunk.com/etc/clientlibs/splunk/splunk-core/source/js/nav/ 922 B
813 B 42ms
33ms Script
application/javascript 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.splunk.com/etc/clientlibs/splunk/splunk-core/source/js/nav/footer-2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

5d3e3969288a2e47dc847d7abfc34c693fcad261b5056715ece9ebcece4399cf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
last-modified: Sun, 04 Oct 2020 16:19:34 GMT
server: Akamai Resource Optimizer
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
date: Thu, 08 Oct 2020 00:33:33 GMT
serverid: prod-web01
content-type: application/javascript
status: 200
cache-control: max-age=604800
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 291
expires: Thu, 15 Oct 2020 00:33:33 GMT

GET
H2 200 source.min.ab65d64eccb8e13d0f8c5e9d3575f1ce.js Show response
www.splunk.com/etc/clientlibs/splunk/splunk-com/ 244 KB
56 KB 42ms
34ms Script
application/javascript 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.splunk.com/etc/clientlibs/splunk/splunk-com/source.min.ab65d64eccb8e13d0f8c5e9d3575f1ce.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

1b06d0f959e02e27e79585d309b73f226ece1d991841c1e8571d4fba9491345b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
last-modified: Sat, 03 Oct 2020 21:39:22 GMT
server: Akamai Resource Optimizer
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
date: Thu, 08 Oct 2020 00:33:33 GMT
serverid: prod-web01
content-type: application/javascript
status: 200
cache-control: max-age=604800
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 57166
expires: Thu, 15 Oct 2020 00:33:33 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 9ms
5ms Script
text/javascript 2a00:1450:4001:819::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 4674
date: Wed, 07 Oct 2020 23:15:39 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Thu, 08 Oct 2020 01:15:39 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 335 KB
72 KB 21ms
17ms Script
application/javascript 2a00:1450:4001:81f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TPV7TP

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5b89e81921f42b8ea68f4a5f9e171306ddaf8d715142652bc6097ee77d24009d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:33 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 73575
x-xss-protection: 0
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 08 Oct 2020 00:33:33 GMT

GET
H2 200 M7Q82-FTRNS-TEZ4E-UCSZ2-NQJ9C Show response
s.go-mpulse.net/boomerang/ Frame 01AB 202 KB
51 KB 20ms
6ms Script
application/javascript 2a02:26f0:6c00:298::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.go-mpulse.net/boomerang/M7Q82-FTRNS-TEZ4E-UCSZ2-NQJ9C
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:6c00:298::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: 95a439c4e11ace2484e8d42c30ff56cf7db5ea7c6463df9ce2fdafa7f6ccbf54

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:33 GMT
content-encoding: br
last-modified: Wed, 26 Aug 2020 09:35:11 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=604800
timing-allow-origin: *
content-length: 51580

GET
H2 200 token.json Show response
www.splunk.com/libs/granite/csrf/ 2 B
530 B 74ms
71ms XHR
application/json 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.splunk.com/libs/granite/csrf/token.json

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-type-options: nosniff
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
server: Apache
x-frame-options: SAMEORIGIN
date: Thu, 08 Oct 2020 00:33:33 GMT
serverid: prod-web01
content-type: application/json;charset=iso-8859-1
status: 200
cache-control: max-age=5184000
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 2
expires: Mon, 07 Dec 2020 00:33:33 GMT

GET
H2 200 blue-gradient-bottom-tall.jpg
www.splunk.com/content/dam/splunk2/images/backgrounds/ 20 KB
21 KB 72ms
72ms Image
image/webp 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.splunk.com/content/dam/splunk2/images/backgrounds/blue-gradient-bottom-tall.jpg
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a72-247-179-120.deploy.static.akamaitechnologies.com
Software: Akamai Image Manager /
Resource Hash: ce0f373f6f3269f03446986ca9b6373e85eab72ab08275f8381d2b8ca79780d2

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:34 GMT
last-modified: Mon, 28 Sep 2020 11:54:50 GMT
server: Akamai Image Manager
content-type: image/webp
status: 200
cache-control: private, no-transform, max-age=1768989
server-timing: cdn-cache; desc=HIT, edge; dur=38
content-length: 20950
expires: Wed, 28 Oct 2020 11:56:43 GMT

GET
H2 200 getting-started.html
www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/ 64 KB
64 KB 38ms
37ms Image
text/html 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: gzip
x-content-type-options: nosniff
serverid: prod-web02
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 22347
server: Apache
x-frame-options: SAMEORIGIN
date: Thu, 08 Oct 2020 00:33:33 GMT
vary: Accept-Encoding
content-language: en-US
expires: Thu, 08 Oct 2020 01:33:33 GMT
cache-control: max-age=3600
x-akamai-transformed: 9 - 0 pmb=mNONE,1mRUM,2
content-type: text/html;charset=utf-8
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-akam-sw-version: 0.5.0
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
H2 200 glyphicons-halflings-regular.woff
www.splunk.com/etc/clientlibs/splunk/legacy/designs/splunk/fonts/ 23 KB
23 KB 55ms
55ms Font
font/woff 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.splunk.com/etc/clientlibs/splunk/legacy/designs/splunk/fonts/glyphicons-halflings-regular.woff

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc/clientlibs/splunk/legacy/designs/splunk/clientlib.min.448dbdae6dfa8f9bfb56bc41e62cc5b9.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

fc969dc1c6ff531abcf368089dcbaf5775133b0626ff56b52301a059fc0f9e1e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Origin: https://www.splunk.com
Referer: https://www.splunk.com/etc/clientlibs/splunk/legacy/designs/splunk/clientlib.min.448dbdae6dfa8f9bfb56bc41e62cc5b9.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
last-modified: Wed, 23 Sep 2020 01:15:38 GMT
server: Apache
status: 200
date: Thu, 08 Oct 2020 00:33:34 GMT
serverid: prod-web02
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=5184000
server-timing: cdn-cache; desc=HIT, edge; dur=10
accept-ranges: bytes
content-length: 23320
expires: Mon, 07 Dec 2020 00:33:34 GMT

GET
H3-Q050 200 js Show response
www.google-analytics.com/gtm/ 172 KB
45 KB 34ms
34ms Script
application/javascript 2a00:1450:4001:819::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=GTM-N4QZZ4H&cid=305123563.1602117214

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e10987759412bc1595918fac7e917c38b5a4b8efb0ab009f379eaecd263e25ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:34 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46300
x-xss-protection: 0
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 08 Oct 2020 00:33:34 GMT

GET
H2

200

activityi;dc_pre=CNGOwNvfo-wCFclE5QodVVkJXw;src=3801996;type=landi397;cat=splun025;ord=9382829862423.87
3801996.fls.doubleclick.net/ Frame D159
Redirect Chain

https://fls.doubleclick.net/activityi;src=3801996;type=landi397;cat=splun025;ord=9382829862423.87?
https://3801996.fls.doubleclick.net/activityi;dc_pre=CNGOwNvfo-wCFclE5QodVVkJXw;src=3801996;type=landi397;cat=splun025;ord=9382829862423.87?

0
0

153ms
56ms

Document
text/html

216.58.207.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://3801996.fls.doubleclick.net/activityi;dc_pre=CNGOwNvfo-wCFclE5QodVVkJXw;src=3801996;type=landi397;cat=splun025;ord=9382829862423.87?

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.207.38 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s24-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 3801996.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CNGOwNvfo-wCFclE5QodVVkJXw;src=3801996;type=landi397;cat=splun025;ord=9382829862423.87?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Thu, 08 Oct 2020 00:33:34 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 398
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 08-Oct-2020 00:48:34 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Thu, 08 Oct 2020 00:33:34 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
location: https://3801996.fls.doubleclick.net/activityi;dc_pre=CNGOwNvfo-wCFclE5QodVVkJXw;src=3801996;type=landi397;cat=splun025;ord=9382829862423.87?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 prum.min.js Show response
rum-static.pingdom.net/ 6 KB
3 KB 12ms
12ms Script
application/javascript 2606:4700:10::6814:15ef
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rum-static.pingdom.net/prum.min.js
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:15ef , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a0054cb907bee526169a8718932e3949ed5d5c6468342cf4daa7bd052c77b38c

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:34 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 13 May 2020 13:49:07 GMT
server: cloudflare
age: 5353
status: 200
etag: W/"5ebbfad3-1880"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=43200
cf-ray: 5debc56bf9542c4e-FRA
cf-request-id: 05a739b77800002c4e39250200000001

GET
H2 200 9ff638b7-8097-449d-9741-7b3c526b0da7.json Show response
cdn.cookielaw.org/consent/9ff638b7-8097-449d-9741-7b3c526b0da7/ 3 KB
1 KB 18ms
17ms XHR
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/9ff638b7-8097-449d-9741-7b3c526b0da7/9ff638b7-8097-449d-9741-7b3c526b0da7.json

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d6cf5fc5344294b7766c2bddc19dc7bcadcb7d4bb1920db9be1225d00e4a24d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Oct 2020 00:33:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 4nF7xW/s9laPsu5RNcTwmQ==
age: 2727
status: 200
vary: Accept-Encoding
content-length: 1163
cf-request-id: 05a739b78500002b7de6b17200000001
x-ms-lease-status: unlocked
last-modified: Wed, 15 Apr 2020 22:50:16 GMT
server: cloudflare
etag: 0x8D7E18F5D9CF0DF
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 176d6f26-701e-00bc-5fd9-77cf97000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 5debc56c08fc2b7d-FRA

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 164 B
355 B 15ms
15ms Script
text/javascript 2606:4700:10::6814:b944
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:b944 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0cc0930a1ab7e9ae754783576228f3c32caa07605236711cf81035f3f45f0ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:34 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 5debc56c885dbef6-FRA
cf-request-id: 05a739b7d10000bef69fa8f200000001

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/5.15.0/ 304 KB
67 KB 10ms
10ms Script
application/javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/5.15.0/otBannerSdk.js

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0143251fc6233ab3db13575f4e5208ca169f7fc18ac72d5a6f62901d94aa6f22

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Oct 2020 00:33:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: cyq3+Z4DcEJk/dYwcUu3dw==
age: 5319
status: 200
vary: Accept-Encoding
content-length: 68064
cf-request-id: 05a739b7ee00002c01bb215200000001
x-ms-lease-status: unlocked
last-modified: Mon, 18 May 2020 06:40:25 GMT
server: cloudflare
etag: 0x8D7FAF658874614
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 264aa783-d01e-0150-16d9-7781bb000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 5debc56cb8f02c01-FRA

GET
H/1.1 200
OK config.json Show response
c.go-mpulse.net/api/ Frame 01AB 3 KB
1 KB 15ms
15ms XHR
application/json 2a02:26f0:6c00:192::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/config.json?key=M7Q82-FTRNS-TEZ4E-UCSZ2-NQJ9C&d=www.splunk.com&t=5340391&v=1.632.0&if=&sl=0&si=nljsn1zecmk-qhuxjy&plugins=AK,ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,LOGN&acao=&ak.ai=418654
Requested by: Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/M7Q82-FTRNS-TEZ4E-UCSZ2-NQJ9C
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:6c00:192::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: bc737ae70a65cccbb80c1ee02205ab32df57aa827429ddfc142b4a9e63d5197d

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 08 Oct 2020 00:33:34 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 842

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/9ff638b7-8097-449d-9741-7b3c526b0da7/b7951409-db27-43d8-a4d6-4a3aaf33d3dd/ 50 KB
11 KB 10ms
10ms Fetch
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/9ff638b7-8097-449d-9741-7b3c526b0da7/b7951409-db27-43d8-a4d6-4a3aaf33d3dd/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/5.15.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc45bfa29b6c6d07e6933a433e345ba8e272bd090895787bef47c5e5f5935fef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Oct 2020 00:33:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: QKRmQCQqJRfte3L8JMzKLg==
age: 2543
status: 200
vary: Accept-Encoding
content-length: 11590
cf-request-id: 05a739b80400002b7de6b1e200000001
x-ms-lease-status: unlocked
last-modified: Wed, 15 Apr 2020 22:50:18 GMT
server: cloudflare
etag: 0x8D7E18F5E9F4EFF
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 9af8a7b7-d01e-00ba-54d9-7738ef000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 5debc56cd9d12b7d-FRA

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/5.15.0/assets/ 17 KB
3 KB 15ms
14ms Fetch
application/json 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/5.15.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/5.15.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e60d72219eb682a93fea26976d93acbe542afdd65065fd1e05c393d8dd996a30

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Oct 2020 00:33:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 02SC5G8dyC7Cq0+bUBFRrg==
age: 5262
status: 200
vary: Accept-Encoding
content-length: 3207
cf-request-id: 05a739b81600002b7de6b1f200000001
x-ms-lease-status: unlocked
last-modified: Mon, 18 May 2020 06:40:18 GMT
server: cloudflare
etag: 0x8D7FAF654B00A17
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 856804a9-d01e-0010-03d9-77ee00000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 5debc56cf9f82b7d-FRA

GET
H2 200 otPcTab.json Show response
cdn.cookielaw.org/scripttemplates/5.15.0/assets/ 87 KB
18 KB 10ms
10ms Fetch
application/json 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/5.15.0/assets/otPcTab.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/5.15.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8ca688fa7efad5358c4ab46aa221f9121b25a66c1b64ca4176f55930d9afca92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Oct 2020 00:33:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: poLEdvLNT7p/LuAUQhpfaA==
age: 5215
status: 200
vary: Accept-Encoding
content-length: 18343
cf-request-id: 05a739b81700002b7de6b20200000001
x-ms-lease-status: unlocked
last-modified: Mon, 18 May 2020 06:40:19 GMT
server: cloudflare
etag: 0x8D7FAF65524B3AD
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 74fd94ac-201e-00a4-58d9-77e202000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 5debc56cf9fa2b7d-FRA

GET
H2 200 bizible.js Show response
cdn.bizible.com/scripts/ 86 KB
33 KB 27ms
26ms Script
application/x-javascript 68.232.35.12
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.bizible.com/scripts/bizible.js
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.232.35.12 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (ska/F711) /
Resource Hash: 4c77b84665a1e6bfb24ec928a1ed9045818099f6a6f2e26e2bb22a560067183f

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:34 GMT
content-encoding: gzip
last-modified: Wed, 07 Oct 2020 14:28:09 GMT
server: ECS (ska/F711)
age: 30454
etag: "2d5d4c14b69cd61:0"
vary: Accept-Encoding
x-cache: HIT
content-type: application/x-javascript
status: 200
cache-control: max-age=86400
accept-ranges: bytes
content-length: 33769

GET
H2 200 elqInit.js Show response
www.splunk.com/etc/clientlibs/splunk/splunk-core/source/js/elqNow/ 7 KB
2 KB 32ms
32ms Script
application/javascript 72.247.179.120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.splunk.com/etc/clientlibs/splunk/splunk-core/source/js/elqNow/elqInit.js

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.247.179.120 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a72-247-179-120.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

44a739506a0ab47d1ac54b8e1c2e98b38e2f6e083e5a580366ed82ffdc7e026f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
content-encoding: br
serverid: prod-web01
status: 200
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 1884
last-modified: Tue, 06 Oct 2020 15:24:33 GMT
server: Akamai Resource Optimizer
date: Thu, 08 Oct 2020 00:33:34 GMT
content-type: application/javascript
expires: Thu, 15 Oct 2020 00:33:34 GMT
cache-control: max-age=604800
accept-ranges: bytes
x-webkit-csp: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com
x-akamai-path-stats: [1:351:2649]
x-content-security-policy: frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com, frame-ancestors *.splunk.com *.touchcast.com

GET
DATA 200
OK truncated
/ 817 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 88 KB
23 KB 7ms
5ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e37570ef85a3553930ba20dfab7280bfcead8a2238b536b5c03c629c35b3d4ca

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 23070
x-xss-protection: 0
pragma: public
x-fb-debug: CiE2yjQb3QtgRL7ba0Z0jeWb+VokgFtpKTtVil2zLy5PSvDwisZFWzPG5anEsRkDZujrh6FVaSvUiI7AtrLYVQ==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Thu, 08 Oct 2020 00:33:34 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 965 B
761 B 7ms
7ms Script
application/x-javascript 2a02:26f0:6c00:296::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TPV7TP
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:296::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 08 Oct 2020 00:33:34 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Sep 2020 22:01:48 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=39296
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 448

GET
H2 200 bat.js Show response
bat.bing.com/ 27 KB
8 KB 28ms
28ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TPV7TP
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44dd62d6a622a6198df9bfcfc1acbf414706e86c57dfc1d0f15b147fa7f25ae0

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:34 GMT
content-encoding: gzip
last-modified: Wed, 30 Sep 2020 20:44:24 GMT
x-msedge-ref: Ref A: 6C39E3F2728A4991B2C401A59919FB49 Ref B: FRAEDGE1516 Ref C: 2020-10-08T00:33:34Z
status: 200
etag: "0417b6a97d61:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 8315

GET
H2 200 hotjar-778215.js Show response
static.hotjar.com/c/ 22 KB
4 KB 31ms
31ms Script
application/javascript 147.75.100.245
PACKET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-778215.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TPV7TP

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

147.75.100.245 Central, Hong Kong, ASN54825 (PACKET, US),

Reverse DNS

pkt-ams-k2-shared-ingress2

Software

Resource Hash

5559cfc9dc35f12ed28dca34d607e7466d681161dd7b62fd4e673c775c8e50eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:34 GMT
content-encoding: br
x-content-type-options: nosniff
content-type: application/javascript
section-io-tag: hotjarjs
age: 54
status: 200
section-io-cache: Hit
vary: Accept-Encoding
content-length: 3307
cache-control: max-age=60
etag: W/81f3858dc3c15359ff94b35ae3857076
access-control-max-age: 600
section-io-origin-status: 304
access-control-allow-origin: *
x-cache-hit: 1
section-io-origin-time-seconds: 0.020
accept-ranges: bytes
section-io-id: 117023fce0374ca09e08267947104c5a
section-origin-responded: true

GET
H2 200 FQgOcAAM.min.js Show response
scripts.demandbase.com/ 60 KB
16 KB 48ms
48ms Script
application/javascript 99.86.243.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://scripts.demandbase.com/FQgOcAAM.min.js
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.243.29 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-29.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 71f6399d134d9edb0d1ff1be792e49a7c9b298110d0821222eed08505ac409de

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: b77A7vmamnNUOgzTIGc25projYU08s9H
content-encoding: gzip
last-modified: Thu, 03 Sep 2020 14:11:26 GMT
server: AmazonS3
age: 526
etag: "f6c5098a12895a26901e97899e2deee8"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
status: 200
cache-control: public, max-age=3600
date: Thu, 08 Oct 2020 00:28:11 GMT
x-amz-cf-pop: VIE50-C1
x-amz-cf-id: HTiT02__nIrhoKqsBPK6zCiV4rkEIIKnKTxRq-3p5GhJME86fcWJFw==
via: 1.1 aa98922692c099827cdae6a16b894745.cloudfront.net (CloudFront)

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 4 KB
2 KB 42ms
42ms Script
application/x-javascript 99.86.240.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TPV7TP
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.240.169 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-240-169.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 07 Oct 2020 18:48:15 GMT
Content-Encoding: gzip
Last-Modified: Thu, 24 Sep 2020 15:15:34 GMT
Server: AmazonS3
Age: 20719
ETag: W/"98d98b3499058b76d58073cf8ede2f10"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Via: 1.1 108e63109879954f4e720db50559f788.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: VIE50-C1
X-Amz-Cf-Id: cxnbWdXdFc3XgVmmK-DV8qCSrbmos_ADtQVOss7o5-6kDc0uVwMT5A==

GET
H2 200 airpr.js Show response
px.airpr.com/ 7 KB
2 KB 69ms
69ms Script
application/javascript 52.84.112.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://px.airpr.com/airpr.js
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.112.20 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-112-20.sof50.r.cloudfront.net
Software: nginx /
Resource Hash: 529b9c583e6cf8da02c9cadf8c38b5714198f0fde2dcde01da2d5ee681228738

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 17:35:47 GMT
content-encoding: gzip
last-modified: Sat, 21 Apr 2018 18:03:55 GMT
server: nginx
age: 25067
etag: "5adb7d0b-853"
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=43200
x-amz-cf-pop: SOF50-C1
content-length: 2131
via: 1.1 58f447cbc9252fca358450daba253306.cloudfront.net (CloudFront)
x-amz-cf-id: CqJPaoQn51LmeM_fv6hHOVT_IoRRmN24RM0_0Vj4K3m0UZJixpKw_g==
expires: Thu, 08 Oct 2020 05:45:45 GMT

GET
H2 200 cs.js Show response
tm.vendemore.com/cs/32fde63c-3af6-4cd0-a131-51e4701d5575/v2/ 408 B
562 B 36ms
36ms Script
application/javascript 3.120.63.212
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tm.vendemore.com/cs/32fde63c-3af6-4cd0-a131-51e4701d5575/v2/cs.js?c=1602117214331

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

3.120.63.212 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-120-63-212.eu-central-1.compute.amazonaws.com

Software

openresty/1.15.8.2 /

Resource Hash

6bd6f89b1e7f7eef3650d12eb6b8b0b9a839034f1917cccfafb5d22f549d5529

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:34 GMT
content-encoding: gzip
server: openresty/1.15.8.2
status: 200
vary: Accept-Encoding
access-control-allow-methods: POST, PUT, GET, OPTIONS, DELETE
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 3600
strict-transport-security: max-age=15724800; includeSubDomains
access-control-allow-headers: Authorization, Content-Type, username, password

GET
H2 200 2h26u57uzx7i.js Show response
js.driftt.com/include/1602117300000/ 137 KB
45 KB 60ms
59ms Script
application/javascript 99.86.243.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1602117300000/2h26u57uzx7i.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.86.243.59 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-86-243-59.vie50.r.cloudfront.net

Software

nginx /

Resource Hash

7bc1dc7d2a673a36a6e7b3d26c7fd8f5cc42d8b2d41a98e4de2a5ebdaaea9bf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: "a48548cec5608126b24de4cbfe9bfb8d"
x-amz-cf-pop: VIE50-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Mon, 05 Oct 2020 17:21:34 GMT
server: nginx
date: Thu, 08 Oct 2020 00:33:34 GMT
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
via: 1.1 96296f2b3ee1b7cbc3fb127d3383661e.cloudfront.net (CloudFront)
cache-control: max-age=10
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: RN1c9OEsy1PvqmGpUQ9VbmCeTHhl0Bgtax-D_NCJ41JauVv7lS8Wvg==

GET
H/1.1 200
OK lp.js Show response
metadata-static-files.sfo2.cdn.digitaloceanspaces.com/pixel/ 4 KB
5 KB 83ms
29ms Script
text/javascript 205.185.216.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://metadata-static-files.sfo2.cdn.digitaloceanspaces.com/pixel/lp.js

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.185.216.10 Phoenix, United States, ASN20446 (HIGHWINDS3, US),

Reverse DNS

map2.hwcdn.net

Software

Resource Hash

ea3dfefbe8e35a421e2569d4e3315e9264cf41fc32a4b865703ed7288dc79d6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 08 Oct 2020 00:33:34 GMT
Connection: Keep-Alive
Last-Modified: Wed, 30 Sep 2020 16:33:45 GMT
x-amz-request-id: tx0000000000000622e683c-005f7e5734-21a723c-sfo2a
ETag: "16587b18b2b06bfaf9417b3d92621ca0"
Vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW: 1602117214.dop068.sk1.shc,1602117214.dop068.sk1.t,1602117214.cds042.sk1.c
Content-Type: text/javascript
Cache-Control: max-age=602966
Strict-Transport-Security: max-age=15552000; includeSubDomains; preload
Accept-Ranges: bytes
Content-Length: 4538

GET
H2 200 b05765359b5ba.js Show response
t.contentsquare.net/uxa/ 189 KB
41 KB 47ms
47ms Script
application/javascript 99.86.243.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://t.contentsquare.net/uxa/b05765359b5ba.js
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.243.95 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-95.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0dc1c8f148d96172c4173f9683d15fabd9a92184265dce82d645d28dc3adaa8e

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 16:04:26 GMT
content-encoding: gzip
age: 30549
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
status: 200
content-length: 42017
last-modified: Wed, 07 Oct 2020 16:02:16 GMT
server: AmazonS3
etag: "9ba4ad7cef46db9e879c599648c234b6"
content-type: application/javascript;charset=utf-8
via: 1.1 a243c19b86829b9271d382d92416109c.cloudfront.net (CloudFront)
cache-control: max-age=900
x-amz-cf-pop: VIE50-C1
accept-ranges: bytes
x-amz-cf-id: rHUCyn93vLGZzlmRvdcY_k4HK-OR6Vd8oSRZyAlwPCLQLIlpXLxDug==

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 92 KB
36 KB 15ms
14ms Script
application/javascript 2a00:1450:4001:815::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-9599668

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TPV7TP

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:815::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

750bc48538b7d0a04da896bfe06c0b2f8a5cfaac40ea8628b0e5f5bef5ec0999

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:34 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37231
x-xss-protection: 0
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 08 Oct 2020 00:33:34 GMT

GET
H/1.1 200
OK 6si.min.js Show response
j.6sc.co/ 15 KB
7 KB 33ms
33ms Script
application/javascript 104.109.70.122
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/6si.min.js
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.70.122 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a104-109-70-122.deploy.static.akamaitechnologies.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 779651bc146d489786b9b4ab590d2784547448e4b85cf1bb9036b31e404d1a37

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 08 Oct 2020 00:33:34 GMT
Content-Encoding: gzip
Last-Modified: Thu, 24 Sep 2020 22:09:24 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5f6d1914-3a6c"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,POST
Content-Type: application/javascript
Access-Control-Allow-Origin
Access-Control-Max-Age: 86400
Access-Control-Allow-Credentials: true
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 6116

GET
H2 200 rz5la3FlMSNo3OYdIkfj Show response
ws.zoominfo.com/pixel/ 0
427 B 326ms
326ms Script
text/javascript 104.16.168.82
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/rz5la3FlMSNo3OYdIkfj

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.168.82 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:34 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by: Express
status: 200
content-length: 0
cf-request-id: 05a739b8aa0000735b84b93200000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 5debc56dd815735b-CPH
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for

GET
H/1.1 200
OK svrGP.aspx Show response
secure.eloqua.com/visitor/v200/ 79 B
539 B 130ms
129ms Script
application/javascript 209.167.231.15
NETDYNAMICS

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.eloqua.com/visitor/v200/svrGP.aspx?pps=70&siteid=1528&ref=https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email%26utm_source=splunk%26utm_campaign=APAC_FY21Q2_Oct20%26utm_content=Detecting-Malware-WP&ms=341

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/splunk/clientlibs/splunk-jquery.min.0fca26b5a37a66d68d0f4406976be4b5.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

209.167.231.15 , United States, ASN7160 (NETDYNAMICS, US),

Reverse DNS

now.eloqua.com

Software

Resource Hash

0387e92e3aea75f169352df7c2fa79c9f4a82f4360a082615133265afa1718a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000;
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Thu, 08 Oct 2020 00:33:33 GMT
Vary: Accept-Encoding
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control: private,no-cache, no-store
Content-Type: application/javascript; charset=utf-8
Content-Length: 106
X-XSS-Protection: 1; mode=block
Expires: -1

GET
H/1.1 200
OK svrGP.aspx
secure.eloqua.com/visitor/v200/ 49 B
406 B 164ms
164ms Image
image/gif 209.167.231.15
NETDYNAMICS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=1528&ref2=elqNone&tzo=-60&ms=341

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

209.167.231.15 , United States, ASN7160 (NETDYNAMICS, US),

Reverse DNS

now.eloqua.com

Software

Resource Hash

f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000;
X-Content-Type-Options: nosniff
Date: Thu, 08 Oct 2020 00:33:33 GMT
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control: private,no-cache, no-store
Content-Type: image/gif
Content-Length: 49
X-XSS-Protection: 1; mode=block
Expires: -1

GET
H2 200 ipv
cdn.bizible.com/m/ 43 B
167 B 27ms
26ms Image
image/gif 68.232.35.12
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=967b200af19a4f9eb9fec6e6f3e25f32&_biz_s=193955&_biz_l=https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DAPAC_FY21Q2_Oct20%26utm_content%3DDetecting-Malware-WP&_biz_t=1602117214351&_biz_i=Online%20Demo%20Experiences%20%7C%20Security%20Investigations%20%7C%20Splunk&_biz_n=0&rnd=103182&cdn_o=a&_biz_z=1602117214353
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.232.35.12 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (ska/F706) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Oct 2020 00:33:34 GMT
last-modified: Sat, 03 Oct 2020 18:40:27 GMT
server: ECS (ska/F706)
age: 366787
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status: 200
cache-control: no-cache, no-store
accept-ranges: bytes
content-type: Image/GIF
content-length: 43
expires: -1

GET
H2 200 u
cdn.bizibly.com/ 43 B
189 B 27ms
27ms Image
image/gif 93.184.220.42
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizibly.com/u?_biz_u=967b200af19a4f9eb9fec6e6f3e25f32&_biz_s=193955&_biz_l=https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DAPAC_FY21Q2_Oct20%26utm_content%3DDetecting-Malware-WP&_biz_t=1602117214356&_biz_i=Online%20Demo%20Experiences%20%7C%20Security%20Investigations%20%7C%20Splunk&rnd=610468&cdn_o=a&_biz_z=1602117214356
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.220.42 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (ska/F70E) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Oct 2020 00:33:34 GMT
last-modified: Wed, 07 Oct 2020 15:30:59 GMT
server: ECS (ska/F70E)
age: 32556
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status: 200
cache-control: no-cache, no-store
accept-ranges: bytes
content-type: Image/GIF
content-length: 43
expires: -1

GET
H2 200 1642523699107798 Show response
connect.facebook.net/signals/config/ 235 KB
68 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1642523699107798?v=2.9.27&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d6ab5f2ce45950a4a8e550d2f4da4851bde39c802b76c552cc8e33de7d56521f

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 69966
x-xss-protection: 0
pragma: public
x-fb-debug: G5BzpxJFbf4lygZ1pP7tjMVMMfMAXiw84DVf6p6vBY3qkMgE8uKh7e4K5IfD/q90OE5ZZC5ybpnMJXHckKsOSg==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Thu, 08 Oct 2020 00:33:34 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK insight.beta.min.js Show response
snap.licdn.com/li.lms-analytics/ 4 KB
2 KB 7ms
6ms Script
application/x-javascript 2a02:26f0:6c00:296::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:296::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 08 Oct 2020 00:33:34 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Sep 2020 22:01:48 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=36257
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1799

GET
H2 204 0
bat.bing.com/action/ 0
93 B 30ms
30ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=5962822&Ver=2&mid=f1fbc2ec-8bee-4ced-8a76-cd5c2614a88b&sid=d5c53f3008fd11ebad98d9d600300adb&vid=d5c568f008fd11eb9ee3810f2bce73d3&vids=0&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Online%20Demo%20Experiences%20%7C%20Security%20Investigations%20%7C%20Splunk&kw=getting%20started,%20splunk,%20security%20investigation,%20demo&p=https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DAPAC_FY21Q2_Oct20%26utm_content%3DDetecting-Malware-WP&r=&lt=1159&evt=pageLoad&msclkid=N&sv=1&rn=931331
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Thu, 08 Oct 2020 00:33:34 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: 10816B07026F4CB0BF349543F2A1EDAB Ref B: FRAEDGE1516 Ref C: 2020-10-08T00:33:34Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 modules.8b5df1db44ffdcf36821.js Show response
script.hotjar.com/ 355 KB
70 KB 33ms
33ms Script
application/javascript 147.75.100.245
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.hotjar.com/modules.8b5df1db44ffdcf36821.js
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.100.245 Central, Hong Kong, ASN54825 (PACKET, US),
Reverse DNS: pkt-ams-k2-shared-ingress2
Software: /
Resource Hash: 9a67d35485f44830dc54cd70f1473d146ffb66d89ddcd041836bbb3602e64b3a

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:34 GMT
content-encoding: br
age: 16179
status: 200
section-io-cache: Hit
content-length: 71570
last-modified: Wed, 07 Oct 2020 20:00:12 GMT
etag: "97868c20259a5d51fbac9c4a9071ad4e"
vary: Accept-Encoding
section-io-origin-status: 200
access-control-allow-origin: *
cache-control: max-age=31536000
section-io-origin-time-seconds: 0.094
section-io-id: e44fee85d4eeed707eebf81da6474241
accept-ranges: bytes
content-type: application/javascript
section-origin-responded: true

GET
H/1.1 200
OK analytics-an-min.js Show response
d2hya7iqhf5w3h.cloudfront.net/scripts/ 4 KB
4 KB 44ms
44ms Script
application/x-javascript 99.86.245.27
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2hya7iqhf5w3h.cloudfront.net/scripts/analytics-an-min.js
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.245.27 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-245-27.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 48b27638205c87f6a8bc2ad57e6e1e14794a580d41418f9dec81cf58abd744ed

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-meta-cb-modifiedtime: Fri, 24 Jan 2020 10:04:55 GMT
Date: Wed, 07 Oct 2020 09:09:10 GMT
Via: 1.1 7b574fc6db5d0840d90b97dd76cc56ec.cloudfront.net (CloudFront)
Last-Modified: Mon, 27 Jan 2020 08:00:24 GMT
Server: AmazonS3
Age: 55465
ETag: "5c9b27e24255c1db58b0c92e56ac1859"
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Connection: keep-alive
X-Amz-Cf-Pop: VIE50-C1
Accept-Ranges: bytes
Content-Length: 3992
X-Amz-Cf-Id: TD6rnKfLccGlAIkexGS91xC-SE6TwPjFsQIIW5K7cPKKYlsa28TSkQ==

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 92 KB
36 KB 16ms
16ms Script
application/javascript 2a00:1450:4001:815::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-399680-1&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-9599668

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:815::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f196c1d1d576f6f92ae7feba85fd0a570f88d09ba8e98fe4489883f2404bb9e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:34 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37233
x-xss-protection: 0
last-modified: Thu, 08 Oct 2020 00:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 08 Oct 2020 00:33:34 GMT

GET
H2 200 ip.json Show response
api.company-target.com/api/v2/ 436 B
939 B 219ms
219ms XHR
application/json 52.84.112.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DAPAC_FY21Q2_Oct20%26utm_content%3DDetecting-Malware-WP&page_title=Online%20Demo%20Experiences%20%7C%20Security%20Investigations%20%7C%20Splunk&src=tag&key=3ba085cbec5f85b5afa666ed40e727757c9caa91
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.112.76 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-112-76.sof50.r.cloudfront.net
Software: nginx /
Resource Hash: 0d24e9923edbf8af778b0e4b424f25f68e5eaf62a395eb7a2242206bf4955b30

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:34 GMT
identification-source: CENTRAL
vary: Accept-Encoding, Origin
x-amz-cf-pop: SOF50-C1
x-cache: Miss from cloudfront
status: 200
request-id: 9cb41ef7-c78a-47c2-85d6-332c312f9717
content-encoding: gzip
pragma: no-cache
access-control-allow-origin: https://www.splunk.com
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
via: 1.1 0dac912bc270f75a44f8cb4f2606fe8a.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: FA-v4Y0l01v8OfVD2NqQM207OFbROUMASn7xuvu7GO5muGMnCOsOKA==
expires: Wed, 07 Oct 2020 00:33:34 GMT

GET
H/1.1

200
OK

validateCookie
segments.company-target.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/demandbase
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
https://segments.company-target.com/log?vendor=choca&user_id=AAED8U6-_L0AABBvPsWYOg
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAED8U6-_L0AABBvPsWYOg&verifyHash=4d113eb6415ecf2a2a8c0daf43eb9de866913448

26 B
409 B

319ms
319ms

Image
image/gif

52.84.112.119
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAED8U6-_L0AABBvPsWYOg&verifyHash=4d113eb6415ecf2a2a8c0daf43eb9de866913448
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.112.119 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-112-119.sof50.r.cloudfront.net
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 08 Oct 2020 00:33:35 GMT
Via: 1.1 ccbbba3d3e67b71a86587be6ff36c80c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: SOF50-C1
Vary: Origin
X-Cache: Miss from cloudfront
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
trace-id: 34bc1e01de0627b2
X-Amz-Cf-Id: GF2n7spXkAN8gADJnlOtgrMQZIXYMuM08rZYacbJViceQNLmXP5vyw==

Redirect headers

Date: Thu, 08 Oct 2020 00:33:34 GMT
Via: 1.1 ccbbba3d3e67b71a86587be6ff36c80c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: SOF50-C1
Vary: Origin
X-Cache: Miss from cloudfront
Location: /validateCookie?vendor=choca&user_id=AAED8U6-_L0AABBvPsWYOg&verifyHash=4d113eb6415ecf2a2a8c0daf43eb9de866913448
Connection: keep-alive
trace-id: aa236dc1e608ffe6
Content-Length: 0
X-Amz-Cf-Id: gG5ZOZTVKGsIhVdqXspg55awn5wd8t14OD_jFWL-XCtdZe-D4dnycg==

GET
H/1.1 200
OK / Show response
c.6sc.co/ 47 B
370 B 31ms
31ms XHR
text/plain 104.109.70.122
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.70.122 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a104-109-70-122.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 08298513c32aa64810deb8487d81142e55cd665bc9b938f3d974876e5bd40a2b

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 08 Oct 2020 00:33:34 GMT
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: text/plain
Access-Control-Allow-Origin: https://www.splunk.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 47

GET
H/1.1 200
OK getuidj Show response
secure.adnxs.com/ 11 B
701 B 93ms
31ms XHR
application/json 37.252.172.38
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.38 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

690.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Oct 2020 00:33:34 GMT
X-Proxy-Origin: 82.102.20.235; 82.102.20.235; 690.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.41:80
AN-X-Request-Uuid: 68a0f6c0-11ed-4bc4-ac5c-f93055cba3de
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.splunk.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 11
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 xdc.js Show response
cdn.bizible.com/ 116 B
368 B 151ms
150ms Script
text/javascript 68.232.35.12
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.bizible.com/xdc.js?_biz_u=967b200af19a4f9eb9fec6e6f3e25f32&_biz_h=-1906410348&cdn_o=a&jsVer=4.20.08.28
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.232.35.12 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (ska/F717) /
Resource Hash: 250021b0c1a8cfcd5ceeaae55ab63947e354cc622784d2f18fcec5e4b74cb3a4

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:33 GMT
content-encoding: gzip
server: ECS (ska/F717)
etag: 0E0CC152
vary: Accept-Encoding
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status: 200
cache-control: private, must-revalidate, max-age=21600
content-type: text/javascript; charset=utf-8
content-length: 218

GET
H2 200 box-469cf41adb11dc78be68c1ae7f9457a4.html
vars.hotjar.com/ Frame BE60 0
0 32ms
32ms Document
text/html 147.75.33.131
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.33.131 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS: pkt-ams-k2-shared-ingress9
Software: /
Resource Hash

Request headers

:method: GET
:authority: vars.hotjar.com
:scheme: https
:path: /box-469cf41adb11dc78be68c1ae7f9457a4.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP

Response headers

status: 200
date: Thu, 08 Oct 2020 00:33:34 GMT
content-type: text/html
content-length: 851
last-modified: Mon, 28 Sep 2020 12:31:06 GMT
etag: "d594f1d4c3e5dbd6b556c60d34e0daea"
cache-control: max-age=31536000
content-encoding: br
section-io-origin-status: 200
section-io-origin-time-seconds: 0.090
section-origin-responded: true
age: 819828
vary: Accept-Encoding
section-io-cache: Hit
accept-ranges: bytes
section-io-id: 6da8864749d5d73c22ec891e8eee406b

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=66727&time=1602117214459&url=https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fget...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D66727%26time%3D1602117214459%26url%3Dhttps%253A%252F%252Fwww.splunk.com%252Fen_us...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=66727&time=1602117214459&url=https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fget...

0
39 B

180ms
180ms

Image
application/javascript

2a05:f500:11:101::b93f:9005
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=66727&time=1602117214459&url=https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DAPAC_FY21Q2_Oct20%26utm_content%3DDetecting-Malware-WP&liSync=true
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:34 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
status: 200
x-li-proto: http/2
x-li-pop: prod-tln1
content-type: application/javascript
content-length: 0
x-li-uuid: /pmkVh7dOxZAfF3aeCsAAA==

Redirect headers

content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-content-type-options: nosniff
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
linkedin-action: 1
status: 302
content-length: 0
x-li-uuid: IPsLUB7dOxbw2YOBjCsAAA==
pragma: no-cache
x-li-pop: afd-prod-lor1
x-msedge-ref: Ref A: 412CE9D3BF7344CBA8D5DC49440905BD Ref B: FRAEDGE1511 Ref C: 2020-10-08T00:33:34Z
x-frame-options: sameorigin
date: Thu, 08 Oct 2020 00:33:34 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=2592000
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-lor1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=66727&time=1602117214459&url=https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DAPAC_FY21Q2_Oct20%26utm_content%3DDetecting-Malware-WP&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 pageview
c.contentsquare.net/ 43 B
415 B 48ms
48ms Image
image/gif 54.217.118.25
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.contentsquare.net/pageview?pid=2961&uu=6bee47b4-127f-a3a2-b6c7-059b642eabe0&sn=1&lv=1602117214&lhd=1602117214&hd=1602117214&re=1&pn=1&dw=1600&dh=3683&ww=1600&wh=1200&sw=1600&sh=1200&dr=&url=https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DAPAC_FY21Q2_Oct20%26utm_content%3DDetecting-Malware-WP&uc=1&la=en-US&v=9.28.2&r=800525
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.217.118.25 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-217-118-25.eu-west-1.compute.amazonaws.com
Software: / ContentSquare
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Oct 2020 00:33:34 GMT
x-powered-by: ContentSquare
status: 200
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-disposition: inline
timing-allow-origin: *
access-control-allow-headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With
content-length: 43
expires: Sun, 24 Oct 1982 23:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
259 B 7ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1642523699107798&ev=PageView&dl=https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DAPAC_FY21Q2_Oct20%26utm_content%3DDetecting-Malware-WP&rl=&if=false&ts=1602117214515&sw=1600&sh=1200&v=2.9.27&r=stable&ec=0&o=30&fbp=fb.1.1602117214514.2026425473&it=1602117214368&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:34 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Thu, 08 Oct 2020 00:33:34 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
213 B 7ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1642523699107798&dl=https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DAPAC_FY21Q2_Oct20%26utm_content%3DDetecting-Malware-WP&rl=&if=false&ts=1602117214517&sw=1600&sh=1200&v=2.9.27&r=stable&ec=1&o=30&fbp=fb.1.1602117214514.2026425473&it=1602117214368&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:34 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Thu, 08 Oct 2020 00:33:34 GMT

GET
BLOB 200
OK 7b2d2fc0-5bd1-4785-9747-9c32f3468905
https://www.splunk.com/ 6 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.splunk.com/7b2d2fc0-5bd1-4785-9747-9c32f3468905
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 43aa943b8dddba7180aa243e058f224d91fe63e6abd1009242e196c2f40a44f4

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Length: 6342
Content-Type: application/javascript

GET
BLOB 200
OK 076f7a41-153b-493c-bfe0-58094cf3ab4e
https://www.splunk.com/ 6 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.splunk.com/076f7a41-153b-493c-bfe0-58094cf3ab4e
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 43aa943b8dddba7180aa243e058f224d91fe63e6abd1009242e196c2f40a44f4

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Length: 6342
Content-Type: application/javascript

GET
BLOB 200
OK 0886d7ea-00fa-4976-9f3b-0a5ef9b23838
https://www.splunk.com/ 6 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.splunk.com/0886d7ea-00fa-4976-9f3b-0a5ef9b23838
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 43aa943b8dddba7180aa243e058f224d91fe63e6abd1009242e196c2f40a44f4

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Length: 6342
Content-Type: application/javascript

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 232ms
232ms Image
image/gif 104.109.70.122
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=581214e52f923b1a91064a134ca689d7&svisitor=6fb51002035600005e5e7e5f75010000182e0700&visitor=4cb65846-dcdb-484c-815c-3ef134051482&session=de808efb-332e-4947-828d-56546e336c4c&event=a_pageload&q=%7B%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20Splunk%20security%20investigation%20use%20cases%20in%20our%20free%2C%20online%20demo%20environment%20without%20installing%20any%20software.%22%2C%22keywords%22%3A%22getting%20started%2C%20splunk%2C%20security%20investigation%2C%20demo%22%2C%22title%22%3A%22Online%20Demo%20Experiences%20%7C%20Security%20Investigations%20%7C%20Splunk%22%7D&cb=17214530&r=&thirdParty=%7B%7D&pageURL=https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DAPAC_FY21Q2_Oct20%26utm_content%3DDetecting-Malware-WP

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.109.70.122 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-70-122.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 08 Oct 2020 00:33:34 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Fri, 21 Feb 2020 18:51:25 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5e5026ad-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 4 B
26 B 13ms
13ms XHR
text/plain 2a00:1450:4001:819::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j86&a=1680458723&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DAPAC_FY21Q2_Oct20%26utm_content%3DDetecting-Malware-WP&ul=en-us&de=UTF-8&dt=Online%20Demo%20Experiences%20%7C%20Security%20Investigations%20%7C%20Splunk&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=csSessionKey&ea=6bee47b4-127f-a3a2-b6c7-059b642eabe0.1&_u=KHDACEADRAAAAC~&jid=1401045294&gjid=1271004144&cid=305123563.1602117214&tid=UA-399680-1&_gid=130021831.1602117214&_r=1&_slc=1&z=1511780897

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 08 Oct 2020 00:33:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://www.splunk.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dvar
c.contentsquare.net/ 43 B
415 B 48ms
48ms Image
image/gif 54.217.118.25
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.contentsquare.net/dvar?v=9.28.2&pid=2961&uu=6bee47b4-127f-a3a2-b6c7-059b642eabe0&sn=1&pn=1&dv=N4IgsgpgJglgrgWxALhBBBDGAbEAaEAYQwQAcsBzAOxRA3IGMB9AMwE8AmARgEcOmA9gwAuHAAz4QAZQFwATgwi0AzqWxwqAaxABfIAA&r=166893
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.217.118.25 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-217-118-25.eu-west-1.compute.amazonaws.com
Software: / ContentSquare
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Oct 2020 00:33:34 GMT
x-powered-by: ContentSquare
status: 200
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-disposition: inline
timing-allow-origin: *
access-control-allow-headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With
content-length: 43
expires: Sun, 24 Oct 1982 23:00:00 GMT

GET
H/1.1 200
OK getuidj Show response
ib.adnxs.com/ 11 B
701 B 95ms
33ms XHR
application/json 37.252.172.36
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/getuidj

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.36 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

692.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Oct 2020 00:33:34 GMT
X-Proxy-Origin: 82.102.20.235; 82.102.20.235; 692.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.51:80
AN-X-Request-Uuid: d1905035-a302-4566-aed2-916e5a624b0a
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.splunk.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 11
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
69 B 14ms
14ms XHR
text/plain 2a00:1450:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=UA-399680-1&cid=305123563.1602117214&jid=1401045294&gjid=1271004144&_gid=130021831.1602117214&_u=KHDACEACRAAAAC~&z=720100453

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c06::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 08 Oct 2020 00:33:34 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://www.splunk.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 visit-data Show response
in.hotjar.com/api/v2/client/sites/778215/ 178 B
320 B 52ms
52ms XHR
application/json 52.208.77.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://in.hotjar.com/api/v2/client/sites/778215/visit-data?sv=7
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.208.77.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-208-77-122.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6154d5f7f6961e042d013bab33fd02b691970d873f44f3c32d8fcc6e79ef5bcd

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Thu, 08 Oct 2020 00:33:34 GMT
content-encoding: br
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-max-age: 86400
access-control-allow-credentials: true

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
106 B 18ms
18ms Image
image/gif 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-399680-1&cid=305123563.1602117214&jid=1401045294&_u=KHDACEACRAAAAC~&z=157698257

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Oct 2020 00:33:34 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
106 B 19ms
18ms Image
image/gif 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-399680-1&cid=305123563.1602117214&jid=1401045294&_u=KHDACEACRAAAAC~&z=157698257

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Oct 2020 00:33:34 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 visits Show response
analytics.vendemore.com/ 31 B
392 B 34ms
34ms XHR
text/plain 3.120.63.212
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.vendemore.com/visits?vlmref=&vaid=&fingerprint=&url=https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DAPAC_FY21Q2_Oct20%26utm_content%3DDetecting-Malware-WP&title=Online%20Demo%20Experiences%20%7C%20Security%20Investigations%20%7C%20Splunk&path=%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html&domain=www.splunk.com&referrer=

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

3.120.63.212 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-120-63-212.eu-central-1.compute.amazonaws.com

Software

openresty/1.15.8.2 /

Resource Hash

3ac21bd725ecff1f0d1bb3edaab987eb7c20e48e0a76a77e440e4cdd5c11c203

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:34 GMT
server: openresty/1.15.8.2
status: 200
strict-transport-security: max-age=15724800; includeSubDomains
access-control-allow-methods: POST, GET, OPTIONS, HEAD
content-type: text/plain;charset=ISO-8859-1
access-control-allow-origin: https://www.splunk.com
access-control-max-age: 3600
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 31

POST
H2 200 /
www.facebook.com/tr/ 0
53 B 6ms
6ms Other
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOguS6pPycqA1AA5N

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Thu, 08 Oct 2020 00:33:35 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://www.splunk.com
access-control-allow-credentials: true
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0

GET
H2 200 tvSx692mGEcWThuE9nKFa7
play.vidyard.com/ 0
2 KB 115ms
32ms Other
text/html 151.101.113.181
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://play.vidyard.com/tvSx692mGEcWThuE9nKFa7?v=4.2.14&type=inline&cc=en&disable_popouts=1

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Frame-Options	ALLOWALL

Request headers

Origin: https://www.splunk.com
Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:35 GMT
content-encoding: gzip
age: 493749
x-cache: HIT
status: 200
content-length: 1452
x-served-by: cache-hhn4053-HHN
x-china: 0
access-control-allow-origin: *
referrer-policy: no-referrer-when-downgrade
x-timer: S1602117215.383206,VS0,VE1
x-frame-options: ALLOWALL
etag: W/"dc1-54YbzyfTS9vISLeqi3XX6p1mYqg"
vary: X-ThumbnailAB, X-China, accept-language, Accept-Encoding
content-type: text/html; charset=utf-8
via: 1.1 varnish
cache-control: no-store, no-cache, must-revalidate
accept-ranges: bytes
x-cache-hits: 1

GET
H2 200 LQkUcTwcyZHHwcDgDhApMn
play.vidyard.com/ 0
1 KB 115ms
33ms Other
text/html 151.101.113.181
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://play.vidyard.com/LQkUcTwcyZHHwcDgDhApMn?v=4.2.14&type=inline&cc=en&disable_popouts=1

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Frame-Options	ALLOWALL

Request headers

Origin: https://www.splunk.com
Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:35 GMT
content-encoding: gzip
age: 493749
x-cache: HIT
status: 200
content-length: 1452
x-served-by: cache-hhn4053-HHN
x-china: 0
access-control-allow-origin: *
referrer-policy: no-referrer-when-downgrade
x-timer: S1602117215.383409,VS0,VE1
x-frame-options: ALLOWALL
etag: W/"dc1-54YbzyfTS9vISLeqi3XX6p1mYqg"
vary: X-ThumbnailAB, X-China, accept-language, Accept-Encoding
content-type: text/html; charset=utf-8
via: 1.1 varnish
cache-control: no-store, no-cache, must-revalidate
accept-ranges: bytes
x-cache-hits: 1

GET
H2 200 3S6wbYGAJ4cKkegMYspviz
play.vidyard.com/ 0
1 KB 115ms
34ms Other
text/html 151.101.113.181
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://play.vidyard.com/3S6wbYGAJ4cKkegMYspviz?v=4.2.14&type=inline&cc=en&disable_popouts=1

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Frame-Options	ALLOWALL

Request headers

Origin: https://www.splunk.com
Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:35 GMT
content-encoding: gzip
age: 493749
x-cache: HIT
status: 200
content-length: 1452
x-served-by: cache-hhn4053-HHN
x-china: 0
access-control-allow-origin: *
referrer-policy: no-referrer-when-downgrade
x-timer: S1602117215.383384,VS0,VE1
x-frame-options: ALLOWALL
etag: W/"dc1-54YbzyfTS9vISLeqi3XX6p1mYqg"
vary: X-ThumbnailAB, X-China, accept-language, Accept-Encoding
content-type: text/html; charset=utf-8
via: 1.1 varnish
cache-control: no-store, no-cache, must-revalidate
accept-ranges: bytes
x-cache-hits: 1

GET
H2 200 tvSx692mGEcWThuE9nKFa7
play.vidyard.com/ Frame D592 0
0 34ms
32ms Document
text/html 151.101.113.181
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://play.vidyard.com/tvSx692mGEcWThuE9nKFa7?v=4.2.14&type=inline&cc=en&disable_popouts=1

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc/clientlibs/splunk/splunk-core/source.min.7d8bd9ece95fd4856ae7367dc8225b04.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
X-Frame-Options	ALLOWALL

Request headers

:method: GET
:authority: play.vidyard.com
:scheme: https
:path: /tvSx692mGEcWThuE9nKFa7?v=4.2.14&type=inline&cc=en&disable_popouts=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP

Response headers

status: 200
content-type: text/html; charset=utf-8
access-control-allow-origin: *
referrer-policy: no-referrer-when-downgrade
x-frame-options: ALLOWALL
cache-control: no-store, no-cache, must-revalidate
etag: W/"dc1-54YbzyfTS9vISLeqi3XX6p1mYqg"
x-china: 0
content-encoding: gzip
accept-ranges: bytes
date: Thu, 08 Oct 2020 00:33:35 GMT
via: 1.1 varnish
age: 493749
x-served-by: cache-hhn4020-HHN
x-cache: HIT
x-cache-hits: 1
x-timer: S1602117215.310838,VS0,VE1
vary: X-ThumbnailAB, X-China, accept-language, Accept-Encoding
content-length: 1452

GET
H2 200 style.js Show response
play.vidyard.com/v4/tvSx692mGEcWThuE9nKFa7/ 176 B
360 B 291ms
290ms Script
text/javascript 151.101.113.181
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://play.vidyard.com/v4/tvSx692mGEcWThuE9nKFa7/style.js?callback=window.VidyardV4.jsonp.style_tvSx692mGEcWThuE9nKFa7.done

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

c550d194dc28e9a207a1e75bee34ef4ee9b04e767aa975e2da96ba0ab34d5bb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
x-cache: MISS
status: 200
content-length: 139
x-served-by: cache-hhn4020-HHN
x-china: 0
access-control-allow-origin: *
referrer-policy: no-referrer-when-downgrade
x-timer: S1602117215.310633,VS0,VE260
x-frame-options: ALLOWALL
etag: W/"b0-W5lw+jNij9piyt3xHUcAvcpMn2A"
vary: X-ThumbnailAB, X-China, accept-language, Accept-Encoding
content-type: text/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-store, no-cache, must-revalidate
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 integrations.js Show response
play.vidyard.com/v4/tvSx692mGEcWThuE9nKFa7/ 176 B
227 B 291ms
290ms Script
text/javascript 151.101.113.181
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://play.vidyard.com/v4/tvSx692mGEcWThuE9nKFa7/integrations.js?callback=window.VidyardV4.jsonp.integrations_tvSx692mGEcWThuE9nKFa7.done

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

4f2ecc193783868ba28f3b96db81a030ea32b5a7ab1602af365289bc37c26f5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
x-cache: MISS
status: 200
content-length: 132
x-served-by: cache-hhn4020-HHN
x-china: 0
access-control-allow-origin: *
referrer-policy: no-referrer-when-downgrade
x-timer: S1602117215.311066,VS0,VE260
x-frame-options: ALLOWALL
etag: W/"b0-334xl6MdCvhTnxGRzFmz31xCTc4"
vary: X-ThumbnailAB, X-China, accept-language, Accept-Encoding
content-type: text/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-store, no-cache, must-revalidate
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 details.js Show response
play.vidyard.com/v4/tvSx692mGEcWThuE9nKFa7/ 1 KB
783 B 290ms
290ms Script
text/javascript 151.101.113.181
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://play.vidyard.com/v4/tvSx692mGEcWThuE9nKFa7/details.js?callback=window.VidyardV4.jsonp.details_tvSx692mGEcWThuE9nKFa7.done

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

8dff076d436ac68083b3080c25cebd93bd9e8ad745e42f14b931ede3af3ca7e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
x-cache: MISS
status: 200
content-length: 687
x-served-by: cache-hhn4020-HHN
x-china: 0
access-control-allow-origin: *
referrer-policy: no-referrer-when-downgrade
x-timer: S1602117215.311904,VS0,VE259
x-frame-options: ALLOWALL
etag: W/"4fa-d1tmz5GuAgqMYmD3sPLCXiSoM3A"
vary: X-ThumbnailAB, X-China, accept-language, Accept-Encoding
content-type: text/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-store, no-cache, must-revalidate
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 LQkUcTwcyZHHwcDgDhApMn
play.vidyard.com/ Frame C495 0
0 34ms
31ms Document
text/html 151.101.113.181
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://play.vidyard.com/LQkUcTwcyZHHwcDgDhApMn?v=4.2.14&type=inline&cc=en&disable_popouts=1

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc/clientlibs/splunk/splunk-core/source.min.7d8bd9ece95fd4856ae7367dc8225b04.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
X-Frame-Options	ALLOWALL

Request headers

:method: GET
:authority: play.vidyard.com
:scheme: https
:path: /LQkUcTwcyZHHwcDgDhApMn?v=4.2.14&type=inline&cc=en&disable_popouts=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP

Response headers

status: 200
content-type: text/html; charset=utf-8
access-control-allow-origin: *
referrer-policy: no-referrer-when-downgrade
x-frame-options: ALLOWALL
cache-control: no-store, no-cache, must-revalidate
etag: W/"dc1-54YbzyfTS9vISLeqi3XX6p1mYqg"
x-china: 0
content-encoding: gzip
accept-ranges: bytes
date: Thu, 08 Oct 2020 00:33:35 GMT
via: 1.1 varnish
age: 493749
x-served-by: cache-hhn4020-HHN
x-cache: HIT
x-cache-hits: 1
x-timer: S1602117215.319676,VS0,VE1
vary: X-ThumbnailAB, X-China, accept-language, Accept-Encoding
content-length: 1452

GET
H2 200 style.js Show response
play.vidyard.com/v4/LQkUcTwcyZHHwcDgDhApMn/ 176 B
234 B 286ms
282ms Script
text/javascript 151.101.113.181
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://play.vidyard.com/v4/LQkUcTwcyZHHwcDgDhApMn/style.js?callback=window.VidyardV4.jsonp.style_LQkUcTwcyZHHwcDgDhApMn.done

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

1b69b1087d961c4e98fd820f9acba211f4ffc883ca41cdf2c2df07858e92aac9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
x-cache: MISS
status: 200
content-length: 139
x-served-by: cache-hhn4020-HHN
x-china: 0
access-control-allow-origin: *
referrer-policy: no-referrer-when-downgrade
x-timer: S1602117215.319738,VS0,VE252
x-frame-options: ALLOWALL
etag: W/"b0-z3mqjAP1usmbWPhtXtVedRMlkCY"
vary: X-ThumbnailAB, X-China, accept-language, Accept-Encoding
content-type: text/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-store, no-cache, must-revalidate
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 integrations.js Show response
play.vidyard.com/v4/LQkUcTwcyZHHwcDgDhApMn/ 176 B
226 B 318ms
315ms Script
text/javascript 151.101.113.181
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://play.vidyard.com/v4/LQkUcTwcyZHHwcDgDhApMn/integrations.js?callback=window.VidyardV4.jsonp.integrations_LQkUcTwcyZHHwcDgDhApMn.done

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

01602d0b73d83024520d441e834bf3e8d3ca708c446238a411b98a0ca5c3e9ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
x-cache: MISS
status: 200
content-length: 132
x-served-by: cache-hhn4020-HHN
x-china: 0
access-control-allow-origin: *
referrer-policy: no-referrer-when-downgrade
x-timer: S1602117215.320291,VS0,VE285
x-frame-options: ALLOWALL
etag: W/"b0-ssH1YrM0oivRenIau3Vfxjabi/4"
vary: X-ThumbnailAB, X-China, accept-language, Accept-Encoding
content-type: text/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-store, no-cache, must-revalidate
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 details.js Show response
play.vidyard.com/v4/LQkUcTwcyZHHwcDgDhApMn/ 930 B
617 B 294ms
292ms Script
text/javascript 151.101.113.181
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://play.vidyard.com/v4/LQkUcTwcyZHHwcDgDhApMn/details.js?callback=window.VidyardV4.jsonp.details_LQkUcTwcyZHHwcDgDhApMn.done

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

cb2d83fd6be8701f7be8b0ad588dc03df2261b42f1fc5f4ebed416057445f65e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
x-cache: MISS
status: 200
content-length: 521
x-served-by: cache-hhn4020-HHN
x-china: 0
access-control-allow-origin: *
referrer-policy: no-referrer-when-downgrade
x-timer: S1602117215.320367,VS0,VE262
x-frame-options: ALLOWALL
etag: W/"3a2-Blu8qNg8JRxMJBGSNgE1nMIlQpg"
vary: X-ThumbnailAB, X-China, accept-language, Accept-Encoding
content-type: text/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-store, no-cache, must-revalidate
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 3S6wbYGAJ4cKkegMYspviz
play.vidyard.com/ Frame C5E4 0
0 53ms
52ms Document
text/html 151.101.113.181
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://play.vidyard.com/3S6wbYGAJ4cKkegMYspviz?v=4.2.14&type=inline&cc=en&disable_popouts=1

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc/clientlibs/splunk/splunk-core/source.min.7d8bd9ece95fd4856ae7367dc8225b04.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
X-Frame-Options	ALLOWALL

Request headers

:method: GET
:authority: play.vidyard.com
:scheme: https
:path: /3S6wbYGAJ4cKkegMYspviz?v=4.2.14&type=inline&cc=en&disable_popouts=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP

Response headers

status: 200
content-type: text/html; charset=utf-8
access-control-allow-origin: *
referrer-policy: no-referrer-when-downgrade
x-frame-options: ALLOWALL
cache-control: no-store, no-cache, must-revalidate
etag: W/"dc1-54YbzyfTS9vISLeqi3XX6p1mYqg"
x-china: 0
content-encoding: gzip
accept-ranges: bytes
date: Thu, 08 Oct 2020 00:33:35 GMT
via: 1.1 varnish
age: 493749
x-served-by: cache-hhn4020-HHN
x-cache: HIT
x-cache-hits: 1
x-timer: S1602117215.327531,VS0,VE1
vary: X-ThumbnailAB, X-China, accept-language, Accept-Encoding
content-length: 1452

GET
H2 200 style.js Show response
play.vidyard.com/v4/3S6wbYGAJ4cKkegMYspviz/ 176 B
361 B 275ms
274ms Script
text/javascript 151.101.113.181
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://play.vidyard.com/v4/3S6wbYGAJ4cKkegMYspviz/style.js?callback=window.VidyardV4.jsonp.style_3S6wbYGAJ4cKkegMYspviz.done

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

95684b08c6bd3ff79865097db0f7b406d971a2488df5a78a7497116840d105dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
x-cache: MISS
status: 200
content-length: 139
x-served-by: cache-hhn4020-HHN
x-china: 0
access-control-allow-origin: *
referrer-policy: no-referrer-when-downgrade
x-timer: S1602117215.324814,VS0,VE244
x-frame-options: ALLOWALL
etag: W/"b0-bpJ8NGPhQDY5ikrjFal6twMttn0"
vary: X-ThumbnailAB, X-China, accept-language, Accept-Encoding
content-type: text/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-store, no-cache, must-revalidate
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 integrations.js Show response
play.vidyard.com/v4/3S6wbYGAJ4cKkegMYspviz/ 176 B
227 B 335ms
333ms Script
text/javascript 151.101.113.181
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://play.vidyard.com/v4/3S6wbYGAJ4cKkegMYspviz/integrations.js?callback=window.VidyardV4.jsonp.integrations_3S6wbYGAJ4cKkegMYspviz.done

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

cd83daf9c9ceb28004f174a52842f411b47abc800d71a32c648e3f2db6b6d4b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
x-cache: MISS
status: 200
content-length: 132
x-served-by: cache-hhn4020-HHN
x-china: 0
access-control-allow-origin: *
referrer-policy: no-referrer-when-downgrade
x-timer: S1602117215.327070,VS0,VE303
x-frame-options: ALLOWALL
etag: W/"b0-6wWe6AuB481Myfq1YL4TgF6TLmA"
vary: X-ThumbnailAB, X-China, accept-language, Accept-Encoding
content-type: text/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-store, no-cache, must-revalidate
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 details.js Show response
play.vidyard.com/v4/3S6wbYGAJ4cKkegMYspviz/ 1 KB
802 B 306ms
304ms Script
text/javascript 151.101.113.181
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://play.vidyard.com/v4/3S6wbYGAJ4cKkegMYspviz/details.js?callback=window.VidyardV4.jsonp.details_3S6wbYGAJ4cKkegMYspviz.done

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

b9413fb84a48aaeb96cff4da907e4e07b5285a477b3136d3e789b741d07de7a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:33:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
x-cache: MISS
status: 200
content-length: 705
x-served-by: cache-hhn4020-HHN
x-china: 0
access-control-allow-origin: *
referrer-policy: no-referrer-when-downgrade
x-timer: S1602117215.327846,VS0,VE274
x-frame-options: ALLOWALL
etag: W/"4f9-CD2YVGxVMTkk+9goQcutGvWFmqg"
vary: X-ThumbnailAB, X-China, accept-language, Accept-Encoding
content-type: text/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-store, no-cache, must-revalidate
accept-ranges: bytes
x-cache-hits: 0

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
62 B 7ms
6ms Image
image/gif 2a00:1450:4001:819::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j86&a=1680458723&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DAPAC_FY21Q2_Oct20%26utm_content%3DDetecting-Malware-WP&ul=en-us&de=UTF-8&dt=Online%20Demo%20Experiences%20%7C%20Security%20Investigations%20%7C%20Splunk&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=airpr&ea=visitor%20hit&_u=KHDACEADRAAAAC~&jid=&gjid=&cid=305123563.1602117214&tid=UA-399680-1&_gid=130021831.1602117214&cd23=305123563.1602117214&z=1975745433

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Oct 2020 01:29:24 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 83051
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

204

anpx
dpx.airpr.com/
Redirect Chain

https://dpx.airpr.com/px?hostname=www.splunk.com&profile=443780&ga_account_id=UA-399680-1&ga_account_type=UA&ga_c=305123563.1602117214&an=true
https://secure.adnxs.com/getuid?https://dpx.airpr.com/anpx?adnxs_uid=$UID&airpr_id=3212079466
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fdpx.airpr.com%2Fanpx%3Fadnxs_uid%3D%24UID%26airpr_id%3D3212079466
https://dpx.airpr.com/anpx?adnxs_uid=1185818055712851132&airpr_id=3212079466

0
63 B

36ms
33ms

Image
text/plain

3.121.145.84
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dpx.airpr.com/anpx?adnxs_uid=1185818055712851132&airpr_id=3212079466
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.121.145.84 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-121-145-84.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Thu, 08 Oct 2020 00:33:35 GMT
cache-control: private
server: nginx

Redirect headers

Pragma: no-cache
Date: Thu, 08 Oct 2020 00:33:35 GMT
X-Proxy-Origin: 82.102.20.235; 82.102.20.235; 690.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.15:80
AN-X-Request-Uuid: efc2799a-6ff1-40f4-a536-cd85dff13515
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://dpx.airpr.com/anpx?adnxs_uid=1185818055712851132&airpr_id=3212079466
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 up
insight.adsrvr.org/track/ Frame 8FBA 0
0 53ms
50ms Document
text/html 18.203.124.74
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=65d5w9m&ref=https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DAPAC_FY21Q2_Oct20%26utm_content%3DDetecting-Malware-WP&upid=zfbopfz&upv=1.1.0
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.124.74 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-124-74.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

:method: GET
:authority: insight.adsrvr.org
:scheme: https
:path: /track/up?adv=65d5w9m&ref=https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DAPAC_FY21Q2_Oct20%26utm_content%3DDetecting-Malware-WP&upid=zfbopfz&upv=1.1.0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP

Response headers

status: 200
date: Thu, 08 Oct 2020 00:33:35 GMT
content-type: text/html
cache-control: private,no-cache, must-revalidate
pragma: no-cache
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 index.html
js.driftt.com/deploy/assets/ Frame 271B 0
0 45ms
43ms Document
text/html 99.86.243.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/deploy/assets/index.html

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1602117300000/2h26u57uzx7i.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.86.243.59 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-86-243-59.vie50.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: js.driftt.com
:scheme: https
:path: /deploy/assets/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP

Response headers

status: 200
content-type: text/html; charset=utf-8
content-length: 894
server: nginx
last-modified: Mon, 05 Oct 2020 17:21:34 GMT
x-amz-server-side-encryption: AES256
accept-ranges: bytes
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
date: Thu, 08 Oct 2020 00:33:35 GMT
etag: "f25d28353ebd5e9e72f90c6b4a90dd6b"
cache-control: max-age=10
x-cache: Hit from cloudfront
via: 1.1 96296f2b3ee1b7cbc3fb127d3383661e.cloudfront.net (CloudFront)
x-amz-cf-pop: VIE50-C1
x-amz-cf-id: IkOYl-u7qfTw7KBAjB4L8HEQj3FM1VMwnPUzaYdtAEHd-8YgrNX99Q==

GET
H/1.1 200
OK beacon.gif Show response
rum-collector-2.pingdom.net/img/ 0
213 B 56ms
54ms XHR
text/plain 34.250.128.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rum-collector-2.pingdom.net/img/beacon.gif?id=552c4298abe53d666aa63604&sAW=1600&sAH=1200&bIW=1600&bIH=1200&pD=24&dPR=1&or=landscape-primary&nT=0&rC=0&nS=0&cS=644&cE=705&dLE=644&dLS=644&fS=643&hS=661&rE=-1&rS=-1&reS=705&resS=781&resE=789&uEE=-1&uES=-1&dL=784&dI=1092&dCLES=1093&dCLEE=1159&dC=2271&lES=2271&lEE=2334&s=nt&title=Online%20Demo%20Experiences%20%7C%20Security%20Investigations%20%7C%20Splunk&path=https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html&ref=&sId=fba0817w&sST=1602117186&sIS=2&rV=0&v=1.4.1
Requested by: Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.250.128.129 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-250-128-129.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Pragma: no-cache
Date: Thu, 08 Oct 2020 00:33:35 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: 0

GET
H3-Q050 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
886 B 6ms
5ms Script
text/javascript 2a00:1450:4001:819::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 00:28:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
age: 300
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=3600
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 859
x-xss-protection: 0
expires: Thu, 08 Oct 2020 01:28:35 GMT

GET
H3-Q050 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:819::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TPV7TP

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 4676
date: Wed, 07 Oct 2020 23:15:39 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Thu, 08 Oct 2020 01:15:39 GMT

GET
H2 200 dvar
c.contentsquare.net/ 43 B
415 B 48ms
48ms Image
image/gif 54.217.118.25
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.contentsquare.net/dvar?v=9.28.2&pid=2961&uu=6bee47b4-127f-a3a2-b6c7-059b642eabe0&sn=1&pn=1&dv=N4IgxgzgsghgLmAFgSwHYHMDSBTAniALhAAYA6AJgHYA2ADgEZbyBOAFmpeeYFZnqB9etWLl69SqO7d63EAF8gAA&r=872880
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.217.118.25 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-217-118-25.eu-west-1.compute.amazonaws.com
Software: / ContentSquare
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Oct 2020 00:33:35 GMT
x-powered-by: ContentSquare
status: 200
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-disposition: inline
timing-allow-origin: *
access-control-allow-headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With
content-length: 43
expires: Sun, 24 Oct 1982 23:00:00 GMT

POST
H/1.1 204
No Content /
6852bd11.akstat.io/ 0
390 B 23ms
22ms Other
image/gif 2a02:26f0:f1:288::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://6852bd11.akstat.io/

Requested by

Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/M7Q82-FTRNS-TEZ4E-UCSZ2-NQJ9C

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:f1:288::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Thu, 08 Oct 2020 00:33:35 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.splunk.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
X-Akamai-Path-Stats: [3:902:2098]
Expires: Thu, 08 Oct 2020 00:33:35 GMT

POST
H3-Q050 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
50 B 21ms
20ms XHR
text/plain 2a00:1450:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=UA-399680-1&cid=305123563.1602117214&jid=339970737&gjid=1279684207&_gid=130021831.1602117214&_u=aHDAiUAjRAAAAG~&z=1253116709

Requested by

Host: www.splunk.com
URL: https://www.splunk.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.652a558c3774088b61b0530c184710d1.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400c:c06::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 08 Oct 2020 00:33:35 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://www.splunk.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
57 B 6ms
5ms Image
image/gif 2a00:1450:4001:819::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j86&a=1680458723&t=pageview&_s=1&dl=https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DAPAC_FY21Q2_Oct20%26utm_content%3DDetecting-Malware-WP&dr=%2F&dp=%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DAPAC_FY21Q2_Oct20%26utm_content%3DDetecting-Malware-WP&ul=en-us&de=UTF-8&dt=Online%20Demo%20Experiences%20%7C%20Security%20Investigations%20%7C%20Splunk&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aHDAiUAjRAAAAC~&jid=339970737&gjid=1279684207&cid=305123563.1602117214&tid=UA-399680-1&_gid=130021831.1602117214&gtm=2wg9u1TPV7TP&cd2=Not%20Logged%20In&cd3=305123563.1602117214&cd4=1602117215514.fmwlqx3gn&cd5=2020-10-08T02%3A33%3A35.514%2B02%3A00&cd7=Bot&cd8=(Non-Company%20Visitor)&cd16=1602117215514.222a2499-22c7-4566-9cd2-1b6ea94253b2&cd24=GA%20-%20Pageview&cd25=967b200af19a4f9eb9fec6e6f3e25f32&cd26=&cd32=0.27681829462999596_1602117215515&z=1552946236

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Oct 2020 01:29:24 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 83051
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ga-audiences
www.google.com/ads/ 42 B
87 B 23ms
21ms Image
image/gif 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-399680-1&cid=305123563.1602117214&jid=339970737&_u=aHDAiUAjRAAAAG~&z=1209645981

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Oct 2020 00:33:35 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ga-audiences
www.google.de/ads/ 42 B
87 B 24ms
21ms Image
image/gif 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-399680-1&cid=305123563.1602117214&jid=339970737&_u=aHDAiUAjRAAAAG~&z=1209645981

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Oct 2020 00:33:35 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
62 B 6ms
5ms Image
image/gif 2a00:1450:4001:819::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j86&a=1680458723&t=pageview&_s=3&dl=https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DAPAC_FY21Q2_Oct20%26utm_content%3DDetecting-Malware-WP&dp=vpv%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html%23%2FGDPR%20cookie%20pop%20up%20-%20Open&ul=en-us&de=UTF-8&dt=Online%20Demo%20Experiences%20%7C%20Security%20Investigations%20%7C%20Splunk%20-%20GDPR%20cookie%20pop%20up%20-%20Open&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aHDACUAjRAAAAG~&jid=&gjid=&cid=305123563.1602117214&tid=UA-399680-1&_gid=130021831.1602117214&z=1103584337

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/security-investigation/getting-started.html?utm_medium=email&utm_source=splunk&utm_campaign=APAC_FY21Q2_Oct20&utm_content=Detecting-Malware-WP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Oct 2020 01:29:24 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 83052
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

246 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

36 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.splunk.com/	1970-01-19 21:47:33	Name: vlmref Value: 216990126421420
.splunk.com/	1970-01-19 21:47:33	Name: _biz_flagsA Value: %7B%22Version%22%3A1%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%7D
www.splunk.com/	1970-01-19 21:47:33	Name: vaid Value: 216990126422341
www.splunk.com/	1970-01-19 13:01:57	Name: _hjIncludedInSessionSample Value: 1
www.splunk.com/	1970-01-19 13:01:57	Name: _hjIncludedInPageviewSample Value: 1
.splunk.com/	1970-01-19 13:01:59	Name: _hjAbsoluteSessionInProgress Value: 0
.splunk.com/	1969-12-31 23:59:59	Name: _hjTLDTest Value: 1
.splunk.com/	1970-01-19 13:01:57	Name: _gat Value: 1
.splunk.com/	1970-01-19 22:31:21	Name: _cs_id Value: 6bee47b4-127f-a3a2-b6c7-059b642eabe0.1602117214.1.1602117214.1602117214.1.1636281214496.Lax.0
.splunk.com/	1970-01-19 22:31:21	Name: _cs_c Value: 1
.splunk.com/	1970-01-19 13:03:23	Name: _uetsid Value: d5c53f3008fd11ebad98d9d600300adb
.splunk.com/	1970-01-19 21:47:33	Name: _hjid Value: 08cf5e49-59b6-45fd-a4a8-123072f63666
www.splunk.com/	1970-01-19 13:12:02	Name: _an_uid Value: 0
.splunk.com/	1970-01-19 21:47:33	Name: _biz_nA Value: 1
www.splunk.com/	1970-01-19 13:02:00	Name: acCode Value: null
www.splunk.com/	1970-01-20 06:33:09	Name: driftt_aid Value: c413a1b9-8c69-4617-acf9-6d4e02f593c0
.splunk.com/	1970-01-19 13:02:00	Name: AKA_A2 Value: A
.splunk.com/	1970-01-19 21:47:33	Name: _biz_uid Value: 967b200af19a4f9eb9fec6e6f3e25f32
.splunk.com/	1970-01-19 13:12:02	Name: RT Value: "z=1&dm=splunk.com&si=nljsn1zecmk&ss=kg0381xy&sl=0&tt=0"
.splunk.com/	1970-01-25 00:25:57	Name: trackAffiliate Value:
.splunk.com/	1970-01-19 21:47:33	Name: _biz_pendingA Value: %5B%5D
.splunk.com/	1970-01-19 13:25:21	Name: _uetvid Value: d5c568f008fd11eb9ee3810f2bce73d3
.splunk.com/	1970-01-20 06:33:09	Name: _ga Value: GA1.2.305123563.1602117214
.doubleclick.net/	1970-01-19 13:01:58	Name: test_cookie Value: CheckForPermission
.splunk.com/	1970-01-19 15:11:33	Name: _fbp Value: fb.1.1602117214514.2026425473
.splunk.com/	1970-01-19 13:01:59	Name: _biz_sid Value: 193955
.splunk.com/	1970-01-19 21:47:33	Name: OptanonConsent Value: isIABGlobal=false&datestamp=Thu+Oct+08+2020+02%3A33%3A34+GMT%2B0200+(Central+European+Summer+Time)&version=5.15.0&landingPath=https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsolutions%2Fsolution-areas%2Fsecurity-and-fraud%2Fsecurity-investigation%2Fgetting-started.html%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DAPAC_FY21Q2_Oct20%26utm_content%3DDetecting-Malware-WP&groups=1%3A1%2C4%3A1%2C2%3A1%2C3%3A1&hosts=&legInt=
.splunk.com/	1969-12-31 23:59:59	Name: SPLUNK_SUB_LOGIN Value: https%3A%2F%2Flogin.splunk.com%3Fmodule%3Droles%26func%3Dshowloginform
.splunk.com/	1969-12-31 23:59:59	Name: SPLUNK_USER_LOGIN_STATUS Value: false
.splunk.com/	1970-01-19 15:11:33	Name: _gcl_au Value: 1.1.457043632.1602117214
.splunk.com/	1970-01-19 13:01:59	Name: _cs_s Value: 1.1
www.splunk.com/	1970-01-20 06:33:09	Name: _gd_svisitor Value: 6fb51002035600005e5e7e5f75010000182e0700
www.splunk.com/	1970-01-20 06:33:09	Name: _gd_visitor Value: 4cb65846-dcdb-484c-815c-3ef134051482
.splunk.com/	1969-12-31 23:59:59	Name: SPLUNK_SUB_SIGNUP Value: https%3A%2F%2Fwww.splunk.com%2Fpage%2Fsign_up
www.splunk.com/	1970-01-19 13:02:11	Name: _gd_session Value: de808efb-332e-4947-828d-56546e336c4c
.splunk.com/	1970-01-19 13:03:23	Name: _gid Value: GA1.2.130021831.1602117214

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.splunk.com/etc/clientlibs/splunk/splunk-com/source.min.ab65d64eccb8e13d0f8c5e9d3575f1ce.js(Line 2897) Message: SplunkApp.setTabsListeners
console-api	log	URL: https://www.splunk.com/etc/clientlibs/splunk/splunk-com/source.min.ab65d64eccb8e13d0f8c5e9d3575f1ce.js(Line 2907) Message: tabs not rendered
console-api	warning	URL: https://connect.facebook.net/en_US/fbevents.js(Line 23) Message: [Facebook Pixel] - Duplicate Pixel ID: 1642523699107798.
console-api	log	URL: https://www.splunk.com/etc.clientlibs/splunk/clientlibs/clientlib-site.min.3c28748656932886ba72f1157ab2ee3c.js(Line 13) Message: interval 1
console-api	log	URL: https://www.splunk.com/etc.clientlibs/splunk/clientlibs/clientlib-site.min.3c28748656932886ba72f1157ab2ee3c.js(Line 13) Message: interval 1
console-api	log	URL: https://www.splunk.com/etc.clientlibs/splunk/clientlibs/clientlib-site.min.3c28748656932886ba72f1157ab2ee3c.js(Line 13) Message: interval 1
console-api	log	URL: https://www.splunk.com/etc.clientlibs/splunk/clientlibs/clientlib-site.min.3c28748656932886ba72f1157ab2ee3c.js(Line 13) Message: interval 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Security-Policy	frame-ancestors .splunk.com .touchcast.com .salesforce.com, frame-ancestors .splunk.com *.touchcast.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3801996.fls.doubleclick.net
6852bd11.akstat.io
analytics.vendemore.com
api.company-target.com
b.6sc.co
bat.bing.com
c.6sc.co
c.contentsquare.net
c.go-mpulse.net
cdn.bizible.com
cdn.bizibly.com
cdn.cookielaw.org
cdn.vidyard.com
connect.facebook.net
d2hya7iqhf5w3h.cloudfront.net
dpx.airpr.com
fls.doubleclick.net
geolocation.onetrust.com
ib.adnxs.com
in.hotjar.com
insight.adsrvr.org
j.6sc.co
js.adsrvr.org
js.driftt.com
match.prod.bidr.io
metadata-static-files.sfo2.cdn.digitaloceanspaces.com
play.vidyard.com
px.ads.linkedin.com
px.airpr.com
rum-collector-2.pingdom.net
rum-static.pingdom.net
s.go-mpulse.net
s1528.t.eloqua.com
s1528.t.en25.com
script.hotjar.com
scripts.demandbase.com
secure.adnxs.com
secure.eloqua.com
segments.company-target.com
snap.licdn.com
static.hotjar.com
stats.g.doubleclick.net
t.contentsquare.net
tm.vendemore.com
vars.hotjar.com
ws.zoominfo.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
www.splunk.com
104.109.70.122
104.16.168.82
147.75.100.245
147.75.33.131
151.101.113.181
18.203.124.74
205.185.216.10
209.167.231.15
209.167.231.17
209.167.231.27
216.58.207.38
216.58.212.134
2606:4700:10::6814:15ef
2606:4700:10::6814:b944
2606:4700::6810:9440
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:815::2008
2a00:1450:4001:819::200e
2a00:1450:4001:81c::2003
2a00:1450:4001:81c::2004
2a00:1450:4001:81f::2008
2a00:1450:400c:c06::9b
2a02:26f0:6c00:192::11a6
2a02:26f0:6c00:296::25ea
2a02:26f0:6c00:298::11a6
2a02:26f0:f1:288::11a6
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a05:f500:11:101::b93f:9005
3.120.63.212
3.121.145.84
34.250.128.129
37.252.172.36
37.252.172.38
52.208.77.122
52.212.22.61
52.84.112.119
52.84.112.20
52.84.112.76
54.217.118.25
68.232.35.12
72.247.179.120
93.184.220.42
93.184.221.26
99.86.240.169
99.86.243.29
99.86.243.59
99.86.243.95
99.86.245.27
0143251fc6233ab3db13575f4e5208ca169f7fc18ac72d5a6f62901d94aa6f22
01602d0b73d83024520d441e834bf3e8d3ca708c446238a411b98a0ca5c3e9ce
0387e92e3aea75f169352df7c2fa79c9f4a82f4360a082615133265afa1718a6
08298513c32aa64810deb8487d81142e55cd665bc9b938f3d974876e5bd40a2b
0d24e9923edbf8af778b0e4b424f25f68e5eaf62a395eb7a2242206bf4955b30
0dc1c8f148d96172c4173f9683d15fabd9a92184265dce82d645d28dc3adaa8e
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
12778349333458c41e8b79bfa66004cd352de74ddf6000f5ca08ba6ad1a14cf0
1514407cddcffb22e626d44e54c991867fd7b0ef049f6bbb351b5aa63baf32de
1b06d0f959e02e27e79585d309b73f226ece1d991841c1e8571d4fba9491345b
1b69b1087d961c4e98fd820f9acba211f4ffc883ca41cdf2c2df07858e92aac9
250021b0c1a8cfcd5ceeaae55ab63947e354cc622784d2f18fcec5e4b74cb3a4
25727b382b6028afe672fed6f2f04fc2047a0f66289c890f514147462e511187
290875dfc6e8b955b599c421fbc423729980387677d1d7922bd13eecf1304950
2c096b63819fbd5f5a384de76186519ef1f63aab1e49b003df9c67f889ec7b0d
2f951f43f836ad8919b067a5c7eae9b43d8753619efe55740adf3a0cf71be207
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
35bb5024b826965ec5398049d72af123d6d315abe4f60bbc15d73f9c3cb4ebf6
396197a350c5f917f454cb764fa31f624d64f8fbac73445c4d2862bad7ca22bf
3ac21bd725ecff1f0d1bb3edaab987eb7c20e48e0a76a77e440e4cdd5c11c203
3b595fb0d95350953f7deb30135240364184967b460bb42827cf759bb596122a
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
43aa943b8dddba7180aa243e058f224d91fe63e6abd1009242e196c2f40a44f4
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
446cb2c77c2807618caf4de745e133e0893780c448f2ce8b1b0266f08f9dfc83
44a739506a0ab47d1ac54b8e1c2e98b38e2f6e083e5a580366ed82ffdc7e026f
44dd62d6a622a6198df9bfcfc1acbf414706e86c57dfc1d0f15b147fa7f25ae0
48b27638205c87f6a8bc2ad57e6e1e14794a580d41418f9dec81cf58abd744ed
4b6c3188274d8950829ed0a5dc26c64c7f02c563d00742e0f182389084ae3ace
4c77b84665a1e6bfb24ec928a1ed9045818099f6a6f2e26e2bb22a560067183f
4f2ecc193783868ba28f3b96db81a030ea32b5a7ab1602af365289bc37c26f5a
526650a66909eb4f0264c70ff8cd5f51ab3683a9208d06c033a428f5d6bc8af7
529b9c583e6cf8da02c9cadf8c38b5714198f0fde2dcde01da2d5ee681228738
5559cfc9dc35f12ed28dca34d607e7466d681161dd7b62fd4e673c775c8e50eb
5b89e81921f42b8ea68f4a5f9e171306ddaf8d715142652bc6097ee77d24009d
5d3e3969288a2e47dc847d7abfc34c693fcad261b5056715ece9ebcece4399cf
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
6154d5f7f6961e042d013bab33fd02b691970d873f44f3c32d8fcc6e79ef5bcd
6607d39e43283ed0bb6e98c94d643344392be4086426e171c96df8a3ac1f40b9
694512bcca0131f7af7cd3cded5fb7cdd109e11d095ca1cc7e7aad3bc30fa4c7
6a9d9343aad35bd6ace0482f5091902750a3cad588ec61989150860079d58f43
6bd6f89b1e7f7eef3650d12eb6b8b0b9a839034f1917cccfafb5d22f549d5529
6e3ebb53aff58aaf432601a5bb9a62c4ab76791c027c5610943936cbb1453777
6f876034ba4d35c700fde3a5a439bd9d1d60e924b43fc236f52c0d7724212d49
71f6399d134d9edb0d1ff1be792e49a7c9b298110d0821222eed08505ac409de
72c54e10197220c41df6aa7a2a4ba36c7dc6a910db9ff0251a983a02c06c2bd8
750bc48538b7d0a04da896bfe06c0b2f8a5cfaac40ea8628b0e5f5bef5ec0999
779651bc146d489786b9b4ab590d2784547448e4b85cf1bb9036b31e404d1a37
78434b739c4013cc3c51ac35a7b3a8c2aede650d9f2f7a282d0db427bdcc06c3
7a2334e568c9689046f0465df6067630a2e222f32478e37b794a9c6827252b92
7bc1dc7d2a673a36a6e7b3d26c7fd8f5cc42d8b2d41a98e4de2a5ebdaaea9bf7
7f57c3e2ef4fe36fb4e3ddec6b6d3236fbd76b04749d7e0af5ceecdd59081ec6
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
89a89105479ea70792afbd97e7faf55f5a2fabf41c9ade06b5d5f8c8f736fc42
8c2812ded6436715279f8fd8db58de307aa39ab0296fe3cf0e879067c51e9b18
8ca688fa7efad5358c4ab46aa221f9121b25a66c1b64ca4176f55930d9afca92
8dff076d436ac68083b3080c25cebd93bd9e8ad745e42f14b931ede3af3ca7e6
90a9acaa2b73d4e87bc59beb161a8e9771d517ae8577ba38f6724f40d3461073
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
95684b08c6bd3ff79865097db0f7b406d971a2488df5a78a7497116840d105dc
95a439c4e11ace2484e8d42c30ff56cf7db5ea7c6463df9ce2fdafa7f6ccbf54
9a67d35485f44830dc54cd70f1473d146ffb66d89ddcd041836bbb3602e64b3a
9d233d4ebf342d0f9341e7b0c53a062fb97c0d640d1c19ad69c3f7cb9be789e4
a0054cb907bee526169a8718932e3949ed5d5c6468342cf4daa7bd052c77b38c
a4a47555ffdfd89567616e27b5d9bc5979b5ec7227ad217410f614b4c4973df1
a810118a0ab9ab90e9acd36978cbf80ff11e9acbb20a47af7b11f782626bcd44
a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f
a886586321c9ab22c09475a29dccd4f1f18e807ce655364cb5d80c23cb4b274e
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b6757c564305ac26f444cf3b00f5bfdce1e0684ae40b80706e5d9cffb2d81176
b9413fb84a48aaeb96cff4da907e4e07b5285a477b3136d3e789b741d07de7a0
bc45bfa29b6c6d07e6933a433e345ba8e272bd090895787bef47c5e5f5935fef
bc737ae70a65cccbb80c1ee02205ab32df57aa827429ddfc142b4a9e63d5197d
c496dfb0cb0a54ec27fd1cebe51edd18a5e781c7644ce11bd94b90a8271ce84a
c550d194dc28e9a207a1e75bee34ef4ee9b04e767aa975e2da96ba0ab34d5bb4
cb2d83fd6be8701f7be8b0ad588dc03df2261b42f1fc5f4ebed416057445f65e
cd83daf9c9ceb28004f174a52842f411b47abc800d71a32c648e3f2db6b6d4b2
ce0f373f6f3269f03446986ca9b6373e85eab72ab08275f8381d2b8ca79780d2
cea2b5003cfa170cde8f250c9cdbba9884937c9225cd0113c82c260466349ad6
cebf4cbf1630311071f998632cb8d4079b8d11491f71b826ae999d4732b380f4
d6ab5f2ce45950a4a8e550d2f4da4851bde39c802b76c552cc8e33de7d56521f
d6cf5fc5344294b7766c2bddc19dc7bcadcb7d4bb1920db9be1225d00e4a24d8
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
dc6dc98cca0dd4df6b20f3813bb9f7da0b6bf8e0abb42653c0ee673880caecfd
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e0cc0930a1ab7e9ae754783576228f3c32caa07605236711cf81035f3f45f0ea
e10987759412bc1595918fac7e917c38b5a4b8efb0ab009f379eaecd263e25ba
e14c6cc87d125650579daef012b939ee4ef85891042a7adb0a568ebfd70023b9
e27218633d360d848acb958a72f1c87f1ef090c40c0c4ad8096a4172d52a8345
e30b8666a7f4aa8b4067e95b01a1e0611fbd1b817228b382a3f8867c4e186bf1
e37570ef85a3553930ba20dfab7280bfcead8a2238b536b5c03c629c35b3d4ca
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e41786c6c10652eff300e9b257253e78089629b4fffdbff060667aa995f5b5dd
e60d72219eb682a93fea26976d93acbe542afdd65065fd1e05c393d8dd996a30
e9ab17238de283187dfc99a1fa9eb9af534c882c8a0dde7206a120fbd5687397
ea3dfefbe8e35a421e2569d4e3315e9264cf41fc32a4b865703ed7288dc79d6c
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093
f196c1d1d576f6f92ae7feba85fd0a570f88d09ba8e98fe4489883f2404bb9e1
f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab
f1d4cb061a8e35b325a022112bb6eb969a93ef1e938bf97e47192be476ccd8b7
f46a35a641796cf74c1c248c93f8aa7829059cd946ccefbd3ddc4ee7e9ce4971
fc969dc1c6ff531abcf368089dcbaf5775133b0626ff56b52301a059fc0f9e1e

www.splunk.com Open in urlscan Pro 72.247.179.120 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

137 Requests

98 %HTTPS

36 %IPv6

35 Domains

53 Subdomains

46 IPs

8 Countries

1696 kBTransfer

5318 kBSize

36 Cookies

21 Outgoing links

Page URL History

Redirected requests

137 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.splunk.com Open in urlscan Pro
72.247.179.120 Public Scan

Screenshot
Live screenshot

Full Image

137
Requests

98 %
HTTPS

36 %
IPv6

35
Domains

53
Subdomains

46
IPs

8
Countries

1696 kB
Transfer

5318 kB
Size

36
Cookies

137 HTTP transactions
1 data transactions