cofense.com Open in urlscan Pro
35.188.168.180 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://cofense.com/blog/autohotkey-banking-trojan/
Submission: On March 15 via api (March 15th 2021, 4:00:52 pm UTC) from US

Summary HTTP 267 Redirects Links 16 Behaviour Indicators

Summary

This website contacted 61 IPs in 6 countries across 48 domains to perform 267 HTTP transactions. The main IP is 35.188.168.180, located in Council Bluffs, United States and belongs to GOOGLE, US. The main domain is cofense.com.
TLS certificate: Issued by R3 on February 27th 2021. Valid for: 3 months.

This is the only time cofense.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	35.188.168.180 35.188.168.180	15169 (GOOGLE) (GOOGLE)
77	108.161.188.228 108.161.188.228	33438 (HIGHWINDS2) (HIGHWINDS2)
4	23.111.9.35 23.111.9.35	33438 (HIGHWINDS2) (HIGHWINDS2)
5	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
1	2600:9000:218... 2600:9000:2182:a400:c:d51b:4400:21	16509 (AMAZON-02) (AMAZON-02)
7	2a00:1450:400... 2a00:1450:4001:827::2008	15169 (GOOGLE) (GOOGLE)
3	2606:4700::68... 2606:4700::6810:125e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2.17.181.202 2.17.181.202	16625 (AKAMAI-AS) (AKAMAI-AS)
6	104.16.94.80 104.16.94.80	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
1	65.9.58.125 65.9.58.125	16509 (AMAZON-02) (AMAZON-02)
1	151.139.128.11 151.139.128.11	20446 (HIGHWINDS3) (HIGHWINDS3)
1	184.73.100.94 184.73.100.94	14618 (AMAZON-AES) (AMAZON-AES)
2	2a00:1450:400... 2a00:1450:4001:828::200e	15169 (GOOGLE) (GOOGLE)
1	13.226.159.79 13.226.159.79	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:210... 2a02:26f0:2100:1a6::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	52.44.242.176 52.44.242.176	14618 (AMAZON-AES) (AMAZON-AES)
1	199.232.136.157 199.232.136.157	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6810:650c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	88.221.60.75 88.221.60.75	16625 (AKAMAI-AS) (AKAMAI-AS)
1 5	84.53.188.140 84.53.188.140	34164 (AKAMAI-LON) (AKAMAI-LON)
1 2	2620:119:50e1... 2620:119:50e1:101::6cae:b25	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	2a00:1450:400... 2a00:1450:4001:800::200e	15169 (GOOGLE) (GOOGLE)
1	54.147.47.240 54.147.47.240	14618 (AMAZON-AES) (AMAZON-AES)
1	13.226.159.122 13.226.159.122	16509 (AMAZON-02) (AMAZON-02)
1	142.250.185.226 142.250.185.226	15169 (GOOGLE) (GOOGLE)
1	104.244.42.197 104.244.42.197	13414 (TWITTER) (TWITTER)
1	13.226.159.3 13.226.159.3	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:400c:c09::9d	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:813::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
1 1	3.248.28.111 3.248.28.111	16509 (AMAZON-02) (AMAZON-02)
13 16	34.253.2.147 34.253.2.147	16509 (AMAZON-02) (AMAZON-02)
1	107.20.140.231 107.20.140.231	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:4001:802::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
2	46.101.132.18 46.101.132.18	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
2	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	18.184.153.186 18.184.153.186	16509 (AMAZON-02) (AMAZON-02)
1 2	84.53.189.33 84.53.189.33	34164 (AKAMAI-LON) (AKAMAI-LON)
1	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	64.202.112.127 64.202.112.127	23352 (SERVERCEN...) (SERVERCENTRAL)
1	185.64.190.80 185.64.190.80	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	141.226.228.48 141.226.228.48	200478 (TABOOLA-AS) (TABOOLA-AS)
1 2	18.158.85.202 18.158.85.202	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1288:80:... 2a00:1288:80:800::7000	203220 (YAHOO-DEB) (YAHOO-DEB)
1 2	52.28.196.155 52.28.196.155	16509 (AMAZON-02) (AMAZON-02)
1 2	185.33.220.244 185.33.220.244	29990 (ASN-APPNEX) (ASN-APPNEX)
1 2	34.98.64.218 34.98.64.218	15169 (GOOGLE) (GOOGLE)
1 1	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
69	13.226.159.75 13.226.159.75	16509 (AMAZON-02) (AMAZON-02)
2	35.174.150.168 35.174.150.168	14618 (AMAZON-AES) (AMAZON-AES)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
1	13.226.159.45 13.226.159.45	16509 (AMAZON-02) (AMAZON-02)
6	50.16.7.188 50.16.7.188	14618 (AMAZON-AES) (AMAZON-AES)
1	52.22.71.46 52.22.71.46	14618 (AMAZON-AES) (AMAZON-AES)
6	100.24.186.63 100.24.186.63	14618 (AMAZON-AES) (AMAZON-AES)
2	54.145.60.34 54.145.60.34	14618 (AMAZON-AES) (AMAZON-AES)
2	3.94.218.138 3.94.218.138	14618 (AMAZON-AES) (AMAZON-AES)
1	2a04:4e42:1b:... 2a04:4e42:1b::720	54113 (FASTLY) (FASTLY)
267	61

2 35.188.168.180 (Council Bluffs, United States)

ASN15169 (GOOGLE, US)
PTR: 180.168.188.35.bc.googleusercontent.com

cofense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

77 108.161.188.228 (United States)

ASN33438 (HIGHWINDS2, US)

qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.111.9.35 (United States)

ASN33438 (HIGHWINDS2, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2182:a400:c:d51b:4400:21 (United States)

ASN16509 (AMAZON-02, US)

dsms0mj1bbhn4.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:827::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2.17.181.202 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-17-181-202.deploy.static.akamaitechnologies.com

cdn.iubenda.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.iubenda.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.16.94.80 (United States)

ASN13335 (CLOUDFLARENET, US)

app-ab46.marketo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.58.125 (United States)

ASN16509 (AMAZON-02, US)

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.139.128.11 (United States)

ASN20446 (HIGHWINDS3, US)

m9m6e2w5.stackpathcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.73.100.94 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-184-73-100-94.compute-1.amazonaws.com

www.shareaholic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:828::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.159.79 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-159-79.dus51.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:2100:1a6::25ea (Munich, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.44.242.176 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-44-242-176.compute-1.amazonaws.com

t.sf14g.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
lltrck.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.136.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:650c (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.221.60.75 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a88-221-60-75.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 84.53.188.140 (Netherlands) 1 redirects

ASN34164 (AKAMAI-LON, NL)
PTR: a84-53-188-140.deploy.static.akamaitechnologies.com

s.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:119:50e1:101::6cae:b25 (United States) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.147.47.240 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-147-47-240.compute-1.amazonaws.com

analytics.shareaholic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.159.122 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-159-122.dus51.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.197 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.159.3 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-159-3.dus51.r.cloudfront.net

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c09::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.248.28.111 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)

d.adroll.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 34.253.2.147 (Dublin, Ireland) 13 redirects

ASN16509 (AMAZON-02, US)

d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.20.140.231 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-107-20-140-231.compute-1.amazonaws.com

partner.shareaholic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 46.101.132.18 (Frankfurt am Main, Germany)

ASN14061 (DIGITALOCEAN-ASN, US)

hits-i.iubenda.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f02d:12:face:b00c:0:3 (United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.184.153.186 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 84.53.189.33 (Netherlands) 1 redirects

ASN34164 (AKAMAI-LON, NL)
PTR: a84-53-189-33.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 64.202.112.127 (United States) 1 redirects

ASN23352 (SERVERCENTRAL, US)
PTR: ny.outbrain.com

sync.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.190.80 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.226.228.48 (Netherlands)

ASN200478 (TABOOLA-AS, IL)

sync.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.158.85.202 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-158-85-202.eu-central-1.compute.amazonaws.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:80:800::7000 (United Kingdom)

ASN203220 (YAHOO-DEB, GB)

ads.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.28.196.155 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.33.220.244 (Amsterdam, Netherlands) 1 redirects

ASN29990 (ASN-APPNEX, US)

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.98.64.218 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.130 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f12d:83:face:b00c:0:25de (United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

69 13.226.159.75 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-159-75.dus51.r.cloudfront.net

rc-fast-lane.js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.174.150.168 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: pi0-lba1-3-ue1.aws.pardot.com

pi.pardot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.159.45 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-159-45.dus51.r.cloudfront.net

embeds.driftcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 50.16.7.188 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-16-7-188.compute-1.amazonaws.com

metrics.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.22.71.46 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-22-71-46.compute-1.amazonaws.com

bootstrap.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 100.24.186.63 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

targeting.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.145.60.34 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-145-60-34.compute-1.amazonaws.com

event.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.94.218.138 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-94-218-138.compute-1.amazonaws.com

flow.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:1b::720 (United States)

ASN54113 (FASTLY, US)

driftt.imgix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
77	netdna-ssl.com qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com	2 MB
70	driftt.com js.driftt.com rc-fast-lane.js.driftt.com	756 KB
21	adroll.com 14 redirects s.adroll.com d.adroll.com	26 KB
17	drift.com metrics.api.drift.com bootstrap.api.drift.com targeting.api.drift.com event.api.drift.com flow.api.drift.com	10 KB
11	gstatic.com fonts.gstatic.com	201 KB
7	iubenda.com cdn.iubenda.com www.iubenda.com hits-i.iubenda.com	134 KB
7	googletagmanager.com www.googletagmanager.com	153 KB
6	marketo.com app-ab46.marketo.com	146 KB
5	google-analytics.com www.google-analytics.com	55 KB
5	googleapis.com fonts.googleapis.com	4 KB
4	doubleclick.net 1 redirects stats.g.doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net	2 KB
4	fontawesome.com use.fontawesome.com	173 KB
3	google.de www.google.de	744 B
3	google.com www.google.com	752 B
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	3 KB
3	hotjar.com static.hotjar.com script.hotjar.com vars.hotjar.com	61 KB
3	cloudflare.com cdnjs.cloudflare.com	58 KB
2	pardot.com pi.pardot.com	3 KB
2	openx.net 1 redirects us-u.openx.net	479 B
2	adnxs.com 1 redirects ib.adnxs.com	2 KB
2	bidswitch.net 1 redirects x.bidswitch.net	872 B
2	3lift.com 1 redirects eb2.3lift.com	739 B
2	outbrain.com 1 redirects sync.outbrain.com	832 B
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com	2 KB
2	facebook.net connect.facebook.net	92 KB
2	shareaholic.com analytics.shareaholic.com partner.shareaholic.com	642 B
2	marketo.net munchkin.marketo.net	7 KB
2	cofense.com cofense.com	2 MB
1	imgix.net driftt.imgix.net	26 KB
1	driftcdn.com embeds.driftcdn.com	17 KB
1	twitter.com analytics.twitter.com	651 B
1	facebook.com www.facebook.com	147 B
1	yahoo.com ads.yahoo.com	447 B
1	taboola.com sync.taboola.com	220 B
1	pubmatic.com simage2.pubmatic.com	806 B
1	rubiconproject.com pixel.rubiconproject.com	239 B
1	advertising.com pixel.advertising.com	125 B
1	lltrck.com lltrck.com	272 B
1	consensu.org 1 redirects d.adroll.mgr.consensu.org	137 B
1	t.co t.co	448 B
1	googleadservices.com www.googleadservices.com	12 KB
1	zoominfo.com ws.zoominfo.com	427 B
1	ads-twitter.com static.ads-twitter.com	2 KB
1	sf14g.com t.sf14g.com	36 KB
1	licdn.com snap.licdn.com	2 KB
1	shareaholic.net www.shareaholic.net	2 KB
1	stackpathcdn.com m9m6e2w5.stackpathcdn.com	44 KB
1	cloudfront.net dsms0mj1bbhn4.cloudfront.net	4 KB
267	48

	Domain	Requested by
77	qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com	cofense.com qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
69	rc-fast-lane.js.driftt.com	js.driftt.com rc-fast-lane.js.driftt.com
16	d.adroll.com	13 redirects cofense.com
11	fonts.gstatic.com	fonts.googleapis.com
7	www.googletagmanager.com	cofense.com www.googletagmanager.com
6	targeting.api.drift.com	rc-fast-lane.js.driftt.com
6	metrics.api.drift.com	rc-fast-lane.js.driftt.com
6	app-ab46.marketo.com	cofense.com app-ab46.marketo.com
5	s.adroll.com	1 redirects www.googletagmanager.com cofense.com s.adroll.com
5	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com cofense.com
5	fonts.googleapis.com	cofense.com rc-fast-lane.js.driftt.com
4	cdn.iubenda.com	cofense.com cdn.iubenda.com
4	use.fontawesome.com	cofense.com use.fontawesome.com
3	www.google.de	cofense.com
3	www.google.com	cofense.com
3	cdnjs.cloudflare.com	cofense.com
2	flow.api.drift.com	rc-fast-lane.js.driftt.com
2	event.api.drift.com	rc-fast-lane.js.driftt.com
2	pi.pardot.com	cofense.com pi.pardot.com
2	us-u.openx.net	1 redirects cofense.com
2	ib.adnxs.com	1 redirects cofense.com
2	x.bidswitch.net	1 redirects cofense.com
2	eb2.3lift.com	1 redirects cofense.com
2	sync.outbrain.com	1 redirects cofense.com
2	dsum-sec.casalemedia.com	1 redirects cofense.com
2	connect.facebook.net	d.adroll.com connect.facebook.net
2	hits-i.iubenda.com	cdn.iubenda.com
2	stats.g.doubleclick.net	www.google-analytics.com
2	px.ads.linkedin.com	1 redirects cofense.com
2	munchkin.marketo.net	cofense.com munchkin.marketo.net
2	cofense.com	cofense.com
1	driftt.imgix.net	rc-fast-lane.js.driftt.com
1	bootstrap.api.drift.com	rc-fast-lane.js.driftt.com
1	embeds.driftcdn.com	rc-fast-lane.js.driftt.com
1	analytics.twitter.com	static.ads-twitter.com
1	www.facebook.com	cofense.com
1	cm.g.doubleclick.net	1 redirects
1	ads.yahoo.com	cofense.com
1	sync.taboola.com	cofense.com
1	simage2.pubmatic.com	cofense.com
1	pixel.rubiconproject.com	cofense.com
1	pixel.advertising.com	cofense.com
1	lltrck.com	cofense.com
1	partner.shareaholic.com	m9m6e2w5.stackpathcdn.com
1	d.adroll.mgr.consensu.org	1 redirects
1	googleads.g.doubleclick.net	www.googleadservices.com
1	vars.hotjar.com	static.hotjar.com
1	t.co	cofense.com
1	www.iubenda.com	cdn.iubenda.com
1	www.googleadservices.com	www.googletagmanager.com
1	script.hotjar.com	static.hotjar.com
1	analytics.shareaholic.com	m9m6e2w5.stackpathcdn.com
1	www.linkedin.com	1 redirects
1	ws.zoominfo.com	cofense.com
1	static.ads-twitter.com	cofense.com
1	t.sf14g.com	cofense.com
1	snap.licdn.com	www.googletagmanager.com
1	static.hotjar.com	www.googletagmanager.com
1	www.shareaholic.net	dsms0mj1bbhn4.cloudfront.net
1	m9m6e2w5.stackpathcdn.com	dsms0mj1bbhn4.cloudfront.net
1	js.driftt.com	cofense.com
1	dsms0mj1bbhn4.cloudfront.net	cofense.com
267	62

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.linkedin.com
support.cofense.com
cofenselabs.com
developer.cofense.com
go.cofense.com
community.cofense.com
ccbjournal.com
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
threatpost.com
www.bankinfosecurity.com
www.wpdownloadmanager.com

Subject Issuer	Validity	Valid
cofense.com R3	`2021-02-27` - `2021-05-28`	3 months	crt.sh
*.netdna-ssl.com Sectigo RSA Domain Validation Secure Server CA	`2021-02-22` - `2022-03-18`	a year	crt.sh
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1	`2020-11-13` - `2021-12-14`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2020-05-26` - `2021-04-21`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-10-21` - `2021-10-20`	a year	crt.sh
www.iubenda.com DigiCert Secure Site ECC CA-1	`2020-02-18` - `2021-05-19`	a year	crt.sh
app-ab46.marketo.com Cloudflare Inc ECC CA-3	`2020-09-16` - `2021-09-16`	a year	crt.sh
*.gstatic.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
drift.com Amazon	`2020-09-21` - `2021-10-23`	a year	crt.sh
*.stackpathcdn.com Go Daddy Secure Certificate Authority - G2	`2019-06-27` - `2021-06-27`	2 years	crt.sh
*.shareaholic.net R3	`2021-02-15` - `2021-05-16`	3 months	crt.sh
*.hotjar.com Amazon	`2020-12-25` - `2022-01-23`	a year	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
t.sf14g.com Go Daddy Secure Certificate Authority - G2	`2020-09-09` - `2021-09-09`	a year	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-14` - `2021-08-19`	a year	crt.sh
zoominfo.com Cloudflare Inc ECC CA-3	`2020-07-04` - `2021-07-04`	a year	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2020-03-14` - `2021-04-13`	a year	crt.sh
*.adroll.com DigiCert SHA2 Secure Server CA	`2020-01-29` - `2021-04-29`	a year	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2021-01-06` - `2021-07-05`	6 months	crt.sh
shareaholic.com Amazon	`2020-07-03` - `2021-08-03`	a year	crt.sh
www.googleadservices.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
t.co DigiCert TLS RSA SHA256 2020 CA1	`2021-01-12` - `2022-01-11`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
www.google.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
www.google.de GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
adroll.mgr.consensu.org Amazon	`2020-10-08` - `2021-11-07`	a year	crt.sh
*.shareaholic.com R3	`2021-02-15` - `2021-05-16`	3 months	crt.sh
*.google.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.google.de GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.iubenda.com Sectigo RSA Domain Validation Secure Server CA	`2020-01-31` - `2022-01-30`	2 years	crt.sh
lltrck.com Go Daddy Secure Certificate Authority - G2	`2020-09-23` - `2021-09-23`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-02-10` - `2021-05-10`	3 months	crt.sh
pixel.advertising.com DigiCert SHA2 High Assurance Server CA	`2021-03-01` - `2021-08-24`	6 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2020-03-02` - `2021-04-01`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2020-12-18` - `2022-01-18`	a year	crt.sh
*.outbrain.com Thawte RSA CA 2018	`2019-10-29` - `2021-11-23`	2 years	crt.sh
*.pubmatic.com DigiCert Baltimore TLS RSA SHA256 2020 CA1	`2020-12-07` - `2021-12-14`	a year	crt.sh
*.taboola.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2020-11-25` - `2021-12-26`	a year	crt.sh
*.3lift.com Amazon	`2020-07-04` - `2021-08-05`	a year	crt.sh
*.ads.yahoo.com DigiCert SHA2 High Assurance Server CA	`2021-02-28` - `2021-04-13`	a month	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2020-04-23` - `2022-05-04`	2 years	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2020-06-18` - `2021-08-17`	a year	crt.sh
*.drift.com Amazon	`2020-09-30` - `2021-10-30`	a year	crt.sh
pi.pardot.com DigiCert SHA2 Secure Server CA	`2020-12-05` - `2021-12-04`	a year	crt.sh
*.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2020-11-30` - `2021-11-29`	a year	crt.sh
*.driftcdn.com Amazon	`2021-03-12` - `2022-04-10`	a year	crt.sh
imgix.map.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-08-06` - `2021-08-07`	a year	crt.sh

This page contains 5 frames:

Primary Page: https://cofense.com/blog/autohotkey-banking-trojan/
Frame ID: 8D0E5140D2E687D41FA88821903B35D9
Requests: 190 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Frame ID: 05A5A3052FF56835ABF56E8EFE9B6F75
Requests: 1 HTTP requests in this frame

Frame: https://app-ab46.marketo.com/index.php/form/XDFrame
Frame ID: 26A332486F763E751BB0A194100B9A24
Requests: 2 HTTP requests in this frame

Frame: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
Frame ID: C70B012F466FD062C31E4FEEFA8F6A33
Requests: 41 HTTP requests in this frame

Frame: https://rc-fast-lane.js.driftt.com/core/chat
Frame ID: B4CF8307F3ADBCCE6DB2333C4D90E895
Requests: 42 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

AdRoll (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /(?:a|s)\.adroll\.com/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

html //i

Page Statistics

267
Requests

100 %
HTTPS

33 %
IPv6

48
Domains

62
Subdomains

61
IPs

6
Countries

5373 kB
Transfer

14142 kB
Size

15
Cookies

16 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/cofense

Search URL Search Domain Scan URL

URL: https://twitter.com/cofense

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/11500065/

Search URL Search Domain Scan URL

URL: https://support.cofense.com/
Title: Customer Resource Center

Search URL Search Domain Scan URL

URL: https://cofenselabs.com/
Title: Cofense Labs

Search URL Search Domain Scan URL

URL: https://developer.cofense.com/
Title: Cofense Dev

Search URL Search Domain Scan URL

URL: https://go.cofense.com/live-demo/
Title: Request a Demo

Search URL Search Domain Scan URL

URL: https://community.cofense.com/
Title: Community

Search URL Search Domain Scan URL

URL: https://www.facebook.com/cofense/
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/phishme-inc-?trk=hb_tab_compy_id_1550880
Title:

Search URL Search Domain Scan URL

URL: https://twitter.com/phishme
Title:

Search URL Search Domain Scan URL

URL: https://ccbjournal.com/podcast/in-house-warrior-garage2global-with-rohyt-belani-ceo-of-cofense-with-cohosts-louis-lehot-of-l2counsel-and-richard-levick-and-ian-lipner-of-levick
Title: 1/04/21 In House Warrior: Garage2Global with Rohyt Belani, CEO of Cofense with cohosts Louis Lehot of L2Counsel and Richard Levick and Ian Lipner of LEVICK Corporate Counsel Business Journal

Search URL Search Domain Scan URL

URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2021/01/Telestra.pdf
Title: 12/31/2020 Telstra backs Melbourne Cofense cyber security centre to defend Asia Pacific The Australian

Search URL Search Domain Scan URL

URL: https://threatpost.com/emotet-returns-100k-mailboxes/162584/
Title: 12/23/2020 Emotet Returns to Hit 100K Mailboxes Per Day ThreatPost

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.com/emotet-botnet-returns-after-2-month-hiatus-a-15656
Title: 12/23/2020 Emotet Botnet Returns After 2-Month Hiatus Bank Info Security

Search URL Search Domain Scan URL

URL: http://www.wpdownloadmanager.com/
Title: WordPress Download Manager - Best Download Management Plugin

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 134

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1615824034639&url=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D300721%26time%3D1615824034639%26url%3Dhttps%253A%252F%252Fcofense.com%252Fblog%252Fautohotkey-banking-trojan%252F%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1615824034639&url=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&liSync=true

Request Chain 151

https://s.adroll.com/j/exp/TFV7KNIV3VHWLJ6GAQ3KFT/index.js HTTP 302
https://s.adroll.com/j/exp/index.js

Request Chain 153

https://d.adroll.mgr.consensu.org/consent/iabcheck/TFV7KNIV3VHWLJ6GAQ3KFT?_s=c5a6243f866f60da5c31cbabb807f0c7&_b=2 HTTP 302
https://d.adroll.com/consent/check/TFV7KNIV3VHWLJ6GAQ3KFT/?_s=c5a6243f866f60da5c31cbabb807f0c7&_b=2

Request Chain 164

https://d.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&pv=41643531842.23648&cookie=&adroll_s_ref=&keyw= HTTP 302
https://s.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/LZCH7AGKEBFGLOFOIHTG7Q.js

Request Chain 167

https://d.adroll.com/cm/aol/out?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://pixel.advertising.com/ups/55980/sync?uid=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

Request Chain 168

https://d.adroll.com/cm/index/out?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&expiration=1647360035 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&expiration=1647360035&C=1

Request Chain 169

https://d.adroll.com/cm/n/out?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&expires=365

Request Chain 170

https://d.adroll.com/cm/outbrain/out?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://sync.outbrain.com/cookie-sync?p=adroll&uid=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk HTTP 302
https://sync.outbrain.com/cookie-sync?p=adroll&uid=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&rdrctExp=true

Request Chain 171

https://d.adroll.com/cm/pubmatic/out?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA

Request Chain 172

https://d.adroll.com/cm/taboola/out?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk

Request Chain 173

https://d.adroll.com/cm/triplelift/out?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://eb2.3lift.com/xuid?mid=4714&xuid=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&dongle=c85e HTTP 302
https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=

Request Chain 174

https://d.adroll.com/cm/r/out?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

Request Chain 175

https://d.adroll.com/cm/b/out?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://x.bidswitch.net/sync?dsp_id=44&user_id=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk HTTP 302
https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk

Request Chain 176

https://d.adroll.com/cm/x/out?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://ib.adnxs.com/setuid?entity=172&code=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DNTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk

Request Chain 178

https://d.adroll.com/cm/o/out?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537103138&val=50202732cf2d1451edb28bef04d84ed9 HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=50202732cf2d1451edb28bef04d84ed9

Request Chain 179

https://d.adroll.com/cm/g/out?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT&google_nid=adroll5 HTTP 302
https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=UCAnMs8tFFHtsovvBNhO2Q HTTP 302
https://d.adroll.com/cm/g/in

267 HTTP transactions
18 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
cofense.com/blog/autohotkey-banking-trojan/ 2 MB
2 MB 520ms
193ms Document
text/html 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx / WP Engine
Resource Hash: 9569ada5e169b65f93f33ce62107c2b75aaa5af5309706fca764beb2b550e700

Request headers

:method: GET
:authority: cofense.com
:scheme: https
:path: /blog/autohotkey-banking-trojan/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

server: nginx
date: Mon, 15 Mar 2021 16:00:31 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
link: <https://cofense.com/?p=24289>; rel=shortlink
x-powered-by: WP Engine
x-cacheable: SHORT
cache-control: max-age=600, must-revalidate
x-cache: HIT: 10
x-cache-group: normal
content-encoding: br

GET
H2 200 cache.skin.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega_main_menu/src/css/ 213 B
400 B 152ms
30ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega_main_menu/src/css/cache.skin.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: fb192c1648b3f3f1d33c7cb0dc247f98d32e9995731598adb483fd34e25a5083

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:29 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e2d-d5"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 style.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/css/dist/block-library/ 50 KB
8 KB 151ms
35ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/css/dist/block-library/style.min.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: fe9ad9796d39e706fe661ddf90151c0ebc03251164354d55f1ee95ca06878b40

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 16:58:16 GMT
server: NetDNA-cache/2.2
etag: W/"604b9da8-c88a"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 all.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/fontawesome/css/ 56 KB
12 KB 163ms
47ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/fontawesome/css/all.min.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 9a680b90260b5106d79f4075491ab31daafa7429eff686453c40b58357309649

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:32 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e30-dff5"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 bootstrap.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/bootstrap/css/ 56 KB
10 KB 167ms
52ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/bootstrap/css/bootstrap.min.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: e53f793a5b8ac48587ffa08d392fddc565ccecc537528b94eb4c73eecad02e60

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:32 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e30-e1e0"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 front.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/css/ 65 KB
12 KB 173ms
58ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/css/front.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 2a141ce8eb4c5191e2b0a3af6e81189bc118436ad1b0c0bf12b0d52e6f8edd87

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:32 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e30-10321"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 ihover.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/ 428 KB
76 KB 178ms
64ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/ihover.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: e89fa95988dcf7bf63bc92866b4ebd12c7ededfda65f8040105b51cb41f0414e

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:30 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e2e-6ae1e"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 style.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/ 1 KB
825 B 214ms
100ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/style.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c95b879561e19ae45fa002f19fab5a8d1b0ca8c9f975409eb3abd829cf83031d

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:29 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e2d-568"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 font-awesome.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/font-awesome/css/ 37 KB
8 KB 217ms
103ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/font-awesome/css/font-awesome.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:29 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e2d-9226"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 page-list.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/page-list/css/ 2 KB
790 B 193ms
79ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/page-list/css/page-list.css?ver=5.1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: b3fd2bd251945091f3e856b2d244d662e7980d715b6d7f1722fde67e6dd321ef

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:29 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e2d-60c"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 front.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/simple-social-buttons/assets/css/ 96 KB
11 KB 216ms
103ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/simple-social-buttons/assets/css/front.css?ver=3.2.1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 737dadb23f48c0823c3d5f597c2f9d34d81a8e964f013109fb366d7d84dffdc1

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:26 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e2a-17e39"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 t4bnewsticker.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/t4b-news-ticker/assets/css/ 2 KB
873 B 194ms
80ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/t4b-news-ticker/assets/css/t4bnewsticker.css?v=1.2.3&ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 9638c4b3ed25883972a0d3e5ef064f74e39fe248a07f62fdcb329abdcc9ad0bf

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:24 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e28-7d7"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 chosen.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/search-filter-pro/public/assets/css/ 10 KB
2 KB 214ms
101ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/search-filter-pro/public/assets/css/chosen.min.css?ver=1.4.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: df531f4d859b68297e2b1d3d0b989147f90b31a30559d137a2e634514da7e961

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:27 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e2b-29ff"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 search-filter.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/search-filter-pro/public/assets/css/ 24 KB
5 KB 196ms
83ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/search-filter-pro/public/assets/css/search-filter.min.css?ver=1.4.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 60fc31875f78865acddb5c715176e982b12e8532097184b38a59f793f1691b43

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:27 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e2b-61cc"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 all.css
use.fontawesome.com/releases/v5.13.0/css/ 57 KB
14 KB 2069ms
1992ms Stylesheet
text/css 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.13.0/css/all.css
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84

Request headers

Origin: https://cofense.com
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:33 GMT
content-encoding: gzip
last-modified: Mon, 23 Mar 2020 16:09:20 GMT
server: NetDNA-cache/2.2
etag: W/"76cb46c10b6c0293433b371bae2414b2"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT

GET
H2 200 js_composer.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/js_composer/assets/css/ 449 KB
45 KB 198ms
86ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/js_composer/assets/css/js_composer.min.css?ver=5.1.1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 014bdcd85899b1e128d977bbb8f899d6c9623e68cfb63b3a637d39f61ff01ff5

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:30 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e2e-70240"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 magnific-popup.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/libs/magnific-popup/ 6 KB
2 KB 192ms
80ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/libs/magnific-popup/magnific-popup.min.css?ver=0.9.9
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 347cd2766d64da2e2d3ba740c9b07659352d583fd5e42a3d6b794acd43748129

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:32 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e30-1802"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 animate.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/ 67 KB
4 KB 195ms
82ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/animate.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 0f3ffa7f0b928b893a75953b1b233b2bf8dc84f94851a6d24225a59d862c270b

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:31 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e2f-10cbc"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 css
fonts.googleapis.com/ 5 KB
657 B 23ms
15ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700&ver=1

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2fb8bbf7561a7cb3f3e25d6cbd650e311544c2f6dad6cf7d805a0ef51e1c5ade

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 15 Mar 2021 15:13:30 GMT
server: ESF
date: Mon, 15 Mar 2021 16:00:31 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 15 Mar 2021 16:00:31 GMT

GET
H2 200 elegant-icons.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/libs/elegant-icons/ 4 KB
1 KB 196ms
84ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/libs/elegant-icons/elegant-icons.min.css?ver=1.0
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 4dc068edecd14f25d56b1f3093a42c9162e0f66a937827f0f1392359094e1208

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:22 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e26-103d"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 owl.carousel.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/libs/owl-carousel/ 22 KB
3 KB 211ms
99ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/libs/owl-carousel/owl.carousel.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 83f6604f4c4ca11246131304ec9a76d75e3b2db2ece8a477c4f0bf580b26a093

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:22 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e26-577a"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 theme-styles.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/ 608 KB
72 KB 204ms
92ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/theme-styles.css?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: e066e27304a41a9bd1eba18c512de3e7bc743488f4002fe21b97b222a822a9c4

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:27 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e2b-980d1"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 theme-shortcodes.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/ 28 KB
5 KB 193ms
81ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/theme-shortcodes.css?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: d2caf4e20c60ec1b01fb2b59d947b111d50d667850f9ef13af194183f0574bed

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:22 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e26-6f98"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 custom-styles.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/ 113 KB
19 KB 214ms
103ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1615568423
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: abee3b66f6dd218919cfb15e9be9c474bc2797a331ff3d27659bb857468efda5

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:23 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e27-1c254"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 wmx-styles.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/ 5 KB
1 KB 195ms
84ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/wmx-styles.css?ver=1615568422
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c4af296b65d25387b38e738018ce430397082b09449a7ce8da08baaa53c4c77d

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:22 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e26-1572"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 responsive.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/ 102 KB
12 KB 210ms
99ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/responsive.css?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 643ced756fe32f82d14c178ac0002a181a12d128402bd63b9b74c3cbdd85e66a

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:23 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e27-198c3"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 select2.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/vendor/ 15 KB
2 KB 191ms
80ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/vendor/select2.min.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c066d830135d79d0b9aa4500ec1ba098dc25e08f606bcd9505fa94cb420c616b

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:22 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e26-3aed"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 style.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/ 93 KB
16 KB 212ms
101ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c255d210ac5b9d7aa2c40ca2d9c0dd8143f05bd61bb6fa611dbff9be22d1e0b5

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:23 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e27-175c1"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 css
fonts.googleapis.com/ 24 KB
1 KB 21ms
14ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.6.2

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

551c24fb8497e8befef657134a4dc50f8cb6191edf8512a53eb32591da35275c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 15 Mar 2021 14:27:19 GMT
server: ESF
date: Mon, 15 Mar 2021 16:00:31 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 15 Mar 2021 16:00:31 GMT

GET
H2 200 v4-shims.css
use.fontawesome.com/releases/v5.13.0/css/ 26 KB
5 KB 2086ms
2012ms Stylesheet
text/css 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.13.0/css/v4-shims.css
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c0ded025aa80c10d37920521c8de04536a6145d0e42eb4186c57b412fa50eb45

Request headers

Origin: https://cofense.com
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:33 GMT
content-encoding: gzip
last-modified: Mon, 23 Mar 2020 16:09:22 GMT
server: NetDNA-cache/2.2
etag: W/"fb073a92592d70e5aa6e3cce1cf93a11"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT

GET
H2 200 jquery-1.12.4-wp.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery/ 95 KB
33 KB 214ms
103ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery/jquery-1.12.4-wp.js?ver=1.12.4-wp
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 3bb2621a4c0c710f6e78404473aebff8e115a28f8d53f44339b867c63ad93b26

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:31 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e2f-17a56"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery-migrate-1.4.1-wp.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/ 23 KB
8 KB 214ms
104ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/jquery-migrate-1.4.1-wp.js?ver=1.4.1-wp
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 708883a21754b3f7e1653d1d358663d65309e97d673a5934990c73f46df22d4c

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:31 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e2f-5c79"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 bootstrap.bundle.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/bootstrap/js/ 79 KB
23 KB 214ms
104ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/bootstrap/js/bootstrap.bundle.min.js?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 4d371899aba195b1f0cba3a70de300fb5b327a322cfbe3a30d77af8456d8494e

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:32 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e30-13b0a"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 front.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/js/ 39 KB
11 KB 214ms
104ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/js/front.js?ver=3.1.11
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 70fabc58ca55af5ac394614cce6a2288a3eeba4cd5f429eea53eaa443f6ca52e

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:32 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e30-9a93"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 chosen.jquery.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/js/ 51 KB
9 KB 213ms
104ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/js/chosen.jquery.min.js?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 7373ca9ed2c272959213699ab6c34d53f342a2d01d996ebc543743312911a6dc

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:32 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e30-cbc3"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 core.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-ui/ 4 KB
2 KB 213ms
104ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-ui/core.min.js?ver=1.11.4-wp
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 46e6f42a22054a793841935920cbbc723856e339fead50fa33c1f1bb3ec5a251

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:31 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e2f-f5b"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 script.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/js/ 3 KB
1 KB 213ms
104ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/js/script.js?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: bfe8ebbb9a154092de88c4c438e3721fe9622818aaa98a8852bb02550cd8342f

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:29 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e2d-c1c"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 front.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/simple-social-buttons/assets/js/ 7 KB
2 KB 213ms
105ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/simple-social-buttons/assets/js/front.js?ver=3.2.1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: e0447c33437b68ce8263e7ce898c532cb1676e1dfc94662aea3300263e425265

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:26 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e2a-1d3b"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.liscroll.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/t4b-news-ticker/assets/js/ 2 KB
1 KB 212ms
104ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/t4b-news-ticker/assets/js/jquery.liscroll.js?ver=1.2.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c34294b171494a6c68a4eee25765b44496a737ca32b098a0f902e1edc5fe65e7

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:24 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e28-98a"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 modernizr.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/ 10 KB
5 KB 212ms
103ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/modernizr.js?ver=1.1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 71209f63fc1592e55fcff12d74e9f6108505190c6e70df5cc7d5748af32b9365

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:32 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e30-283b"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 shareaholic.js Show response
dsms0mj1bbhn4.cloudfront.net/assets/pub/ 9 KB
4 KB 40ms
9ms Script
application/javascript 2600:9000:2182:a400:c:d51b:4400:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dsms0mj1bbhn4.cloudfront.net/assets/pub/shareaholic.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2182:a400:c:d51b:4400:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 7fb05d93d6e31f72eba8cfddc8128be22fc193f0665284d2058fc21be241c724

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 15:50:45 GMT
content-encoding: gzip
age: 603
x-cache: Hit from cloudfront
x-hello-human: Join the fun! Apply at www.shareaholic.com/jobs
content-length: 3703
access-control-allow-origin: *
last-modified: Tue, 09 Mar 2021 22:06:48 GMT
server: nginx
etag: "4955cd52f50e5a0e12c7c4f440c69d06"
content-type: application/javascript; charset=UTF-8
via: 1.1 f12c01365a7e1bcbb4b6d5b856516527.cloudfront.net (CloudFront)
cache-control: max-age=1200, public
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
x-amz-cf-id: ibhbeBWpiKEosASDbppIf2iZA7byecX2XN1q-dcRCiJ6kCQjv4_-Tg==

GET
H2 200 css
fonts.googleapis.com/ 3 KB
598 B 20ms
15ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Rubik:400,500

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7971bffa44c1c86543b6747b7ac333564decf57d2696acb1f939e521bb49f766

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 15 Mar 2021 14:22:50 GMT
server: ESF
date: Mon, 15 Mar 2021 16:00:31 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 15 Mar 2021 16:00:31 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 181 KB
60 KB 29ms
26ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

49d1ffb246bfc28d97c64df45b43df0d98dfbe1310f1e7dbe911eabb2a7bdb83

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61549
x-xss-protection: 0
last-modified: Mon, 15 Mar 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 15 Mar 2021 16:00:34 GMT

GET
H2 200 wp-emoji-release.min.js Show response
cofense.com/wp-includes/js/ 14 KB
5 KB 160ms
159ms Script
application/javascript 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-includes/js/wp-emoji-release.min.js?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c

Request headers

Referer: https://cofense.com/blog/autohotkey-banking-trojan/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: br
last-modified: Fri, 12 Mar 2021 16:58:15 GMT
server: nginx
etag: W/"604b9da7-3795"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 lottie.min.js Show response
cdnjs.cloudflare.com/ajax/libs/bodymovin/5.7.4/ 256 KB
54 KB 16ms
15ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/bodymovin/5.7.4/lottie.min.js

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e27b9cf011c3d5b006906bed6b2b64fbf0b82b2d4821f21dfdf00291c8c07be

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Origin: https://cofense.com
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:31 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"max_age":604800,"report_to":"cf-nel"}
age: 1017220
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 54959
cf-request-id: 08d83728850000d6b10b03f000000001
timing-allow-origin: *
last-modified: Mon, 02 Nov 2020 04:51:20 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f9f9048-3ff8d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=CU7uAG5LMDElGhqKano2U1g8L8Lm6Rvyjwa9K5m%2FDEtvIyG6p34vkWU2bB6C%2FQZ9ibumf2ADNb0EGtm6t8xNMfdYKOVaG%2BhyuRv7Eq0shOcXQW2oTa%2Bz86lW3FdJBT2Tzg%3D%3D"}],"max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6306f487388ed6b1-FRA
expires: Sat, 05 Mar 2022 16:00:31 GMT

GET
H2 200 iubenda_cons.js Show response
cdn.iubenda.com/cons/ 228 B
495 B 101ms
33ms Script
application/javascript 2.17.181.202
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.iubenda.com/cons/iubenda_cons.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.181.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-17-181-202.deploy.static.akamaitechnologies.com
Software: nginx/1.19.1 /
Resource Hash: 19b00d994015088ded16ddd49891ade9c288232431be63c161f5c411e4666121

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
last-modified: Thu, 11 Mar 2021 19:27:05 GMT
server: nginx/1.19.1
etag: "604a6f09-d6"
vary: Accept-Encoding
p3p: CP="DSP NOI COR", policyref="http://www.iubenda.com/w3c/p3p.xml"
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, max-age=10800
content-type: application/javascript
content-length: 214
expires: Mon, 15 Mar 2021 19:00:34 GMT

GET
H2 200 iubenda_cs.js Show response
cdn.iubenda.com/cs/ 470 B
631 B 90ms
33ms Script
application/javascript 2.17.181.202
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.iubenda.com/cs/iubenda_cs.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.181.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-17-181-202.deploy.static.akamaitechnologies.com
Software: nginx/1.19.1 /
Resource Hash: 3f0489789316418cf97a21654f8d1ffb3a73785a667c9c4db11c87e31cec1edf

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
last-modified: Thu, 11 Mar 2021 19:27:10 GMT
server: nginx/1.19.1
etag: "604a6f0e-15d"
vary: Accept-Encoding
p3p: CP="DSP NOI COR", policyref="http://www.iubenda.com/w3c/p3p.xml"
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, max-age=10800
content-type: application/javascript
content-length: 349
expires: Mon, 15 Mar 2021 19:00:34 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 99 KB
39 KB 43ms
27ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1061448384

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

caf646015e4d83c41c832b2f6bb4c79584265cb057b1a341f6ad752a1777fb61

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39795
x-xss-protection: 0
last-modified: Mon, 15 Mar 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 15 Mar 2021 16:00:34 GMT

GET
H2 200 cofense-logo.svg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/ 3 KB
1 KB 33ms
32ms Image
image/svg+xml 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/cofense-logo.svg
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: ca57cc407c7eefa8e3901cc501b0988fdefbea8a5c2043cf9178dacbd4c197f9

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:22 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e26-b20"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 cofense-cbfree.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 3 KB
3 KB 32ms
31ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-cbfree.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 2cf13ef8a0e548d45203297ecc6e21ad5f82fe24e759acbf9a9600996aa4528c

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Fri, 12 Mar 2021 16:59:22 GMT
server: NetDNA-cache/2.2
etag: "604b9dea-c2a"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3114

GET
H2 200 cofense-lms.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 3 KB
3 KB 32ms
31ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-lms.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 102f598e077a43ea681594e0750b0e835960f288bada922fff4107785b3c7e31

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Fri, 12 Mar 2021 16:59:22 GMT
server: NetDNA-cache/2.2
etag: "604b9dea-cd3"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3283

GET
H2 200 cofense-reporter.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 3 KB
3 KB 33ms
32ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-reporter.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: f6fa548f3755570ef254a6b934091fcd2634717a57060511fd414a704e7dc95c

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Fri, 12 Mar 2021 16:59:22 GMT
server: NetDNA-cache/2.2
etag: "604b9dea-b2e"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2862

GET
H2 200 cofense-pds.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 4 KB
4 KB 33ms
32ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-pds.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: f498997e7a39cb345fb129f9158745de59167f8aee78cc573554bd2f5dbc92c7

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Fri, 12 Mar 2021 16:59:22 GMT
server: NetDNA-cache/2.2
etag: "604b9dea-ff4"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 4084

GET
H2 200 cofense-triage.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 3 KB
3 KB 32ms
32ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-triage.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 12a5ec5674ef088f8c198091b7eb6d0478cf5aae6465c09634abae505332d149

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Fri, 12 Mar 2021 16:59:22 GMT
server: NetDNA-cache/2.2
etag: "604b9dea-c04"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3076

GET
H2 200 cofense-vision.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 3 KB
3 KB 33ms
32ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-vision.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 1a71c8fe9799162a1bbb1faf1f7e60c7db8e90eb15779a9b6b1bf4e0812890f3

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Fri, 12 Mar 2021 16:59:22 GMT
server: NetDNA-cache/2.2
etag: "604b9dea-ad5"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2773

GET
H2 200 cofense-intelligence.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 3 KB
3 KB 32ms
32ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-intelligence.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 7fd52abcc46a46e1d1f39cf3677e2a581b4365872258b5fbc5e28eb183fb6410

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Fri, 12 Mar 2021 16:59:22 GMT
server: NetDNA-cache/2.2
etag: "604b9dea-c34"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3124

GET
H2 200 cofense-livefeed.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 5 KB
5 KB 33ms
32ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-livefeed.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 201ac106aa78dbaf7062e570803b878ae8d4e909608bc19dc77bdfdc39fe85d0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Fri, 12 Mar 2021 16:59:22 GMT
server: NetDNA-cache/2.2
etag: "604b9dea-12ad"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 4781

GET
H2 200 virus-01.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/03/ 6 KB
7 KB 33ms
32ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/03/virus-01.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: d2dcdaca89cc8422fd1d1ab405630bd6a5e6dd4adebe8723a11ed050a60461c4

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Fri, 12 Mar 2021 16:58:54 GMT
server: NetDNA-cache/2.2
etag: "604b9dce-198b"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 6539

GET
H2 200 wfh-01.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/04/ 4 KB
5 KB 34ms
33ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/04/wfh-01.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: f4f38c2e3b869558658a4303d42a3a0fc5f81ad2e72517be88f22da35c617b6f

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Fri, 12 Mar 2021 16:58:46 GMT
server: NetDNA-cache/2.2
etag: "604b9dc6-111d"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 4381

GET
H2 200 cofense-threat_education.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 4 KB
4 KB 33ms
32ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-threat_education.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: dc83f496595b1d3b55fd6aeae76471a9d89284e1026849b5ab805bc3e8116739

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Fri, 12 Mar 2021 16:59:22 GMT
server: NetDNA-cache/2.2
etag: "604b9dea-e51"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3665

GET
H2 200 phishing-threats-db.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/06/ 5 KB
5 KB 37ms
34ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/06/phishing-threats-db.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: fdf1d02d0e923da1e187476e11f688c61482e25abba482b857674fbb3d79ef45

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Fri, 12 Mar 2021 16:58:39 GMT
server: NetDNA-cache/2.2
etag: "604b9dbf-1469"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 5225

GET
H2 200 cofense-cloud_seeker.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 4 KB
5 KB 37ms
34ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-cloud_seeker.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: fde4dd0ab5add3a76f91f880c510718310cdf21d8fed6e65b5bd0a624a02ea69

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Fri, 12 Mar 2021 16:59:22 GMT
server: NetDNA-cache/2.2
etag: "604b9dea-1166"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 4454

GET
H2 200 facebook.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2017/03/ 666 B
892 B 36ms
33ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2017/03/facebook.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 53fe7d6860d0d3d09f82e41a1d1db6d7bc302b662a7e0bdb096f27b5cbda40ea

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Fri, 12 Mar 2021 16:59:57 GMT
server: NetDNA-cache/2.2
etag: "604b9e0d-29a"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 666

GET
H2 200 linkedin.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2017/03/ 723 B
949 B 36ms
33ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2017/03/linkedin.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 0f0a82edad8aa60a62ae9ee4816366b69c8212b1068f6ecbf7da97f6796a8056

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Fri, 12 Mar 2021 16:59:58 GMT
server: NetDNA-cache/2.2
etag: "604b9e0e-2d3"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 723

GET
H2 200 twitter.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2017/03/ 809 B
1 KB 36ms
33ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2017/03/twitter.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 5a6b2f0487eee2503a9443992282db18bd97997f71570e34fb5b07a79c9cfccd

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Fri, 12 Mar 2021 16:59:58 GMT
server: NetDNA-cache/2.2
etag: "604b9e0e-329"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 809

GET
H2 200 free-access-blog.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/05/ 95 KB
96 KB 34ms
33ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/05/free-access-blog.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: d288049bf9a317db1fbbdfdde0dc4cb599d1abf49546be6a57c8d8fa1b9488b5

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Fri, 12 Mar 2021 16:58:44 GMT
server: NetDNA-cache/2.2
etag: "604b9dc4-17d95"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 97685

GET
H2 200 infobox.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/ 2 KB
846 B 34ms
31ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/infobox.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: e0377c505a7d560f42802298baa2f3aacb7903203ab235af12a055c558f9ba19

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:33 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:29 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e2d-821"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.form.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/jquery/ 16 KB
6 KB 32ms
32ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/jquery/jquery.form.min.js?ver=4.2.1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: f5bda9607a2d871842fd3ff6807d30f35b336a9cebdea43f5a9820851b66c4a3

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:33 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 16:58:15 GMT
server: NetDNA-cache/2.2
etag: W/"604b9da7-3e97"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.t-countdown.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/jquery-t-countdown-widget/js/ 9 KB
3 KB 34ms
33ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/jquery-t-countdown-widget/js/jquery.t-countdown.js?ver=2.4.0
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: a6dcb2582661566fdc1517014d9eea855588c2a8409067eca719b8bb1da475dc

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:30 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e2e-23d2"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 wow.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/ 8 KB
3 KB 41ms
30ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/wow.min.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: cfa1739ee346d63a3d3cfdff8c18cbe8fdedbcb32d4b0895028c193ce828e7a5

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:31 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e2f-1ff6"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 modules.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/ 121 KB
35 KB 46ms
36ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/modules.min.js?ver=1.1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 8b950c87c8fcca9e5a47bbe6143f7a2df9a783faf9a11b07559d35a7adddb504

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:32 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e30-1e4e2"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 owl.carousel.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/libs/owl-carousel/ 38 KB
9 KB 49ms
39ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/libs/owl-carousel/owl.carousel.js?ver=1.0
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: e13c8733b82140ef6edef5f6ce96c0387419b93dd9b73fab8807a43a09d1fd73

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:23 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e27-99c8"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.sticky.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/ 10 KB
3 KB 49ms
40ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/jquery.sticky.js?ver=30
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: bcf6b9b28cec8958f9d3f3ee39070e85ffd46d670f1f0baa7cd21aa24c188a00

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:22 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e26-2765"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 custom.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/ 14 KB
4 KB 50ms
40ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/custom.js?ver=1615568422
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 1b889b5222373b8a0485f3fb325564e3b2b017a6cbb518d12a045a407d1eca83

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:22 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e26-3802"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 theme-scripts.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/ 139 KB
39 KB 38ms
37ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/theme-scripts.js?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 5c722519d5b20bb22f0453889d36e0ba6ce9bd967d93fbbe7a9682d31cf31be5

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:23 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e27-22de9"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 select2.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/vendor/ 66 KB
19 KB 35ms
34ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/vendor/select2.min.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: d7dd05bfc68901dbb2c883a7bd65698c29b3917d61f0e12d1966dca14d5056c0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:22 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e26-10964"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.waypoints.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/vendor/ 9 KB
3 KB 32ms
32ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/vendor/jquery.waypoints.min.js?ver=3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 368daab67b1a5b2b2802edbbac79a2aa4ba992a2ebf9c67b98ad784d8004018c

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:22 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e26-2344"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 sticky.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/vendor/ 1 KB
829 B 32ms
31ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/vendor/sticky.min.js?ver=3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 14c52b4f1daa1aa3a92d960a311d4518da07e80b7b1a443d3f1a55c0968c99a0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:22 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e26-4db"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 comment-reply.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/ 3 KB
2 KB 33ms
32ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/comment-reply.min.js?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: ab21fef3ac4ee12ebb305942f85de99b290b8a24654c69060e54673d5f3a11f2

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 16:58:15 GMT
server: NetDNA-cache/2.2
etag: W/"604b9da7-ba6"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 wp-embed.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/ 1 KB
1016 B 33ms
32ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/wp-embed.min.js?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 16:58:15 GMT
server: NetDNA-cache/2.2
etag: W/"604b9da7-592"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 js_composer_front.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/js_composer/assets/js/dist/ 18 KB
6 KB 32ms
32ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/js_composer/assets/js/dist/js_composer_front.min.js?ver=5.1.1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 8d9a46db80c58e316c5594342e8e62bb792d4706ae90d02e4af8a03218335117

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:30 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e2e-49dc"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.modal.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/ 5 KB
2 KB 21ms
13ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/jquery.modal.min.js

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a7e8ed2d7bbdbcaeeee81c3433f057d64a32c000112bbd09b5969fc658d0a655

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1620606
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1399
cf-request-id: 08d83730db0000c2fea8975000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:46 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec2-1359"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Kf3kZ3hPqVHT8X5uAK274wu4INhbbExyxMaA%2FNLCvXSMcZTg3Avq%2BsXRXOFIWxlJFodvq4Bpf5v8txmmhsdBYVY%2Btj98RBcN6SjlyEouyZEFKJakc1fjDvewD%2Ftdr70lcg%3D%3D"}],"max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6306f4949877c2fe-FRA
expires: Sat, 05 Mar 2022 16:00:34 GMT

GET
H2 200 jquery.modal.min.css
cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/ 3 KB
2 KB 23ms
15ms Stylesheet
text/css 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/jquery.modal.min.css

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eaa593bcfe485f4b5a8ac997cf9936604f9fbef91652db94a8e22b75d612bfc1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 381450
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1541
cf-request-id: 08d83730db0000c2feba361000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:46 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec2-c81"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=iAL9IbS3zTlbrV7uxx9KhwV9zbJ9yt%2BLlAdtS%2BXDAE46seXHgo35Mj3uzA2dgxCBTqD33B5nZjCSG4oGtXorKu8tXwkWNaIt4WsUSVQzQwKmWWAi3%2Bve6bNvLuviEaNfaQ%3D%3D"}],"max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6306f4949878c2fe-FRA
expires: Sat, 05 Mar 2022 16:00:34 GMT

GET
H2 200 forms2.min.js Show response
app-ab46.marketo.com/js/forms2/js/ 204 KB
68 KB 461ms
313ms Script
application/x-javascript 104.16.94.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-ab46.marketo.com/js/forms2/js/forms2.min.js

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.94.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

014de295141a456ceda8e3c4762085e53dca50f91ddf65906d227f70cf0b1a55

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: EXPIRED
last-modified: Sat, 16 Jan 2021 05:25:05 GMT
server: cloudflare
etag: "27211e7-33187-5b8fdb621b553"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 6306f4958ae77357-CPH
cf-request-id: 08d8373171000073578f0dc000000001
expires: Mon, 15 Mar 2021 20:00:34 GMT

GET
H2 200 1Ptug8zYS_SKggPNyC0ITw.woff2
fonts.gstatic.com/s/raleway/v19/ 46 KB
46 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v19/1Ptug8zYS_SKggPNyC0ITw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700&ver=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1824e38c8fe9b23fb54ed5deafd63f31fcceed673d89111bebc8f05d1aa7b126

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 08 Mar 2021 18:26:50 GMT
x-content-type-options: nosniff
last-modified: Thu, 28 Jan 2021 22:37:32 GMT
server: sffe
age: 596023
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47272
x-xss-protection: 0
expires: Tue, 08 Mar 2022 18:26:50 GMT

GET
H2 200 28krvx2uf9n3.js Show response
js.driftt.com/include/1615824300000/ 205 KB
59 KB 279ms
183ms Script
application/javascript 65.9.58.125
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1615824300000/28krvx2uf9n3.js

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.58.125 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

5abeb1ce56d0537be73f02849471e39b01338e6d410327b3e0b9eac492e99874

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: WG8ZMdWExev_JSAIS4EJEVK62SGBDgpf
via: 1.1 38263cd2a79bbfbde38589f8589f28be.cloudfront.net (CloudFront), 1.1 fdd677a35b242f0199586a71e2f6859f.cloudfront.net (CloudFront)
etag: W/"7d3b4f96cd84c236f122b8f87c3c0d24"
x-amz-cf-pop: IAD66-C1, FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Mon, 15 Mar 2021 14:53:13 GMT
server: nginx
date: Mon, 15 Mar 2021 16:00:34 GMT
vary: Accept-Encoding,Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=10
access-control-allow-credentials: true, true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type, DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 4_RBwAK53IIbl9P5JlcLBjtzWWpdIy6KIzJXLTT_zocnuztCRyApGQ==

GET
DATA 200
OK truncated
/ 122 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3ca275e3abc25d28d1687290d7022fbdc1dbc65897a57edf625612becc7cd4cd

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 86 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c346378eecdbc49f1af4027e1782ccfcf6daed7c02125d0c3efa715ae8273157

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 40 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f0cd273dd31151f7c238927161bba7c45f7a62a762c33b179b69c8a44205825a

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 108 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dff95065f38a434e84c6e9cfff039fc30f6981fc1b91f139fd6bace0dfe7ca61

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 397 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: decb22061966d60e11818d21d2ac0a8886bf6908c98c9f3253546fc7697fbfc5

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 15 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 026c031ea4bf0b31b0819e6576940574507c6293d8dc6c8200363b54ac7030a8

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 105 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c55c8751dbcb177cef9a5fd0b35d7bc18237574724c5e27432da0d857d0b0a49

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 99 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d53d2be00a4528f66c74e090ff517d270fef7a9698d462ea122a1c58c75259a5

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 56 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dabbb72e22cb1b6b46076eb52af87040bc18bcc082060fc20a86250896da0414

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 79 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 98e89f927a0dd5f4fcb92a9f4a08b7d3ba87d95f4964fc0a213cfbf31029d5bc

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 174 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 734976c4bb5a252fb49c7380c9b1dca1d36d2c14462716ab6c5f5a732637c82a

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 11 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5430d6fe02af3c64feb8afbc260c7aceb1204fa869aa422f421f7d921dd382ea

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 112 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e6f24078660b09ece82cb18154ca70658e05e25be808029dd09c22668676a7fd

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 43 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: af71da6e0b8871d0806f440e932cb3b99706330fa4306e8becc7cbf2c7860c4d

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 66 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1d355d2a4e8ff0e3eba6acd9b35c7972985fa371cbff6b3ba72d9735e04c057b

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 61 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0f73cdb5b4ff4fc3339c1d8ddcdf35ea878691e8c33a0a299676f2b0352bb8e7

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 58 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 938fefbc4f39e13fa1d382e19d72864b406f82f201df9d0376910adf439db117

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 96 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6b251fb950a81e0947386320b408ba05a9cd60ef73329331502aa4adfb171e37

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 nav-arrow.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/ 3 KB
3 KB 36ms
35ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/nav-arrow.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1615568423
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: a05ce29b1660d2755713106d272474ec04a2524269517b23603f325230d2d4c9

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1615568423
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Fri, 12 Mar 2021 17:00:22 GMT
server: NetDNA-cache/2.2
etag: "604b9e26-b8d"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2957

GET
H2 200 icn-nav-search@2x.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/ 1 KB
1 KB 33ms
32ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/icn-nav-search@2x.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1615568423
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 21110fa48987dc5804b08b84e1008e7c922f7b028c6291c64a6845fbb868014f

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1615568423
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Fri, 12 Mar 2021 17:00:22 GMT
server: NetDNA-cache/2.2
etag: "604b9e26-514"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 1300

GET
H2 200 b-g.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/ 840 KB
841 KB 33ms
33ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/b-g.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1615568423
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 8c3f327cab31c3d02e5bf8d08bac753e210f1f12588a1197226bccff955a0df9

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1615568423
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Fri, 12 Mar 2021 17:00:28 GMT
server: NetDNA-cache/2.2
etag: "604b9e2c-d20af"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 860335

GET
H2 200 twitter_social_tile_A2_1200_628-510x240.jpg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2021/01/ 31 KB
31 KB 54ms
53ms Image
image/jpeg 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2021/01/twitter_social_tile_A2_1200_628-510x240.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: b485b0babd7fec066e4763f2cfd2beee9fa94df2358fa9b46da7f6d47281178e

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Fri, 12 Mar 2021 16:58:24 GMT
server: NetDNA-cache/2.2
etag: "604b9db0-7b63"
vary: Accept-Encoding
x-cache: HIT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 31587

GET
H2 200 footer-graphic.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2016/07/ 4 KB
4 KB 35ms
31ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2016/07/footer-graphic.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.6.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: b4c873f99c6d9811d0b8663a59007825e1dd511a54336f08bac1df3a80a3fe29

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.6.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Fri, 12 Mar 2021 17:00:04 GMT
server: NetDNA-cache/2.2
etag: "604b9e14-e4e"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3662

GET
H2 200 footer-graphic-b.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2016/07/ 212 B
438 B 36ms
32ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2016/07/footer-graphic-b.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.6.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 88b758789019407fc4c2461c0d188aa776cb4b72d759e3c670b73d68fabf383a

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.6.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Fri, 12 Mar 2021 17:00:04 GMT
server: NetDNA-cache/2.2
etag: "604b9e14-d4"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 212

GET
H2 200 footer-graphic-a.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2016/07/ 107 B
333 B 34ms
32ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2016/07/footer-graphic-a.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.6.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 0b0200866fae3fcc0c3f1acf6d8dc18fb93ce8b7a55cc7fbc31b231b01764ddb

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.6.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Fri, 12 Mar 2021 17:00:04 GMT
server: NetDNA-cache/2.2
etag: "604b9e14-6b"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 107

GET
H2 200 fa-solid-900.woff2
use.fontawesome.com/releases/v5.13.0/webfonts/ 78 KB
78 KB 531ms
43ms Font
font/woff2 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.13.0/webfonts/fa-solid-900.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.13.0/css/all.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 7f4d3fd0a705dbf8403298aad91d5de6972e6b5d536068eba8b24954a5a0a8c7

Request headers

Origin: https://cofense.com
Referer: https://use.fontawesome.com/releases/v5.13.0/css/all.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Mon, 23 Mar 2020 16:08:17 GMT
server: NetDNA-cache/2.2
etag: "b15db15f746f29ffa02638cb455b8ec0"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT
accept-ranges: bytes
content-length: 79444

GET
H3-Q050 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v20/ 16 KB
16 KB 10ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.6.2

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

24369e1b2461af9dcefecaf9cc93d64cf22a4c5bac32506100b9e21014507bcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 08 Mar 2021 18:27:39 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:37 GMT
server: sffe
age: 595975
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15872
x-xss-protection: 0
expires: Tue, 08 Mar 2022 18:27:39 GMT

GET
H2 200 fa-brands-400.woff2
use.fontawesome.com/releases/v5.13.0/webfonts/ 75 KB
75 KB 579ms
94ms Font
font/woff2 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.13.0/webfonts/fa-brands-400.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.13.0/css/all.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 5d9190292acdd48ba0fc35080f7e7448f3cdf0d79199a4d23f0f49b5341fdf29

Request headers

Origin: https://cofense.com
Referer: https://use.fontawesome.com/releases/v5.13.0/css/all.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Mon, 23 Mar 2020 16:10:04 GMT
server: NetDNA-cache/2.2
etag: "a06da7f0950f9dd366fc9db9d56d618a"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT
accept-ranges: bytes
content-length: 76612

GET
H3-Q050 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v20/ 15 KB
15 KB 9ms
7ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 08 Mar 2021 18:51:47 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:36 GMT
server: sffe
age: 594527
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15736
x-xss-protection: 0
expires: Tue, 08 Mar 2022 18:51:47 GMT

GET
H3-Q050 200 KFOkCnqEu92Fr1MmgVxIIzI.woff2
fonts.gstatic.com/s/roboto/v20/ 15 KB
16 KB 12ms
10ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOkCnqEu92Fr1MmgVxIIzI.woff2

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

12823d585605238121554aff8bb060a235dc36f37efd9fb1e7e6ea1a9622bc35

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 08 Mar 2021 18:09:19 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:34 GMT
server: sffe
age: 597075
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15808
x-xss-protection: 0
expires: Tue, 08 Mar 2022 18:09:19 GMT

GET
H3-Q050 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v20/ 15 KB
16 KB 11ms
9ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29f6da0a8c21c5681511bb9b08663d3fd2c5d09c9bd8054ec354c563b8c8b7c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 10 Mar 2021 22:41:50 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:55 GMT
server: sffe
age: 407924
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15784
x-xss-protection: 0
expires: Thu, 10 Mar 2022 22:41:50 GMT

GET
H3-Q050 200 KFOjCnqEu92Fr1Mu51TzBic6CsQ.woff2
fonts.gstatic.com/s/roboto/v20/ 17 KB
17 KB 14ms
12ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOjCnqEu92Fr1Mu51TzBic6CsQ.woff2

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5cc2e47701ee7dc9e0ba16303e170db0fcb2df2989b7763ac705893d37b4e237

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 11 Mar 2021 09:24:15 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:19:12 GMT
server: sffe
age: 369379
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17020
x-xss-protection: 0
expires: Fri, 11 Mar 2022 09:24:15 GMT

GET
H3-Q050 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v20/ 15 KB
16 KB 12ms
10ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b4d07892cde715d50bb69c1982df496385d1dfd8f9d1867c31f19a3c8634cfae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 10 Mar 2021 19:52:31 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:19:00 GMT
server: sffe
age: 418083
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15816
x-xss-protection: 0
expires: Thu, 10 Mar 2022 19:52:31 GMT

GET
H2 200 ssb-icon.ttf
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/simple-social-buttons/assets/fonts/ 6 KB
4 KB 105ms
32ms Font
application/octet-stream 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/simple-social-buttons/assets/fonts/ssb-icon.ttf?eahqa2
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/simple-social-buttons/assets/css/front.css?ver=3.2.1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 65effed019c96df30638340081f21c1fe64e87f1230ddb0d48e2e8b763dbd131

Request headers

Origin: https://cofense.com
Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/simple-social-buttons/assets/css/front.css?ver=3.2.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:00:26 GMT
server: NetDNA-cache/2.2
etag: W/"604b9e2a-17f8"
vary: Accept-Encoding
x-cache: HIT
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H3-Q050 200 KFOjCnqEu92Fr1Mu51TjASc6CsQ.woff2
fonts.gstatic.com/s/roboto/v20/ 17 KB
17 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOjCnqEu92Fr1Mu51TjASc6CsQ.woff2

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9e02524ebecd813fc4bcb40336bb2b033871b1fdcbd234229dee4189dc44850d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 08 Mar 2021 18:39:10 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:37 GMT
server: sffe
age: 595284
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17448
x-xss-protection: 0
expires: Tue, 08 Mar 2022 18:39:10 GMT

GET
H2 200 main.js Show response
m9m6e2w5.stackpathcdn.com/v2/9eb2c00f/ 151 KB
44 KB 94ms
35ms Script
application/javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://m9m6e2w5.stackpathcdn.com/v2/9eb2c00f/main.js
Requested by: Host: dsms0mj1bbhn4.cloudfront.net
URL: https://dsms0mj1bbhn4.cloudfront.net/assets/pub/shareaholic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 37c44613f0abf20e665fe6ee9c920f61abb65bf4d6c4f45327e465959806ff29

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
last-modified: Tue, 09 Mar 2021 22:06:45 GMT
server: nginx
x-amz-request-id: TNQQGV063ECRDJJ2
etag: "f7fcf32c4547f9980ce9a445f236d915"
x-hw: 1615824034.cds069.sk1.hn,1615824034.cds039.sk1.c
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000, public
x-hello-human: Join the fun! Apply at www.shareaholic.com/jobs
accept-ranges: bytes
content-length: 44551
x-amz-id-2: 9ny/1R72hWE+IMxSIvRXykzqQ+mufgkL6V/POQhXbFyBSSV4v9OAZRYaqUpAGUPd/wKnNdHbj0E=

GET
H2 200 core-d2a24f1d20d2043482758bef114eb219.js Show response
cdn.iubenda.com/cons/iubenda_cons/ 21 KB
7 KB 32ms
31ms Script
application/javascript 2.17.181.202
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.iubenda.com/cons/iubenda_cons/core-d2a24f1d20d2043482758bef114eb219.js
Requested by: Host: cdn.iubenda.com
URL: https://cdn.iubenda.com/cons/iubenda_cons.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.181.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-17-181-202.deploy.static.akamaitechnologies.com
Software: nginx/1.19.1 /
Resource Hash: 523b4316eb8e2bcdd2df9f714e53bae45c0e13fe9cd1e6d7de09ee1f2f5ddf37

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
last-modified: Thu, 11 Mar 2021 19:27:05 GMT
server: nginx/1.19.1
etag: "604a6f09-1b74"
vary: Accept-Encoding
p3p: CP="DSP NOI COR", policyref="http://www.iubenda.com/w3c/p3p.xml"
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, max-age=31536000
content-type: application/javascript
content-length: 7028
expires: Tue, 15 Mar 2022 16:00:34 GMT

GET
H2 200 core-d053bf0c05bb347ae5bf169b877657a0.js Show response
cdn.iubenda.com/cookie_solution/iubenda_cs/ 615 KB
125 KB 35ms
35ms Script
application/javascript 2.17.181.202
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.iubenda.com/cookie_solution/iubenda_cs/core-d053bf0c05bb347ae5bf169b877657a0.js
Requested by: Host: cdn.iubenda.com
URL: https://cdn.iubenda.com/cs/iubenda_cs.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.181.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-17-181-202.deploy.static.akamaitechnologies.com
Software: nginx/1.19.1 /
Resource Hash: ff7382ee12375febef437bf18fe87fa40296eadb21853c0bf221de4fdceecd73

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
last-modified: Thu, 11 Mar 2021 19:27:05 GMT
server: nginx/1.19.1
etag: "604a6f09-1f03c"
vary: Accept-Encoding
p3p: CP="DSP NOI COR", policyref="http://www.iubenda.com/w3c/p3p.xml"
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, max-age=31536000
content-type: application/javascript
content-length: 127036
expires: Tue, 15 Mar 2022 16:00:34 GMT

GET
H2 200 62df9f201cc7c19a56912daae814efca.json Show response
www.shareaholic.net/config/ 11 KB
2 KB 342ms
116ms XHR
application/json 184.73.100.94
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://www.shareaholic.net/config/62df9f201cc7c19a56912daae814efca.json
Requested by: Host: dsms0mj1bbhn4.cloudfront.net
URL: https://dsms0mj1bbhn4.cloudfront.net/assets/pub/shareaholic.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.73.100.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-184-73-100-94.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b64e92c54cf8815d6fff0a70489dc30b8e5dae68c639c28b79df2ce8f2af9229

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-client-geo-country: DK,Denmark
date: Sun, 14 Mar 2021 23:51:27 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
content-length: 1672
server: nginx
x-client-geo-region: 84,Capital Region
x-client-geo-metrocode
etag: W/"b64e92c54cf8815d6fff0a70489dc30b"
access-control-max-age: 2000
x-client-geo-city: Copenhagen
x-varnish: 87779573 69034718
via: 1.1 varnish (Varnish/6.0)
access-control-expose-headers: Etag, Access-Control-Allow-Origin, x-client-geo-latlong, x-client-geo-country, x-client-geo-city, x-client-geo-zip, x-client-geo-region, x-client-geo-metrocode
cache-control: max-age=3, public, must-revalidate
x-client-geo-zip: 2750
accept-ranges: bytes
content-type: application/json
access-control-allow-headers: *
x-client-geo-latlong: 55.732700,12.365600

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 138 KB
53 KB 29ms
28ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-0HTW6C6HJS&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

eea083b30a2be9a04bacbdd23fb38922b0ef3f861790dc055c8c14604e21ffd9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54113
x-xss-protection: 0
expires: Mon, 15 Mar 2021 16:00:34 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 46 KB
19 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 05 Feb 2021 21:33:27 GMT
server: Golfe2
age: 1929
date: Mon, 15 Mar 2021 15:28:25 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18980
expires: Mon, 15 Mar 2021 17:28:25 GMT

GET
H2 200 hotjar-1312741.js Show response
static.hotjar.com/c/ 9 KB
2 KB 107ms
35ms Script
application/javascript 13.226.159.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-1312741.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.79 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-79.dus51.r.cloudfront.net

Software

Resource Hash

40edb045b0a503756f56b4b5cbded5795d314ba4fc386d19cf514b72d90e6438

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:00 GMT
content-encoding: br
x-content-type-options: nosniff
cache-control: max-age=60
age: 34
etag: W/1874f1430a73b4fea422d88836988c58
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
access-control-allow-origin: *
x-cache-hit: 1
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: 19IUhxquZXTMMTxcPbv2S3YiEZDV2kp0uL1EAMjKLOvqnFenhhhuQw==
via: 1.1 5cd60f530cdafe284762767565aa2747.cloudfront.net (CloudFront)

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 4 KB
2 KB 10ms
10ms Script
application/x-javascript 2a02:26f0:2100:1a6::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2100:1a6::25ea Munich, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 5f3b103a1268f862a5e432d607f8e5220dea9d301d13565b0ecded3ad9c25ab2

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 15 Mar 2021 16:00:34 GMT
Content-Encoding: gzip
Last-Modified: Mon, 04 Jan 2021 22:14:03 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=16607
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1855

GET
H2 200 sf14g.js Show response
t.sf14g.com/ 36 KB
36 KB 444ms
208ms Script
application/javascript 52.44.242.176
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://t.sf14g.com/sf14g.js

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.44.242.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-44-242-176.compute-1.amazonaws.com

Software

Kestrel /

Resource Hash

6b171db7ca7ffee17e14f5d432d37e4ec87d6e7a5ce361670e329f705ee34364

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 Mar 2021 16:00:34 GMT
last-modified: Tue, 09 Feb 2021 15:39:01 GMT
server: Kestrel
etag: "1d6fef9b02c88cc"
strict-transport-security: max-age=2592000
content-type: application/javascript
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 36940
expires: -1

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 97ms
31ms Script
application/javascript 199.232.136.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.136.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4cf52cc73734aa71f26f6a10be9aeec89602af45bf0f9abd5c8445a076c1ae1a

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
via: 1.1 varnish
last-modified: Fri, 04 Dec 2020 00:21:46 GMT
age: 54561
etag: "cbc512946c8abb461c6215ed5b454e5f+gzip"
vary: Accept-Encoding,Host
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-encoding: gzip
cache-control: no-cache
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 1957
x-timer: S1615824035.600703,VS0,VE0
x-served-by: cache-hhn11520-HHN

GET
H2 200 2Uq3HoQoVZEHgHXXf288 Show response
ws.zoominfo.com/pixel/ 0
427 B 213ms
212ms Script
text/javascript 2606:4700::6810:650c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/2Uq3HoQoVZEHgHXXf288

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:650c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 6306f497c88a2bd2-FRA
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for
content-length: 0
cf-request-id: 08d83732d900002bd264be3000000001

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 95ms
31ms Script
application/x-javascript 88.221.60.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 88.221.60.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-60-75.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 15 Mar 2021 16:00:34 GMT
Content-Encoding: gzip
Last-Modified: Wed, 05 Aug 2020 03:11:00 GMT
Server: AkamaiNetStorage
ETag: "a67ed8ce0a86706b9f73a86806ce5bd3:1596597060.25158"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 752

GET
H2 200 getForm Show response
app-ab46.marketo.com/index.php/form/ 24 KB
6 KB 348ms
347ms Script
application/javascript 104.16.94.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app-ab46.marketo.com/index.php/form/getForm?munchkinId=404-JHU-612&form=1378&url=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&callback=jQuery112408161806591558627_1615824034544&_=1615824034545
Requested by: Host: app-ab46.marketo.com
URL: https://app-ab46.marketo.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.94.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f44f1645b4369ec43dcdba43b912942c0cca14392a473fbdcdbae7be9d8007c1

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cf-request-id: 08d837331b0000735720055000000001
content-encoding: gzip
server: cloudflare
date: Mon, 15 Mar 2021 16:00:34 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 6306f49829167357-CPH
cached: true

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ 40 KB
13 KB 147ms
51ms Script
text/javascript 84.53.188.140
AKAMAI-LON

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 84.53.188.140 , Netherlands, ASN34164 (AKAMAI-LON, NL),
Reverse DNS: a84-53-188-140.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: b643399710767e220dd2e5da8ae4ea284d8b7f1e936b50d77c2512d68d62ae98

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: fgXI26IrIZf8LtoJMxFjWtVYRTnCfec3
Content-Encoding: gzip
ETag: "7e768526e99ea17eed6db5f16c57a98f"
x-amz-request-id: 8CDBC8B21B37A7F3
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 12681
x-amz-id-2: LskamZWC4LNbo7PxzYhXLlVqO2Tm7hPmxoPZyHBoD6VHOPWNFlGocVzk6NnFR8HjLL70NqiPKn4=
Last-Modified: Tue, 23 Feb 2021 18:19:36 GMT
Server: AmazonS3
Date: Mon, 15 Mar 2021 16:00:34 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1615824034639&url=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D300721%26time%3D1615824034639%26url%3Dhttps%253A%252F%252Fcofense.com%252Fblog%25...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1615824034639&url=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&liSync=true

0
57 B

189ms
188ms

Image
application/javascript

2620:119:50e1:101::6cae:b25
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1615824034639&url=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&liSync=true
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:119:50e1:101::6cae:b25 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:35 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
x-li-proto: http/2
x-li-pop: prod-esv5
content-type: application/javascript
content-length: 0
x-li-uuid: 6xEyP2aPbBZAfJmuGSsAAA==

Redirect headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
linkedin-action: 1
content-length: 0
x-li-uuid: +DtPM2aPbBaQJ4azzyoAAA==
pragma: no-cache
x-li-pop: afd-prod-lor1
x-msedge-ref: Ref A: FB492319D1E844F2AE7C023117FBB1C2 Ref B: FRAEDGE1108 Ref C: 2021-03-15T16:00:35Z
date: Mon, 15 Mar 2021 16:00:34 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
x-frame-options: sameorigin
x-li-fabric: prod-lor1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1615824034639&url=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&liSync=true
cache-control: no-cache, no-store
content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-Q050 200 js Show response
www.google-analytics.com/gtm/ 97 KB
36 KB 21ms
20ms Script
application/javascript 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=OPT-K29SPQM&t=gtm2&cid=1639249986.1615824035&aip=true

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f80797422711c42dc269bd69c05123d535e1af0b1a6d06f85f560d53cdf2c238

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36923
x-xss-protection: 0
expires: Mon, 15 Mar 2021 16:00:34 GMT

POST
H2 200 e
analytics.shareaholic.com/ 43 B
377 B 334ms
111ms Other
image/gif 54.147.47.240
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.shareaholic.com/e

Requested by

Host: m9m6e2w5.stackpathcdn.com
URL: https://m9m6e2w5.stackpathcdn.com/v2/9eb2c00f/main.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.47.240 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-147-47-240.compute-1.amazonaws.com

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Content-Security-Policy	referrer always

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Mon, 15 Mar 2021 16:00:34 GMT
vary: Origin
p3p: CP="OTI DSP COR DEVo ADMa OUR CONo IND COM INT ONL PUR STA OTC"
access-control-allow-origin: https://cofense.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
referer-policy: unsafe-url
content-security-policy: referrer always
content-type: image/gif
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 modules.43e462fb3bf72fd02265.js Show response
script.hotjar.com/ 217 KB
58 KB 117ms
41ms Script
application/javascript 13.226.159.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.43e462fb3bf72fd02265.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1312741.js?sv=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-122.dus51.r.cloudfront.net

Software

Resource Hash

12ac633816bca5cff8ab286eb140927b6270fa0ba11b5490f868e66bfe554bb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 12 Mar 2021 15:45:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 260126
x-cache: Hit from cloudfront
content-length: 58555
access-control-allow-origin: *
last-modified: Fri, 12 Mar 2021 15:44:42 GMT
etag: "e889a795239793d1ff590c019fea98ac"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 dfeaf865724e57eaac72220929416926.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: 6ToKv-jny_KOjzOdipFmfr8j1szvFzdOHAvBh6HWdmE0Mcfu8mGH4Q==

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/159/ 11 KB
5 KB 35ms
34ms Script
application/x-javascript 88.221.60.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/159/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 88.221.60.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-60-75.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 15 Mar 2021 16:00:34 GMT
Content-Encoding: gzip
Last-Modified: Fri, 08 May 2020 02:24:14 GMT
Server: AkamaiNetStorage
ETag: "79274ffc293e4f76fc372b953f780d16:1588904654.430334"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4810
Expires: Wed, 23 Jun 2021 16:00:34 GMT

POST
H3-Q050 204 collect
www.google-analytics.com/g/ 0
38 B 13ms
13ms Other
text/plain 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-0HTW6C6HJS&gtm=2oe330&_p=742120417&sr=1600x1200&ul=en-us&cid=1639249986.1615824035&_s=1&dl=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&dt=AutoHotKey%20Leveraged%20by%20Metamorfo%2FMekotio%20Banking%20Trojan&sid=1615824034&sct=1&seg=0&en=page_view&_fv=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-0HTW6C6HJS&l=dataLayer&cx=c
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 15 Mar 2021 16:00:34 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cofense.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 32 KB
12 KB 42ms
42ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1061448384

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

08e8886e305db1744d2c9f1439f28abc73bef383f7a14da5f6e45e3f9e905cd0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12597
x-xss-protection: 0
server: cafe
etag: 5966996634223651104
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 15 Mar 2021 16:00:34 GMT

GET
H3-Q050 204 a
www.googletagmanager.com/ 0
95 B 14ms
14ms Image
image/gif 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-0HTW6C6HJS&cv=1&v=3&t=t&pid=1111030841&rv=330&es=1&e=gtm.init&eid=9&ut=C&tc=13&z=0

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 Mar 2021 16:00:34 GMT
server: Google Tag Manager
vary: *
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 204 a
www.googletagmanager.com/ 0
21 B 21ms
21ms Image
image/gif 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-0HTW6C6HJS&cv=1&v=3&t=t&pid=1111030841&rv=330&es=1&e=gtm.js&eid=1&ut=C&tc=13&tr=1gct.1lcl.1lcl.1ehl&ti=1gct.1lcl.1lcl.1ehl&z=0

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 Mar 2021 16:00:34 GMT
server: Google Tag Manager
vary: *
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 76856514.js Show response
www.iubenda.com/cookie-solution/confs/js/ 63 B
435 B 34ms
33ms Script
application/javascript 2.17.181.202
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.iubenda.com/cookie-solution/confs/js/76856514.js
Requested by: Host: cdn.iubenda.com
URL: https://cdn.iubenda.com/cookie_solution/iubenda_cs/core-d053bf0c05bb347ae5bf169b877657a0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.181.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-17-181-202.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 539420f5aec3cbe2d186a82f224e80c2628dd05f1c7f2815cb8bee3e270a45a1

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
access-control-request-method: *
content-encoding: gzip
content-length: 69
last-modified: Tue, 23 Feb 2021 16:41:42 GMT
server: nginx
etag: "60353046-3f"
vary: Accept-Encoding
access-control-allow-methods: POST, PUT, DELETE, GET, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
expires: Tue, 16 Mar 2021 16:00:34 GMT

GET
H2 200 adsct
t.co/i/ 43 B
448 B 249ms
149ms Image
image/gif 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0&txn_id=nv828&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 102
pragma: no-cache
last-modified: Mon, 15 Mar 2021 16:00:34 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 5ad69df13989f76400db6718728d1c8b
x-transaction: 0004d18a007c8305
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 box-469cf41adb11dc78be68c1ae7f9457a4.html Show response
vars.hotjar.com/ Frame 05A5 2 KB
1 KB 108ms
34ms Document
text/html 13.226.159.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1312741.js?sv=7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.159.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-159-3.dus51.r.cloudfront.net
Software: /
Resource Hash: 66f396314193bfe4809457b6c8004d026e3c503befe550e29ea068667f84ce39

Request headers

:method: GET
:authority: vars.hotjar.com
:scheme: https
:path: /box-469cf41adb11dc78be68c1ae7f9457a4.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cofense.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cofense.com/

Response headers

content-type: text/html
content-length: 851
date: Mon, 23 Nov 2020 17:01:03 GMT
accept-ranges: bytes
cache-control: max-age=31536000
content-encoding: br
etag: "d594f1d4c3e5dbd6b556c60d34e0daea"
last-modified: Mon, 23 Nov 2020 15:41:01 GMT
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 129372028f60828d8c084fb619a69bc0.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: KpluLkKM1Z3Li9NoDsXUPE9OvRhJlFv8QFjVvhUiZ5vTSkQkf6hruQ==
age: 9673171

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
85 B 14ms
14ms XHR
text/plain 2a00:1450:400c:c09::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j88&tid=UA-114787942-1&cid=1639249986.1615824035&jid=1831794134&gjid=1569671587&_gid=1024769513.1615824035&_u=aGDAgUADQAAAAE~&z=1064744735

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c09::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 15 Mar 2021 16:00:34 GMT
content-type: text/plain
access-control-allow-origin: https://cofense.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
120 B 6ms
6ms Image
image/gif 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j88&aip=1&a=742120417&t=pageview&_s=1&dl=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&ul=en-us&de=UTF-8&dt=AutoHotKey%20Leveraged%20by%20Metamorfo%2FMekotio%20Banking%20Trojan&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&exp=Y916st7_TUq9exzEKHDaPA.1&_u=aGDAgUADQ~&jid=1831794134&gjid=1569671587&cid=1639249986.1615824035&tid=UA-114787942-1&_gid=1024769513.1615824035&gtm=2wg3305RQ37KH&z=1454984867

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 14 Mar 2021 20:46:55 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 69219
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1061448384/ 2 KB
1 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1061448384/?random=1615824034804&cv=9&fst=1615824034804&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa330&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&tiba=AutoHotKey%20Leveraged%20by%20Metamorfo%2FMekotio%20Banking%20Trojan&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ace7f6ae09ebbfc194975fa0fbc09e46f7da4670b1bcc23bbf16d9f7bcae9b73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1071
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
111 B 30ms
29ms Image
image/gif 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-114787942-1&cid=1639249986.1615824035&jid=1831794134&_u=aGDAgUADQAAAAE~&z=1580263033

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 Mar 2021 16:00:34 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 29ms
28ms Image
image/gif 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-114787942-1&cid=1639249986.1615824035&jid=1831794134&_u=aGDAgUADQAAAAE~&z=1580263033

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 Mar 2021 16:00:34 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/exp/
Redirect Chain

https://s.adroll.com/j/exp/TFV7KNIV3VHWLJ6GAQ3KFT/index.js
https://s.adroll.com/j/exp/index.js

28 B
747 B

45ms
45ms

Script
application/javascript

84.53.188.140
AKAMAI-LON

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/exp/index.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 84.53.188.140 , Netherlands, ASN34164 (AKAMAI-LON, NL),
Reverse DNS: a84-53-188-140.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: 8C_4p5S6NLuKOM2fXKpm7asomxwPn3IL
Content-Encoding: gzip
ETag: "5816cced8568d223aa09d889f300692b"
x-amz-request-id: A6E4D842C4F3666B
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 48
x-amz-id-2: 1Pslf+Y9QwUHIZmwUo95w2CKA8MTrgZpbGBRFLUwAevxRDJ3euWTGuAJ2AJ78njOjdUd48ZsKSg=
Last-Modified: Tue, 19 Jan 2021 16:25:36 GMT
Server: AmazonS3
Date: Mon, 15 Mar 2021 16:00:35 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

Redirect headers

Date: Mon, 15 Mar 2021 16:00:35 GMT
Server: AkamaiGHost
Location: https://s.adroll.com/j/exp/index.js
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 0

GET
H/1.1 200
OK index.js Show response
s.adroll.com/j/pre/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/ 0
705 B 129ms
43ms Script
text/javascript 84.53.188.140
AKAMAI-LON

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/index.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 84.53.188.140 , Netherlands, ASN34164 (AKAMAI-LON, NL),
Reverse DNS: a84-53-188-140.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: OSo64o5gQTcM.uaod.Z_VfyJFA7VVI2K
ETag: "d41d8cd98f00b204e9800998ecf8427e"
x-amz-request-id: HK296VN68FBWCP2E
x-amz-server-side-encryption: AES256
Connection: keep-alive
Content-Length: 0
x-amz-id-2: rlFAFyTZvmvn2U0Qz08hvZ8WZto7dsNR0RQgtjOF3MMXhqJhYBYxKhp3MLKYKAc84mjlDD7/i2Y=
Last-Modified: Mon, 15 Mar 2021 04:57:48 GMT
Server: AmazonS3
Date: Mon, 15 Mar 2021 16:00:34 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H2

200

/ Show response
d.adroll.com/consent/check/TFV7KNIV3VHWLJ6GAQ3KFT/
Redirect Chain

https://d.adroll.mgr.consensu.org/consent/iabcheck/TFV7KNIV3VHWLJ6GAQ3KFT?_s=c5a6243f866f60da5c31cbabb807f0c7&_b=2
https://d.adroll.com/consent/check/TFV7KNIV3VHWLJ6GAQ3KFT/?_s=c5a6243f866f60da5c31cbabb807f0c7&_b=2

394 B
862 B

158ms
50ms

Script
application/javascript

34.253.2.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/TFV7KNIV3VHWLJ6GAQ3KFT/?_s=c5a6243f866f60da5c31cbabb807f0c7&_b=2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.253.2.147 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: adfc2225ba78f587e113da758bc1529b8804472defee127f272dcda3f2161dc2

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 Mar 2021 16:00:35 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.18.0
content-type: application/javascript
content-length: 394
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Redirect headers

location: https://d.adroll.com/consent/check/TFV7KNIV3VHWLJ6GAQ3KFT/?_s=c5a6243f866f60da5c31cbabb807f0c7&_b=2
date: Mon, 15 Mar 2021 16:00:34 GMT
server: nginx/1.18.0
content-length: 105

GET
H2 200 partners.js Show response
partner.shareaholic.com/ 0
265 B 327ms
111ms Script
application/javascript 107.20.140.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://partner.shareaholic.com/partners.js?location=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&cl=en-US&id_sync=8e1920de-ce43-4766-ada1-c37da3542130&minify=1&site=62df9f201cc7c19a56912daae814efca
Requested by: Host: m9m6e2w5.stackpathcdn.com
URL: https://m9m6e2w5.stackpathcdn.com/v2/9eb2c00f/main.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.20.140.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-107-20-140-231.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 Mar 2021 16:00:35 GMT
vary: Accept-Encoding, User-Agent
p3p: CP='OTI DSP COR DEVo ADMa OUR CONo IND COM INT ONL PUR STA OTC'
cache-control: no-cache, no-store, must-revalidate
content-type: application/javascript;charset=utf-8
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/1061448384/ 42 B
530 B 48ms
33ms Image
image/gif 2a00:1450:4001:802::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1061448384/?random=1615824034804&cv=9&fst=1615824000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa330&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&tiba=AutoHotKey%20Leveraged%20by%20Metamorfo%2FMekotio%20Banking%20Trojan&async=1&fmt=3&is_vtc=1&random=919398678&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 Mar 2021 16:00:34 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/1061448384/ 42 B
530 B 51ms
36ms Image
image/gif 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1061448384/?random=1615824034804&cv=9&fst=1615824000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa330&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&tiba=AutoHotKey%20Leveraged%20by%20Metamorfo%2FMekotio%20Banking%20Trojan&async=1&fmt=3&is_vtc=1&random=919398678&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 Mar 2021 16:00:34 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 write Show response
hits-i.iubenda.com/ 0
397 B 41ms
41ms XHR
text/plain 46.101.132.18
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://hits-i.iubenda.com/write?db=hits1
Requested by: Host: cdn.iubenda.com
URL: https://cdn.iubenda.com/cookie_solution/iubenda_cs/core-d053bf0c05bb347ae5bf169b877657a0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.101.132.18 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cofense.com/
Authorization: Basic aGl0czFfdTpoaXRzMV91cHdk
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 15 Mar 2021 16:00:35 GMT
server: nginx
x-influxdb-build: OSS
access-control-allow-methods: DELETE, GET, OPTIONS, POST, PUT
access-control-allow-origin: https://cofense.com
access-control-expose-headers: Date, X-InfluxDB-Version, X-InfluxDB-Build
request-id: 93cc1ab5-85a7-11eb-821c-0242ac110002
access-control-allow-headers: Accept, Accept-Encoding, Authorization, Content-Length, Content-Type, X-CSRF-Token, X-HTTP-Method-Override
x-influxdb-version: 1.8.2
x-request-id: 93cc1ab5-85a7-11eb-821c-0242ac110002

OPTIONS
H2 204 write
hits-i.iubenda.com/ Frame 0
0 114ms
32ms Preflight
text/plain 46.101.132.18
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://hits-i.iubenda.com/write?db=hits1
Protocol: H2
Server: 46.101.132.18 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization
Origin: https://cofense.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

server: nginx
date: Mon, 15 Mar 2021 16:00:35 GMT
access-control-allow-origin: https://cofense.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: *, authorization
access-control-max-age: 1728000
access-control-allow-credentials: true
content-length: 0
content-type: text/plain charset=UTF-8

GET
H2 200 forms2.css
app-ab46.marketo.com/js/forms2/css/ 13 KB
3 KB 42ms
42ms Stylesheet
text/css 104.16.94.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-ab46.marketo.com/js/forms2/css/forms2.css

Requested by

Host: app-ab46.marketo.com
URL: https://app-ab46.marketo.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.94.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 6814
vary: Accept-Encoding
content-length: 2623
cf-request-id: 08d837347d000073577faa6000000001
last-modified: Wed, 06 Jan 2021 21:16:41 GMT
server: cloudflare
etag: "2b2042f-3437-5b841d6e0e040"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63113904
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 6306f49a6db47357-CPH
expires: Mon, 15 Mar 2021 20:00:34 GMT

GET
H2 200 forms2-theme-plain.css
app-ab46.marketo.com/js/forms2/css/ 828 B
363 B 47ms
46ms Stylesheet
text/css 104.16.94.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-ab46.marketo.com/js/forms2/css/forms2-theme-plain.css

Requested by

Host: app-ab46.marketo.com
URL: https://app-ab46.marketo.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.94.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 6357
vary: Accept-Encoding
content-length: 246
cf-request-id: 08d837347e000073572eab9000000001
last-modified: Wed, 06 Jan 2021 21:16:41 GMT
server: cloudflare
etag: "2b20433-33c-5b841d6e0e040"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63113904
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 6306f49a6dba7357-CPH
expires: Mon, 15 Mar 2021 20:00:34 GMT

GET
H2 200 select_ui.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/ 1 KB
1 KB 32ms
31ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/select_ui.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/theme-styles.css?ver=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 55f8adec4b29514b52eb85f0f39875bb441683fa05aeae00f82b9d79ab8d27dd

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/theme-styles.css?ver=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:35 GMT
last-modified: Fri, 12 Mar 2021 17:00:22 GMT
server: NetDNA-cache/2.2
etag: "604b9e26-43d"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 1085

GET
H2 200 XDFrame Show response
app-ab46.marketo.com/index.php/form/ Frame 26A3 2 KB
1 KB 177ms
177ms Document
text/html 104.16.94.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-ab46.marketo.com/index.php/form/XDFrame

Requested by

Host: app-ab46.marketo.com
URL: https://app-ab46.marketo.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.94.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

370906bac81874da17c967e44e9da639b9350fd22e910b2711fbe946a7e1f978

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: app-ab46.marketo.com
:scheme: https
:path: /index.php/form/XDFrame
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cofense.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cf_bm=918e9f61814d00d19d4ee38497763720981edef7-1615824034-1800-ATjsaaCuw4c65mm0R0/QUBCJ+u2SalTmpL15tNl4PlgqYjtt+JkHKmPbH4TGD05Zd7aheOpgzImVttq8nw7085E=
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cofense.com/

Response headers

date: Mon, 15 Mar 2021 16:00:35 GMT
content-type: text/html; charset=utf-8
content-length: 653
set-cookie: __cfduid=defb4acf53d034fda96bf90e00d952c2b1615824035; expires=Wed, 14-Apr-21 16:00:35 GMT; path=/; domain=.app-ab46.marketo.com; HttpOnly; SameSite=Lax BIGipServerab46web-nginx-app_https=!J6Tuwicpp1koEuC5yiPNdgcigIaMSRlgxrhe9CkYUr+EXzdZue0FbUz2X5iAL1yHPn6q/iQ/sws9Og==;Path=/;Version=1;Secure;Httponly
cache-control: max-age=3600
strict-transport-security: max-age=63113904
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
cf-cache-status: DYNAMIC
cf-request-id: 08d837352e0000735793863000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6306f49b789c7357-CPH

GET
H2 200 tracking
lltrck.com/api/ 43 B
272 B 332ms
114ms Image
image/gif 52.44.242.176
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lltrck.com/api/tracking?accountId=19612&page=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&referer=&fp=84101abb558b671462d929e9c3aaca82

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.44.242.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-44-242-176.compute-1.amazonaws.com

Software

Kestrel /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 15 Mar 2021 16:00:35 GMT
server: Kestrel
content-length: 43
strict-transport-security: max-age=2592000
content-type: image/gif

GET
H/1.1

200
OK

LZCH7AGKEBFGLOFOIHTG7Q.js Show response
s.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/
Redirect Chain

https://d.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-troja...
https://s.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/LZCH7AGKEBFGLOFOIHTG7Q.js

4 KB
2 KB

44ms
44ms

Script
text/javascript

84.53.188.140
AKAMAI-LON

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/LZCH7AGKEBFGLOFOIHTG7Q.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 84.53.188.140 , Netherlands, ASN34164 (AKAMAI-LON, NL),
Reverse DNS: a84-53-188-140.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 969d46e33813c8220b273c0404fed5658d41638f863800ed8fb2fca99d8920cd

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: pV63wssUTNuzKRiEhPCUY6UWHFWb2FIJ
Content-Encoding: gzip
ETag: "a7a27b8b818085dc9afcceff9102471d"
x-amz-request-id: 2JDG6X7Z4H2H4PAY
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 1499
x-amz-id-2: CrE21TTmTCfm5C7IIh79iRrCQ0W3Ra7W9D9bF4Xgi7EVKPRQTHZymaOhe5wP22u9oj5O0ZTl36w=
Last-Modified: Tue, 26 Jan 2021 22:18:13 GMT
Server: AmazonS3
Date: Mon, 15 Mar 2021 16:00:35 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

Redirect headers

pragma: no-cache
x-conversion-value: 0.00
server: nginx/1.18.0
x-rule: *
date: Mon, 15 Mar 2021 16:00:35 GMT
x-segment-eid: LZCH7AGKEBFGLOFOIHTG7Q
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://s.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/LZCH7AGKEBFGLOFOIHTG7Q.js
cache-control: no-store, no-cache, must-revalidate
x-segment-display-name: Visitors to Unsegmented Pages
x-pixel-eid: JLU6TD3D6FA2JAELGSQWLD
x-segment-name: *
x-advertisable-eid: TFV7KNIV3VHWLJ6GAQ3KFT
content-length: 0
x-conversion-currency

GET
H2 200 forms2.min.js Show response
app-ab46.marketo.com/js/forms2/js/ Frame 26A3 204 KB
68 KB 42ms
42ms Script
application/x-javascript 104.16.94.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-ab46.marketo.com/js/forms2/js/forms2.min.js

Requested by

Host: app-ab46.marketo.com
URL: https://app-ab46.marketo.com/index.php/form/XDFrame

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.94.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

014de295141a456ceda8e3c4762085e53dca50f91ddf65906d227f70cf0b1a55

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://app-ab46.marketo.com/index.php/form/XDFrame
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Sat, 16 Jan 2021 05:25:05 GMT
server: cloudflare
age: 1
etag: "27211e7-33187-5b8fdb621b553"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 6306f49d0c517357-CPH
cf-request-id: 08d837362a000073574305d000000001
expires: Mon, 15 Mar 2021 20:00:35 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 91 KB
23 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: d.adroll.com
URL: https://d.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&pv=41643531842.23648&cookie=&adroll_s_ref=&keyw=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9e7ea2b4ba8e2bcc4a964d6192e4671dc5f6863a1c7e35b52b229a3c1e67a68d

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 23762
x-fb-rlafr: 0
pragma: public
x-fb-debug: RIKa9pHBkZdn+cWFY96C6UhFokGP/q6gsa8cf4YxhA0gpeRLpOJEsvJBEJUHI7tRCKL1p54po9+Zur9tlA4HyA==
x-fb-trip-id: 917726464
x-frame-options: DENY
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Mon, 15 Mar 2021 16:00:35 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"group":"coop_report","max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"include_subdomains":true}, {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
priority: u=3,i
cross-origin-opener-policy-report-only: same-origin-allow-popups;report-to="coop_report"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

204

sync
pixel.advertising.com/ups/55980/
Redirect Chain

https://d.adroll.com/cm/aol/out?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ...
https://pixel.advertising.com/ups/55980/sync?uid=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

0
125 B

101ms
33ms

Image
text/plain

18.184.153.186
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55980/sync?uid=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.184.153.186 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:35 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://pixel.advertising.com/ups/55980/sync?uid=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
pragma: no-cache
date: Mon, 15 Mar 2021 16:00:35 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.18.0
content-length: 167
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/
Redirect Chain

https://d.adroll.com/cm/index/out?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHW...
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&expiration=1647360035
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&expiration=1647360035&C=1

43 B
1 KB

101ms
100ms

Image
image/gif

84.53.189.33
AKAMAI-LON

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&expiration=1647360035&C=1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 84.53.189.33 , Netherlands, ASN34164 (AKAMAI-LON, NL),
Reverse DNS: a84-53-189-33.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 Mar 2021 16:00:35 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 15 Mar 2021 16:00:35 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 15 Mar 2021 16:00:35 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&expiration=1647360035&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 333
Expires: Mon, 15 Mar 2021 16:00:35 GMT

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://d.adroll.com/cm/n/out?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6G...
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&expires=365

0
239 B

137ms
36ms

Image
image/gif

69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&expires=365
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
Content-Type: image/gif

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&expires=365
pragma: no-cache
date: Mon, 15 Mar 2021 16:00:35 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.18.0
content-length: 124
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/
Redirect Chain

https://d.adroll.com/cm/outbrain/out?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3...
https://sync.outbrain.com/cookie-sync?p=adroll&uid=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk
https://sync.outbrain.com/cookie-sync?p=adroll&uid=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&rdrctExp=true

0
477 B

113ms
113ms

Image
text/plain

64.202.112.127
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=adroll&uid=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&rdrctExp=true
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.202.112.127 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 15 Mar 2021 16:00:36 GMT
Cache-Control: no-cache
X-TraceId: d50151362bf7af4e0e8b919e1368ad35
Content-Length: 0

Redirect headers

Location: https://sync.outbrain.com/cookie-sync?p=adroll&uid=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&rdrctExp=true
Date: Mon, 15 Mar 2021 16:00:35 GMT
X-TraceId: 87a4a7c56152db33e5b8c7a01ece752b
Content-Length: 0

GET
H/1.1

200
OK

Pug
simage2.pubmatic.com/AdServer/
Redirect Chain

https://d.adroll.com/cm/pubmatic/out?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENA...

1 B
806 B

164ms
39ms

Image
text/html

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 15 Mar 2021 16:00:35 GMT
X-lat: lhrpug015:0:367
Server: nginx
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 1

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
pragma: no-cache
date: Mon, 15 Mar 2021 16:00:35 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.18.0
content-length: 220
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H2

204

rtb-h
sync.taboola.com/sg/adroll-network/1/
Redirect Chain

https://d.adroll.com/cm/taboola/out?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3V...
https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk

0
220 B

100ms
33ms

Image
text/plain

141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

tbl-x-upstream: 10.41.34.201:10213
date: Mon, 15 Mar 2021 16:00:35 GMT
server: nginx
x-fastly-to-nlb-rtt: 14961

Redirect headers

location: https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk
pragma: no-cache
date: Mon, 15 Mar 2021 16:00:35 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.18.0
content-length: 111
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H2

200

xuid
eb2.3lift.com/
Redirect Chain

https://d.adroll.com/cm/triplelift/out?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNI...
https://eb2.3lift.com/xuid?mid=4714&xuid=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&dongle=c85e
https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=

37 B
352 B

33ms
33ms

Image
image/gif

18.158.85.202
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.158.85.202 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-85-202.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:35 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: /xuid?ld=1&mid=4714&xuid=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=
date: Mon, 15 Mar 2021 16:00:35 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

204

v1
ads.yahoo.com/cms/
Redirect Chain

https://d.adroll.com/cm/r/out?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6G...
https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

0
447 B

23ms
7ms

Image
text/plain

2a00:1288:80:800::7000
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7000 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:35 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

Redirect headers

location: https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
pragma: no-cache
date: Mon, 15 Mar 2021 16:00:35 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.18.0
content-length: 165
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H2

200

sync
x.bidswitch.net/ul_cb/
Redirect Chain

https://d.adroll.com/cm/b/out?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6G...
https://x.bidswitch.net/sync?dsp_id=44&user_id=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk
https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk

43 B
344 B

33ms
33ms

Image
image/gif

52.28.196.155
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.28.196.155 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:35 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

Redirect headers

location: https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk
date: Mon, 15 Mar 2021 16:00:35 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H/1.1

200
OK

bounce
ib.adnxs.com/
Redirect Chain

https://d.adroll.com/cm/x/out?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6G...
https://ib.adnxs.com/setuid?entity=172&code=NTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DNTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk

43 B
1 KB

33ms
33ms

Image
image/gif

185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DNTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 Mar 2021 16:00:35 GMT
X-Proxy-Origin: 82.102.20.235; 82.102.20.235; 731.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.177:80
AN-X-Request-Uuid: 114e9cb1-9605-4e25-81cd-97f1ba0b611e
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 15 Mar 2021 16:00:35 GMT
X-Proxy-Origin: 82.102.20.235; 82.102.20.235; 731.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.53:80
AN-X-Request-Uuid: fea43cbf-0ff6-4ac1-ab70-a4a1e0caa83e
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DNTAyMDI3MzJjZjJkMTQ1MWVkYjI4YmVmMDRkODRlZDk
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 out
d.adroll.com/cm/l/ 42 B
180 B 84ms
82ms Image
image/gif 34.253.2.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/l/out?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.253.2.147 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:35 GMT
cache-control: no-transform,public,max-age=300,s-maxage=900
server: nginx/1.18.0
content-length: 42
vary: Cookie
content-type: image/gif

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://d.adroll.com/cm/o/out?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6G...
https://us-u.openx.net/w/1.0/sd?id=537103138&val=50202732cf2d1451edb28bef04d84ed9
https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=50202732cf2d1451edb28bef04d84ed9

43 B
180 B

54ms
54ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=50202732cf2d1451edb28bef04d84ed9
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.202.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 Mar 2021 16:00:35 GMT
via: 1.1 google
server: OXGW/16.202.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=50202732cf2d1451edb28bef04d84ed9
date: Mon, 15 Mar 2021 16:00:35 GMT
via: 1.1 google
server: OXGW/16.202.0
alt-svc: clear
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H2

200

in
d.adroll.com/cm/g/
Redirect Chain

https://d.adroll.com/cm/g/out?adroll_fpc=e1b724bb7977511e2e9b5f85a77871e6-1615824035352&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6G...
https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=UCAnMs8tFFHtsovvBNhO2Q
https://d.adroll.com/cm/g/in

42 B
536 B

50ms
50ms

Image
image/gif

34.253.2.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/g/in
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.253.2.147 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 Mar 2021 16:00:35 GMT
server: nginx/1.18.0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-store, no-cache, must-revalidate
content-type: image/gif
content-length: 42
x-result: g.-1.-1.-1

Redirect headers

pragma: no-cache
date: Mon, 15 Mar 2021 16:00:35 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://d.adroll.com/cm/g/in
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 225
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 356920024481298 Show response
connect.facebook.net/signals/config/ 240 KB
69 KB 7ms
7ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/356920024481298?v=2.9.33&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

be59eeb43ce977328d414c543d60c07cd284788a76f617cd433e1a484bfa33ff

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 70520
x-fb-rlafr: 0
pragma: public
x-fb-debug: waIR0Qvl6etwYhopLYgTfBpI+Y+BMFsKZqOr8HPlRIs1U1/+nRbkgrcYZy39G1nCC68+CePMa5b9Z7DV/3NgwQ==
x-fb-trip-id: 917726464
x-frame-options: DENY
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Mon, 15 Mar 2021 16:00:35 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"group":"coop_report","max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"include_subdomains":true}, {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
cross-origin-opener-policy-report-only: same-origin-allow-popups;report-to="coop_report"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
147 B 6ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=356920024481298&ev=PageView&dl=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&rl=&if=false&ts=1615824035508&cd[segment_eid]=LZCH7AGKEBFGLOFOIHTG7Q&sw=1600&sh=1200&v=2.9.33&r=stable&ec=0&o=29&fbp=fb.1.1615824035506.517265359&it=1615824035478&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=GET

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:35 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Mon, 15 Mar 2021 16:00:35 GMT

GET
H3-Q050 204 a
www.googletagmanager.com/ 0
44 B 14ms
14ms Image
image/gif 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-0HTW6C6HJS&cv=1&v=3&t=t&pid=1111030841&rv=330&es=1&e=*&eid=16&u=C&ut=C&tc=13&z=0

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 Mar 2021 16:00:35 GMT
server: Google Tag Manager
vary: *
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 core Show response
rc-fast-lane.js.driftt.com/ Frame C70B 3 KB
1 KB 225ms
148ms Document
text/html 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1615824300000/28krvx2uf9n3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

6cd0b7f49bdab851ed2aa1876108ffc7002ccaf1ba967b166e876070d1c7d95d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: rc-fast-lane.js.driftt.com
:scheme: https
:path: /core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cofense.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cofense.com/

Response headers

content-type: text/html
server: nginx
last-modified: Mon, 15 Mar 2021 14:52:42 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: RHwAxGZiAeOgoiavznLU_Gc2TrjEbfz1
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
date: Mon, 15 Mar 2021 16:00:36 GMT
cache-control: no-cache
etag: W/"801d332de8cf883b58d76959e78dd581"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: iUae62Q_fmW4l-KHZ6mcfZ_yC2OqU_0cZ49-IDNPTM9FisymUtCcFA==

GET
H2 200 chat Show response
rc-fast-lane.js.driftt.com/core/ Frame B4CF 3 KB
1 KB 228ms
152ms Document
text/html 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/chat

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1615824300000/28krvx2uf9n3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

6cd0b7f49bdab851ed2aa1876108ffc7002ccaf1ba967b166e876070d1c7d95d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: rc-fast-lane.js.driftt.com
:scheme: https
:path: /core/chat
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cofense.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cofense.com/

Response headers

content-type: text/html
server: nginx
last-modified: Mon, 15 Mar 2021 14:52:42 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: RHwAxGZiAeOgoiavznLU_Gc2TrjEbfz1
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
date: Mon, 15 Mar 2021 16:00:36 GMT
cache-control: no-cache
etag: W/"801d332de8cf883b58d76959e78dd581"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: OdCGBgrNm5CN-tGuxlsYrjUsUAEHy7XBL9Hqe9s_2smmC6_xpFs9Fw==

GET
H/1.1 200
OK pd.js Show response
pi.pardot.com/ 5 KB
2 KB 448ms
112ms Script
application/javascript 35.174.150.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/pd.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.150.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: pi0-lba1-3-ue1.aws.pardot.com
Software: PardotServer /
Resource Hash: 925be107869153b6120de872c1ae333977bfaee69a0f7c6271f32d4a8348bca8

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 15 Mar 2021 16:00:36 GMT
Content-Encoding: gzip
X-Pardot-Route: ea50fcd3dcf777490e1499615b883deb
X-Pardot-LB: a083ac6fc1531fb089982e922db67d20
Last-Modified: Fri, 13 Mar 2020 19:48:31 GMT
Server: PardotServer
ETag: "1442-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Cache-Control: max-age=63072000
Accept-Ranges: bytes
Content-Length: 1842
Expires: Wed, 15 Mar 2023 16:00:36 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
651 B 387ms
170ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0&txn_id=nv828&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 121
pragma: no-cache
last-modified: Mon, 15 Mar 2021 16:00:36 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: d38bcf33329dedd46eaaebfb305e197a
x-transaction: 007a6d7a008c8e35
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 runtime~main.04b859d0.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame C70B 5 KB
3 KB 333ms
329ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

c62435c37cac42a12a0f32ddbdd04939aafa71c401eafdd6a299c23516bc7ffa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:36 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:08 GMT
server: nginx
etag: W/"13a56bc2dc377a1eb06f2c60cb54367b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: XJKa4ZPQjjjtsDvdiB1kWX8tEHMK01zi
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: TRFZ1pxqhiNVZHEFxhpmzPSANfYcNp4vk3dmHEPXKM1h5PnAvRMv_A==

GET
H2 200 38.feef3c6b.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame C70B 40 KB
12 KB 369ms
365ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

af8a20e6bd6c6de708d7aeffdd3afab1a47a00f91b53618d246cdb73410f147c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:36 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:06 GMT
server: nginx
etag: W/"8a244bcbbb9c80ac041e954050101a6d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 159CIpqp4fCjjToFO43v8VS4tGmLADdn
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: C2al_E1bS3CgW6Pe-vox83ratHdDDYOzV9PToL2cTCWYxWbwR4-LBg==

GET
H2 200 22.c3832689.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame C70B 42 KB
12 KB 351ms
347ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/22.c3832689.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

d5dd51858c25c8f35b6d808746ec3c11750d0b6796b607cf720fa3c86d6e1bb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:36 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:06 GMT
server: nginx
etag: W/"2b69413df831a59bc270b140595f3bee"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: FDZRQS52niirFlBqm67sd7T0vE2w38LG
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: iRPVj61K8IhmfnOgf_WBi1cl8-pYQb8iFJ9ORIqsZJ93WTJX_0Dwiw==

GET
H2 200 13.a9247e5d.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame C70B 70 KB
22 KB 160ms
156ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/13.a9247e5d.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

a46a8c9098978eb78708da11a88cf5b7d8f3d691c499aa23a56938beebed5adb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:36 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:05 GMT
server: nginx
etag: W/"905ca25975ecfcc9b76946365bc9cd59"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: s0YpJCLh4._KTbtu3b.Fk0T4MSxPb3O0
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: tAHKZHJL3kKPvtnp7HPIGaRMfyPn6sQzFg5iQVrEL6ZyVNBTtkCqlg==

GET
H2 200 29.69384517.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame C70B 48 KB
15 KB 331ms
328ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/29.69384517.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

70bedf6699398da0f7fa3be459809c0701fe7de1de2e4fff0718be5f65600db9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:36 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:06 GMT
server: nginx
etag: W/"a4be40481b3d6f225b9f914e9d1e2d0f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 3y3pk9OqyH6GFF6Vp9x_WDx_BtxkBsIa
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: p9fToCj2yV96FtJ9I_5f4dst39Kxay3WINQwBcZMlHSzTZEIw09wrA==

GET
H2 200 12.57262d49.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame C70B 29 KB
8 KB 350ms
346ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/12.57262d49.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

ed2fec0144162eef92fd358672643917fc5dbb486c1bbbd322a51cefe8e4795f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:36 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:05 GMT
server: nginx
etag: W/"348b3ab0c4ac731aa7e05f603e4335ea"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: q5u4AQOJKtJ53NAjySg15aut36CU7Xo.
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: g54nnxbDNWVYnlBxlWolieaB68ardyZcJ8yGG-1dsXkfOyoQ3jidtA==

GET
H2 200 15.ba891359.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame C70B 39 KB
10 KB 155ms
152ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/15.ba891359.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

2d3474f74f49ea05fe008ac0707fa6e2f3adba2b990b5c46d61f3a465023eae2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:36 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:05 GMT
server: nginx
etag: W/"c35bc9563c8d6e811ec2f39f529dc431"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: bIAyf6unXVTBXL1uwRqKbYsTRIUTt34t
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: _cUQ0q5n6nMcq5XrldANbCa__t8SFT_MhLVuE0tgGd4tdpgmlZ2doQ==

GET
H2 200 35.a8afab31.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame C70B 52 KB
18 KB 160ms
157ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/35.a8afab31.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

f86e08b2390d477db93fb1f6549ef75530790c121d24a531a6acb0c0b811fceb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:36 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:06 GMT
server: nginx
etag: W/"e000fed6be2bb9d6650a3d6298820c00"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 4Jfh9a4M8le4m57CBsQBL2h74N3YiJuE
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Js5YvbMKbIrTgcfRqhngE-CFNLKKX2YsVBrksBeRJ2VEGC-_lHvNbQ==

GET
H2 200 33.6dcbce8f.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame C70B 24 KB
10 KB 161ms
158ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/33.6dcbce8f.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

1a613cec529d335c4758874a4b8249ddf6921d238969f33ac58289dddada5388

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:36 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:06 GMT
server: nginx
etag: W/"95f111c83ae06bebf035d1b81b96b8c8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Gr.w05U40txkJkcM9UnPXcMpMSMY9S6r
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: sVfT0iSG1s-Ebh2eGUuz1GgjVfcvP5t92y09xKbI2IigoUOKCF9WfQ==

GET
H2 200 8.b94e6c9f.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame C70B 60 KB
21 KB 351ms
349ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/8.b94e6c9f.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

cae6601eec3262f0496682bc1cced8b0fabc8636c4645562c4952a81d02c5283

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:36 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:07 GMT
server: nginx
etag: W/"367141ca772a2b6bf33a53efb589a530"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Zgb_jwmT6f_wK55TmmJp9FBr92xwf07x
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: NEFcLXFSD0EstaC-G-6FmKHYSOfslzAUdHq6F1Udnbp5HIrPk2xawA==

GET
H2 200 main~493df0b3.b07d5ed4.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame C70B 20 KB
7 KB 355ms
353ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/main~493df0b3.b07d5ed4.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

76dc4285400dc948e9fa22bafee1f1779703e6aa6fe0064d003b4d4fdb586d23

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:36 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:08 GMT
server: nginx
etag: W/"1f883d55e4c92e03ce755be467849e57"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: UAPh1GGu3kqcmwC4vfuEHJghvTCYHda2
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: T_NxmAZyRod5wXF6ZB5-qVuxPgXUcm3S2Mfx4JlfnAYApmHENw8jLA==

GET
H2 200 main~970f9218.55840df9.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame C70B 60 KB
16 KB 354ms
352ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/main~970f9218.55840df9.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

99abd2ce5d6ec8c6a8df5735d98d5b37bb03b56c067b4e68de2335e265ade0e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:36 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:08 GMT
server: nginx
etag: W/"56f31de0a4f37f3dc022c81264904b16"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 0n.OI.2RkCpUqPSuxqb6emvVnu8AF5aN
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: tjRLK3Lz2eY_eEs9DoXeMD3ORH6UMbIXVf1R74enckH8ylxqH9EvsQ==

GET
H2 200 main~89e24786.227e1a1e.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame C70B 63 KB
17 KB 364ms
362ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/main~89e24786.227e1a1e.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

88db5d9a8b1674c53ab7e86d59d0b0e67ea92f0003770c642b95883e23582ed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:36 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:08 GMT
server: nginx
etag: W/"4ea7d5bdc86d3ee0b51b7839751063fc"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: v04uMsBCl0FSPFOjmBoknMolTlw4RRAJ
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Bgsj2BFpZ6iGQ9wZZXBM_NxeXkbZ4z2Hb9QsWN6Hp-K4m6fatF2FKg==

GET
H2 200 main~53ca99a6.c5bce9cd.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame C70B 27 KB
9 KB 350ms
349ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/main~53ca99a6.c5bce9cd.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

366c3f9d43d021bf672904a0b643c0271c1588b2cfe2ed09fb5dfc1ae61e4645

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:36 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:08 GMT
server: nginx
etag: W/"9ac2c61b6b43c92711f876dfa04dd72d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: J4AvyGYmTemtC4KouhzmHIPtA.MgQhDY
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: AP5FL__lE2V9gcuZ7Cfd8wEboXxj-CJn8gU9Zp5y_C9lUPLqpKA78g==

GET
H2 200 runtime~main.04b859d0.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 5 KB
3 KB 56ms
53ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

c62435c37cac42a12a0f32ddbdd04939aafa71c401eafdd6a299c23516bc7ffa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 13:49:32 GMT
content-encoding: gzip
age: 7864
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 13:49:32 GMT
server: nginx
etag: W/"13a56bc2dc377a1eb06f2c60cb54367b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: RbKJjDvqz_hspHR9ydAQVyrCt3wcYvBb
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ce4vqqxQjj3hKGFcSNCRVhcth_U2FUYNXyoljjEtIP7BGwIBifAHJA==

GET
H2 200 38.feef3c6b.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 40 KB
12 KB 111ms
108ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

af8a20e6bd6c6de708d7aeffdd3afab1a47a00f91b53618d246cdb73410f147c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Jan 2021 17:43:11 GMT
content-encoding: gzip
age: 5782645
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 07 Jan 2021 17:42:50 GMT
server: nginx
etag: W/"8a244bcbbb9c80ac041e954050101a6d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: qbRLIuL4oDvAMd8wtm3jMo4n74SWJOvU
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: QEwyYesje0Fv9kJ4bOl5vXp_2f2z0jQYyb_mSHdanaLHRrVsA9Hbpw==

GET
H2 200 22.c3832689.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 42 KB
12 KB 61ms
57ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/22.c3832689.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

d5dd51858c25c8f35b6d808746ec3c11750d0b6796b607cf720fa3c86d6e1bb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 10 Feb 2021 01:57:16 GMT
content-encoding: gzip
age: 2901800
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 10 Feb 2021 01:38:04 GMT
server: nginx
etag: W/"2b69413df831a59bc270b140595f3bee"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: pRbob56a_6u.QzQ1afrgBfnJnL3zCkDn
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: zFqFNaz5gT_eEHeKe6cxZBoTOTH2PLFbwYOub1sWqIWLas7Wvh17ug==

GET
H2 200 13.a9247e5d.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 70 KB
22 KB 113ms
110ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/13.a9247e5d.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

a46a8c9098978eb78708da11a88cf5b7d8f3d691c499aa23a56938beebed5adb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 09 Feb 2021 03:13:10 GMT
content-encoding: gzip
age: 2983646
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 08 Feb 2021 18:30:04 GMT
server: nginx
etag: W/"905ca25975ecfcc9b76946365bc9cd59"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: ORIQnA8LFRUGPm_MvjEAn9pPZiA.jKnz
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: O-gja8GV5Iff8fkVwymUrj6YC073q4DYbAtLttXUFGKB_v0Wa3kJoQ==

GET
H2 200 29.69384517.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 48 KB
15 KB 77ms
74ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/29.69384517.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

70bedf6699398da0f7fa3be459809c0701fe7de1de2e4fff0718be5f65600db9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 09 Mar 2021 22:48:11 GMT
content-encoding: gzip
age: 493945
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 09 Mar 2021 22:48:09 GMT
server: nginx
etag: W/"a4be40481b3d6f225b9f914e9d1e2d0f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 1keKhh7aWchFfILY.F67AdOYZz1V61iN
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: o5tS6sfaUxLMmpwteWIoLylqV11GEI17NWyf0dZz32_Sak9bM0B_AA==

GET
H2 200 12.57262d49.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 29 KB
8 KB 80ms
77ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/12.57262d49.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

ed2fec0144162eef92fd358672643917fc5dbb486c1bbbd322a51cefe8e4795f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 09 Mar 2021 22:48:11 GMT
content-encoding: gzip
age: 493945
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 09 Mar 2021 22:48:09 GMT
server: nginx
etag: W/"348b3ab0c4ac731aa7e05f603e4335ea"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: MkxRlsMRtyiqMA3RTGn25Ax1jSB.aylP
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: tgZ-suSUhM8rjZP4igKfm-JsLgMGTRtvhvBK8vAA7eGxsRUvbp25vw==

GET
H2 200 15.ba891359.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 39 KB
10 KB 84ms
81ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/15.ba891359.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

2d3474f74f49ea05fe008ac0707fa6e2f3adba2b990b5c46d61f3a465023eae2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Jan 2021 17:43:11 GMT
content-encoding: gzip
age: 5782645
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 07 Jan 2021 17:42:49 GMT
server: nginx
etag: W/"c35bc9563c8d6e811ec2f39f529dc431"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: P0EWjdsMAxKZToiBN_Ev92YgkdqIibj3
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 9GxKcYm4v2Ja80pSQFMkHQFfLv8ehi8rxTTCiD1gy82DkIamgxRPhQ==

GET
H2 200 35.a8afab31.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 52 KB
18 KB 89ms
86ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/35.a8afab31.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

f86e08b2390d477db93fb1f6549ef75530790c121d24a531a6acb0c0b811fceb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 13:49:15 GMT
content-encoding: gzip
age: 7881
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 11 Mar 2021 21:29:33 GMT
server: nginx
etag: W/"e000fed6be2bb9d6650a3d6298820c00"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: gNX052Ud.P3to00jfrs5nVU9M1XStidu
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: n826RDr8ZxjWTvFfGKITi0ktEja4XE6juYuULyZ8T7x6-lV2_0cYnQ==

GET
H2 200 33.6dcbce8f.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 24 KB
10 KB 108ms
106ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/33.6dcbce8f.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

1a613cec529d335c4758874a4b8249ddf6921d238969f33ac58289dddada5388

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 11 Feb 2021 02:01:47 GMT
content-encoding: gzip
age: 2815129
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 10 Feb 2021 20:34:33 GMT
server: nginx
etag: W/"95f111c83ae06bebf035d1b81b96b8c8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: kML7kED8sDN5yx43ZDztCRo.3edJ2520
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: khOFI0uf6p0v2QVq6F1OMazsH2DUa7x3IZzOQCZiVto2a3i-wVvw3A==

GET
H2 200 8.b94e6c9f.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 60 KB
21 KB 95ms
93ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/8.b94e6c9f.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

ddb54fd9f48bfd94fe644bfb5890741c8a330f1aa7e38ee8312ff8107116f46b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 10 Dec 2020 20:49:43 GMT
content-encoding: gzip
age: 8190653
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 10 Dec 2020 14:22:39 GMT
server: nginx
etag: W/"d9be39d08138fc7b2f54789157f72e65"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 8N5zfyOI_RTyOHpPNHVrZWDfhxVd8Iko
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: J8xiYSdMNQhJAXQZRo8lCRewo1SVv7zLzIlRG6u-PS-cKwVj_XwcWw==

GET
H2 200 main~493df0b3.b07d5ed4.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 20 KB
7 KB 96ms
94ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/main~493df0b3.b07d5ed4.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

76dc4285400dc948e9fa22bafee1f1779703e6aa6fe0064d003b4d4fdb586d23

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 13:49:32 GMT
content-encoding: gzip
age: 7864
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 13:49:32 GMT
server: nginx
etag: W/"1f883d55e4c92e03ce755be467849e57"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 5ctRAV0ps7ual1avBKi5MLAIt5YtUncB
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 7eqhi1Gcdw3ZGdKEQIaWYFsZgT6hWNOUCht3plCbEsDkYoe1AjXkyg==

GET
H2 200 main~970f9218.55840df9.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 60 KB
16 KB 106ms
104ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/main~970f9218.55840df9.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

99abd2ce5d6ec8c6a8df5735d98d5b37bb03b56c067b4e68de2335e265ade0e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 13:49:32 GMT
content-encoding: gzip
age: 7864
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 13:49:32 GMT
server: nginx
etag: W/"56f31de0a4f37f3dc022c81264904b16"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: iX7_mprKjyK8JoyLAhHKeLpslZF7BAXJ
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: FC_6ONyNBr4C3eE4LtTJdae6HN0mvbEutHJfwEV6UaWNsnT9lONMHA==

GET
H2 200 main~89e24786.227e1a1e.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 63 KB
17 KB 100ms
98ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/main~89e24786.227e1a1e.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

88db5d9a8b1674c53ab7e86d59d0b0e67ea92f0003770c642b95883e23582ed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 13:49:32 GMT
content-encoding: gzip
age: 7864
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 13:49:32 GMT
server: nginx
etag: W/"4ea7d5bdc86d3ee0b51b7839751063fc"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: j5Oz0eIka.6syLAdkNM0chdlCNEm0yYK
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: vnp26oQZyh-aT1mSwgTu7wy6JjyXjSws9_MC-injiAYVozTk9aVyKQ==

GET
H2 200 main~53ca99a6.c5bce9cd.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 27 KB
9 KB 102ms
100ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/main~53ca99a6.c5bce9cd.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

366c3f9d43d021bf672904a0b643c0271c1588b2cfe2ed09fb5dfc1ae61e4645

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 14:53:14 GMT
content-encoding: gzip
age: 4042
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:08 GMT
server: nginx
etag: W/"9ac2c61b6b43c92711f876dfa04dd72d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: J4AvyGYmTemtC4KouhzmHIPtA.MgQhDY
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: qsQbVY5iaz87uab15DkfGfalAnVPcA8eYXThoZHoqk8qmB7GOn9QDA==

GET
H/1.1 200
OK analytics Show response
pi.pardot.com/ 72 B
533 B 127ms
126ms Script
text/html 35.174.150.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=1564&account_id=47382&title=AutoHotKey%20Leveraged%20by%20Metamorfo%2FMekotio%20Banking%20Trojan&url=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&referrer=
Requested by: Host: pi.pardot.com
URL: https://pi.pardot.com/pd.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.150.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: pi0-lba1-3-ue1.aws.pardot.com
Software: PardotServer /
Resource Hash: d5ed0d3bb98ae16ad90be29db3becf6153a1390b922506a19cccf2400bbdb1c1

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 15 Mar 2021 16:00:36 GMT
Content-Encoding: gzip
X-Pardot-Route: d5a18e4517a9c8ba62b77de366a4cdb5
X-Pardot-LB: a083ac6fc1531fb089982e922db67d20
Server: PardotServer
Vary: Accept-Encoding,User-Agent
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=63072000
Content-Length: 89
Expires: Wed, 15 Mar 2023 16:00:36 GMT

GET
H3-Q050 204 a
www.googletagmanager.com/ 0
44 B 15ms
14ms Image
image/gif 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-0HTW6C6HJS&cv=1&v=3&t=t&pid=1111030841&rv=330&es=1&e=gtm.load&eid=17&u=C&ut=C&tc=13&tr=1sdl.5sdl&ti=1sdl.1sdl&z=0

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 Mar 2021 16:00:36 GMT
server: Google Tag Manager
vary: *
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 36.56cefaf3.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 6 KB
3 KB 37ms
36ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/36.56cefaf3.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

e9f1723d153401796dcde6f2d1fbf9a6e2181ac7e94049fc88126fbff1abd38d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 30 Jan 2021 04:23:16 GMT
content-encoding: gzip
age: 3843440
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 29 Jan 2021 18:47:31 GMT
server: nginx
etag: W/"199a90762d66f2a85b69771e3ad0d5d5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: QRy7zgWa0i92DNsndUmZj.OhtDp51Hx0
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 3wkqg3TOQrlg-5N1xpmz3hNJZe3a4wpLmaEkF9KCb-qqzz6IF46V_A==

GET
H2 200 34.fe729046.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 107 KB
34 KB 39ms
38ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/34.fe729046.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

ff04dd81bb93731c0d1f8e7d384b370f26b93f4352980404fcdc4518e386bedd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 09 Feb 2021 03:08:40 GMT
content-encoding: gzip
age: 2983916
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 08 Feb 2021 18:30:05 GMT
server: nginx
etag: W/"b75bf38c8eee61f620998bf4e506f0a8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: m8edRsIe1sadfWN1WLf704tqM5aKomP5
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 7NYuKa99tow0mrZYnPaT41gcH-Wjh4CFgOxnlYsKKIYacLX-7lKMng==

GET
H2 200 26.91e0f92d.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 27 KB
9 KB 40ms
39ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/26.91e0f92d.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

457b4bd3410faf074da387900f87abc1e845269e857219560bce3ead8260d103

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 09 Mar 2021 22:48:11 GMT
content-encoding: gzip
age: 493945
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 09 Mar 2021 22:48:09 GMT
server: nginx
etag: W/"2203aa06cd7f5410d671168ef758e8ca"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: ceIvnGHsyl9nla89dnTpnWqKjpRiI6hC
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 77-i0hEp2gH-3ONVGEcF8W7J3kFg-AUHfv5_JWASElFun0aJXXVyCA==

GET
H2 200 32.92beb56c.chunk.css
rc-fast-lane.js.driftt.com/core/assets/css/ Frame B4CF 2 KB
1 KB 43ms
43ms Stylesheet
text/css 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/css/32.92beb56c.chunk.css

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

11c0f76b0414f025f6d8790a111f70421b4b0e816a93317188736671360192ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 19:35:31 GMT
content-encoding: gzip
age: 937505
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 04 Mar 2021 19:35:04 GMT
server: nginx
etag: W/"1103e1501b63c165063174303b93cb83"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: vPGJRAJgqOZxHaQUel.CzZz_qo15XtyR
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Y1pUpCr1fLjBmhhjmeh-6NeETfRW1xdWO_AEvX4aCYEPr_YZs49cBA==

GET
H2 200 32.006d9a64.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 5 KB
2 KB 43ms
43ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/32.006d9a64.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

3a20dd690bb8b873e65040ac190e289a3c2d6c4debee865f4619f306cf2c9544

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 09 Mar 2021 22:48:12 GMT
content-encoding: gzip
age: 493944
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 09 Mar 2021 22:48:10 GMT
server: nginx
etag: W/"e75834d1c478af776c281151aa135393"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: y4pEWgsXqSLwckn.h937t1UY2XlTGCpb
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: PA0yhrW0svFdCGSBaoIyhMnSYYCSDA4C2gSWslKWJO4GCrbyREWtDA==

GET
H2 200 0.45eb4005.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 17 KB
6 KB 39ms
38ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/0.45eb4005.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

65d29e040c59a5e843952c3f0da27028455dc63372440602d129681883891276

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 07 Feb 2021 03:01:27 GMT
content-encoding: gzip
age: 3157149
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:44 GMT
server: nginx
etag: W/"7e689afacd5eb298702f393c9c2f70f8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: MLQlqLUzDNkCLNl67wPUbjWUqeQs3jI3
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: HKyB3m1t_kTFb2WwxW35iXHhCzAIMkVudo2Qrbbj5AQWW-BG3Mg-TQ==

GET
H2 200 31.e776e5b0.chunk.css
rc-fast-lane.js.driftt.com/core/assets/css/ Frame B4CF 6 KB
1 KB 40ms
39ms Stylesheet
text/css 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/css/31.e776e5b0.chunk.css

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

f8e3f110b75b3f1951f50fb7795c6eaf5bee4f07b787a1b535b39e734c7f1723

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Jan 2021 17:43:12 GMT
content-encoding: gzip
age: 5782644
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 07 Jan 2021 17:42:48 GMT
server: nginx
etag: W/"9f36443a9402e1e03bf8070ddc88b8db"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: rdUZJDsKnUZQ3WGIO327z8myEGngjgBC
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: XErRzN0vaeBIKNyAtCM9AZnBO5ZrUC30uKIpg5TYXznbzTqW6VfAeg==

GET
H2 200 31.097eee16.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 2 KB
2 KB 40ms
40ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/31.097eee16.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

7cc5de02e755067bd3c580c61e3cbe314b42aad5fc2e1a8219a22020048c8caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 09 Mar 2021 22:48:12 GMT
content-encoding: gzip
age: 493944
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 09 Mar 2021 22:48:10 GMT
server: nginx
etag: W/"3812ca4c1f28ecca4240842e05a0c358"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: DiBIjCxoxUT7WxYRHhJS16i.oFW3IZp2
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: SERFSoLHKAIxRXQN3RSt6WgMJS6fY4yN-LT7cAwl-A25-TR0V6hY0Q==

GET
H2 200 1.0af467a5.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 68 KB
20 KB 37ms
34ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/1.0af467a5.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

817c7a8de5f73b3bd9358babbbd8f904fa639279f18bc86d320fcfb7fcfa8485

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 05 Feb 2021 05:46:16 GMT
content-encoding: gzip
age: 3320060
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 04 Feb 2021 22:21:53 GMT
server: nginx
etag: W/"aedd244e100709f43b70a84bb3945ca6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: pPrzDrBK9ZBlTQmhxNukoojbq71cvxgM
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 6SVJwCMXIjSN4m0Px_4-nK9d6OCBkrUXbrDjk9k8hD2EFDm7NGjybg==

GET
H2 200 24.07aa08a5.chunk.css
rc-fast-lane.js.driftt.com/core/assets/css/ Frame B4CF 7 KB
2 KB 41ms
37ms Stylesheet
text/css 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/css/24.07aa08a5.chunk.css

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 08 Feb 2021 18:30:13 GMT
content-encoding: gzip
age: 3015023
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 08 Feb 2021 18:30:03 GMT
server: nginx
etag: W/"189aeffd571884559dababa22c66d75a"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: j7XQqoa6b.VpGoAHtHWYYAuyCKDvQIC2
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 08V3t8MAHidP46BEOmdGkmD4Sm3dOb8n95XbwEPCq7eKolig2r8HHQ==

GET
H2 200 24.d1e2ba0d.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 38 KB
13 KB 47ms
43ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/24.d1e2ba0d.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

8509f8b66ce83784c82b29f557979cee1cdeafcfa4ea5b43e6301700ac1d6332

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 12 Feb 2021 04:13:45 GMT
content-encoding: gzip
age: 2720811
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 11 Feb 2021 15:02:24 GMT
server: nginx
etag: W/"f2a5c91c1591ed94eeaed7fae317b092"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: mI64OeTZXtdtDVAbBDB4VSw2IQR8RXt9
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: JwYZdHaSJaEdc0Xt3ctEvOFR3voSw7W5oAhkP2HPLjRPHBuRf6NfiA==

GET
H2 200 20.ec5afb3b.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 50 KB
14 KB 44ms
41ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/20.ec5afb3b.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

16bab25394f47e60db69b3a75ace1574b150a268353e17096619ba5ba96e208d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 27 Jan 2021 20:49:37 GMT
content-encoding: gzip
age: 4043459
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 27 Jan 2021 20:49:24 GMT
server: nginx
etag: W/"3cd2b5a6bcf9f406aacdee5be662461f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: NS7O4deD7g..sW02_GzJRmiko3q1dssb
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: dLa4kCkOiUFeb0bkk7AgAzJk0QnUWSHjDzzaUitx0fUUyM2H2R3pMQ==

GET
H2 200 2.497d9c43.chunk.css
rc-fast-lane.js.driftt.com/core/assets/css/ Frame B4CF 1 KB
1 KB 41ms
38ms Stylesheet
text/css 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/css/2.497d9c43.chunk.css

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

9066c399df39fc448ea3597ef0b67e9f987a58d466b3dd3a61b1d505e18516eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 28 Jan 2021 06:32:18 GMT
content-encoding: gzip
age: 4008497
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 27 Jan 2021 22:05:00 GMT
server: nginx
etag: W/"53a4a9c8842e24b41fd0229969b6d146"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: g73Bp0evdEsPlQRKEwaO5dAec2yNuDpH
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 315W0FDlOqVuwOoKyKCJ9-Vc90mrSG8ztTw-ZTgp9o-9D64I2Lt-gg==

GET
H2 200 2.71f04a13.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 27 KB
10 KB 45ms
42ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/2.71f04a13.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

df0e1ab988d451dcf5eaca26de327dc716a2cbc85bd348aa33d4a42a5f996d66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 19:35:31 GMT
content-encoding: gzip
age: 937505
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 04 Mar 2021 19:35:05 GMT
server: nginx
etag: W/"983fafe09a6e34607464014289317ed0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: em0d.vqqgX5nL_0aHT6C2FK8VQ9x3.Fo
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: hrH1fNMnoR2qlhZDv6F1bnjmQqw0A-FIsZYTWrcPq1kf2LwgT5dzZg==

GET
H2 200 23.401111da.chunk.css
rc-fast-lane.js.driftt.com/core/assets/css/ Frame B4CF 11 KB
3 KB 40ms
37ms Stylesheet
text/css 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/css/23.401111da.chunk.css

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

21a7fd6ffd2b55bfa0ccf4acfd4d9cc37e78151ce5cb9e65b2d665baafab02af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 19:35:16 GMT
content-encoding: gzip
age: 937520
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 04 Mar 2021 19:35:04 GMT
server: nginx
etag: W/"fd9003fd2c8558fd680914f594d24a3c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: QmQkIuOkoBGmArX2CO0Z5XYqPZLEo76z
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Qmf10LSUnXidbgXtBDYqfgU0PsE8W2BJccAKjw7LYZQMMXhSdtmG3w==

GET
H2 200 23.d97926a4.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 17 KB
7 KB 42ms
37ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/23.d97926a4.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

01ce75526fbe1b6dce324233fc46e7f15e7ae9efe2fbcfd6f8233384ead5277b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 19:35:16 GMT
content-encoding: gzip
age: 937520
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 04 Mar 2021 19:35:06 GMT
server: nginx
etag: W/"7fd6360c24f8735134dbc8681845283d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: SnuHpBOou2TqhwaUjn4Ru8f9ZM3XuqFo
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 5kMy_vRmrCFUqsIBXH6pHk755ipENEgukV2wOMRBTcAhMDyNNB7Sfg==

GET
H2 200 17.28004bc2.chunk.css
rc-fast-lane.js.driftt.com/core/assets/css/ Frame B4CF 10 KB
3 KB 40ms
39ms Stylesheet
text/css 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/css/17.28004bc2.chunk.css

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

6f5de1c3d3d57632417dc1dc3c3a9584d1c3b17a8898b92f3f4da70543222db8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 02:45:39 GMT
content-encoding: gzip
age: 7737297
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 11 Dec 2020 15:22:03 GMT
server: nginx
etag: W/"dfe1e2142b4a23188626765b3975457f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: dRfaoBwXg7lMmQAL_T483L5WizTGPHvJ
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 9nJ63TFCom8PfmRG2F6_igRLPDd7RzxHgoNadvzcIyNLaFDoId8yYA==

GET
H2 200 17.032f33d9.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 16 KB
6 KB 40ms
37ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/17.032f33d9.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

787db1c0a78ac6ebc0acecdbc222455f2f113fd0d1b631af04b57bfdccdd04c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 19:35:16 GMT
content-encoding: gzip
age: 937520
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 04 Mar 2021 19:35:05 GMT
server: nginx
etag: W/"4ab91c521005334ce8bae10ea8e660bd"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: m4i6_UkhCET4SoUFA0SOFJeW6s1fgi4Y
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: PPZYgBQ4O0oVMc5rlgKbC3fuev0PqF6_sqAf2E3EiD3eQQJpFMDEYw==

GET
H2 200 14.5fd8bdaf.chunk.css
rc-fast-lane.js.driftt.com/core/assets/css/ Frame B4CF 32 KB
6 KB 41ms
39ms Stylesheet
text/css 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/css/14.5fd8bdaf.chunk.css

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

6c6e96f0ca3b8dd53783957016e257a37442b01987bcd0cd0f8f952d261f11c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 19:35:16 GMT
content-encoding: gzip
age: 937520
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 04 Mar 2021 19:35:04 GMT
server: nginx
etag: W/"628da88a35791623b07d0baf08471856"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 1f5_UwhyoKTXhIH9Gr3Ieg3ul1dLbhMn
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: OadlVOAik2IwOZnOCNiJHASsbJ_w_CdhGOFYMHPG_Ynb7F_9U7ZDTQ==

GET
H2 200 14.d2904d5e.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 64 KB
19 KB 40ms
38ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/14.d2904d5e.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

408b59dca880b3a79fe69a8609c87ca6b680b1ce701d88cbce6101d279559c54

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 13:49:32 GMT
content-encoding: gzip
age: 7863
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 13:49:30 GMT
server: nginx
etag: W/"a8492d71ff56722e0e76d8f8f509a9aa"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: AhoupklkqCI0F8ifzbDav_2HEttDNmQq
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: lqVBuQTTGZGEY3GONWVNgH6ioQ37qoYn9H7ZyLurlRS1xToOxWzpBQ==

GET
H2 200 19.ad288f08.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 18 KB
6 KB 41ms
39ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/19.ad288f08.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

1c17b4f782ea41735ea096c4fdacb9a2b62feed4efc2ab130bd0132919af3ac7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 13:49:32 GMT
content-encoding: gzip
age: 7864
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 13:49:30 GMT
server: nginx
etag: W/"b812432f4936ca6e27afbeef0c9f32e4"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: r4QrDPmNMTL_FE6ysdKRPwpJTpzkA0Xs
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: wpddY19jG3WvWykqAZWlu7VQDFewf9X9cI-1Cz3piEqClhmoabmwjA==

GET
H2 200 27.d575826f.chunk.css
rc-fast-lane.js.driftt.com/core/assets/css/ Frame B4CF 10 KB
2 KB 41ms
40ms Stylesheet
text/css 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/css/27.d575826f.chunk.css

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

f8981397ca0b967449e9e9208109a2762f25d0edf7d7e458788592b6438e5fcc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 09 Mar 2021 22:48:12 GMT
content-encoding: gzip
age: 493944
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 09 Mar 2021 22:48:08 GMT
server: nginx
etag: W/"d70456ae6ec3d990da312845907053b4"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Ws4HVzrt77KlCfPM3WsiDOc9dSppfIdV
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: hdX7LG3znFDFpLfYFtA-cOGOfzUOOHLqqx0cDDglfdHaeml2Pdascg==

GET
H2 200 27.01448788.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 17 KB
7 KB 41ms
40ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/27.01448788.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

2873d6a697066988a7c518ff3b6879df210054eca5df4f1bceb0095caa568b48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 13:49:32 GMT
content-encoding: gzip
age: 7864
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 13:49:31 GMT
server: nginx
etag: W/"bb79a9c1ec9d962ca532e347e90d71e8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: EMIGGyNdxFI.uOd8sLqbFhyMfg4cM_oY
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: B3rVbN6pNb-7rj09MMaJNlioDVb9nOkgzQm8eFI6unxdO5nBMXW8fw==

GET
H2 200 36.56cefaf3.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame C70B 6 KB
3 KB 158ms
157ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/36.56cefaf3.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

e9f1723d153401796dcde6f2d1fbf9a6e2181ac7e94049fc88126fbff1abd38d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:37 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:06 GMT
server: nginx
etag: W/"199a90762d66f2a85b69771e3ad0d5d5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: HnCOdfXmjSgZ7sdmbWuqxTPk3Pck6bCN
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: suHlckr0BW2gq_a2XHQ8rBGU1PZdx2WV1hNb5nZATyr8Cr-zJq_3iw==

GET
H2 200 34.fe729046.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame C70B 107 KB
35 KB 163ms
161ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/34.fe729046.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

ff04dd81bb93731c0d1f8e7d384b370f26b93f4352980404fcdc4518e386bedd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:37 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:06 GMT
server: nginx
etag: W/"b75bf38c8eee61f620998bf4e506f0a8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: uLynY4sRb11xVn5M41h.fKhkYQT2BH.L
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: HBkNFhBm4Lm-IjqCU38Jr8zL3S-xFUODJNLwqFzwB4fku1u920r6Kg==

GET
H2 200 26.91e0f92d.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame C70B 27 KB
9 KB 156ms
156ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/26.91e0f92d.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

457b4bd3410faf074da387900f87abc1e845269e857219560bce3ead8260d103

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:37 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:06 GMT
server: nginx
etag: W/"2203aa06cd7f5410d671168ef758e8ca"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Ws14_AYdtdLaFVaNxmj79qanmL3p8Abv
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 0b6HRISJGJ1WJiQi7V23ayw8FOjIrRFGvugalEdh2aHSbLN180UvXQ==

GET
H2 200 32.92beb56c.chunk.css
rc-fast-lane.js.driftt.com/core/assets/css/ Frame C70B 2 KB
1 KB 154ms
154ms Stylesheet
text/css 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/css/32.92beb56c.chunk.css

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

11c0f76b0414f025f6d8790a111f70421b4b0e816a93317188736671360192ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:37 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:04 GMT
server: nginx
etag: W/"1103e1501b63c165063174303b93cb83"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: _1rbllfOqmXSfEAzO8DDpcuWKQrMYUdW
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: pk-AItr2IbWri2UXO5I3h2whrHh3qEHzLpV577n7SF0WnRpIh53ynQ==

GET
H2 200 32.006d9a64.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame C70B 5 KB
2 KB 155ms
154ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/32.006d9a64.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

3a20dd690bb8b873e65040ac190e289a3c2d6c4debee865f4619f306cf2c9544

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:37 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:06 GMT
server: nginx
etag: W/"e75834d1c478af776c281151aa135393"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: N_4Jdtko9fU7KS.uygi9MPeWmRxkXJDK
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Lfg8EQrYdwI6UW-WKindUZQeEkuIEbZP9Xg-wLuLsnVggziYAujMpQ==

GET
H2 200 0.45eb4005.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame C70B 17 KB
6 KB 335ms
328ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/0.45eb4005.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

65d29e040c59a5e843952c3f0da27028455dc63372440602d129681883891276

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:37 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:05 GMT
server: nginx
etag: W/"7e689afacd5eb298702f393c9c2f70f8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: t7Jqj2Q6jYxfBmfpOTcdd.E6nirU8dmy
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ujjwCf359VqeAmnWKXt-Kwm5psc6IDhhvg9oht2ihcn3FtIIrAHbRg==

GET
H2 200 1.0af467a5.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame C70B 68 KB
20 KB 163ms
156ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/1.0af467a5.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

817c7a8de5f73b3bd9358babbbd8f904fa639279f18bc86d320fcfb7fcfa8485

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:37 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:05 GMT
server: nginx
etag: W/"aedd244e100709f43b70a84bb3945ca6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 9s7sre2T8Xk.fsvgF45GWDwo7XMzPLFu
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: qrAgj_kHaNQ-uux0byOOXpVRdTaqfc5qlCa4hUjmWdbM9i_rb3_dUA==

GET
H2 200 28.973133ca.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame C70B 41 KB
12 KB 159ms
155ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/28.973133ca.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

8b695f56517b6e927c365dfc1f09b6cedfafb869183074b0040399c4960a77c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:37 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:06 GMT
server: nginx
etag: W/"ecf99724b02f7b23e01b9717ae480786"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: AnpetJY2LFGNLbc8Ovs.UjpS8oB3XUsY
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: QFXFM6WkYxUhKw-rLUJZCa6aSjUAvOz1P9yD6PKhAAJpUqcacclNMA==

GET
H2 200 2.497d9c43.chunk.css
rc-fast-lane.js.driftt.com/core/assets/css/ Frame C70B 1 KB
1 KB 157ms
154ms Stylesheet
text/css 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/css/2.497d9c43.chunk.css

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

9066c399df39fc448ea3597ef0b67e9f987a58d466b3dd3a61b1d505e18516eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:37 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:04 GMT
server: nginx
etag: W/"53a4a9c8842e24b41fd0229969b6d146"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: L4R9eLpHEmvbbrOZ5lwbA03TIGVcHoAd
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: cPbjv1SthR76qACyxhnahdccnhODuhAc-Wo1ZbZDf54NZEDO4tRLYQ==

GET
H2 200 2.71f04a13.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame C70B 27 KB
10 KB 163ms
160ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/2.71f04a13.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

df0e1ab988d451dcf5eaca26de327dc716a2cbc85bd348aa33d4a42a5f996d66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:37 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:06 GMT
server: nginx
etag: W/"983fafe09a6e34607464014289317ed0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: ZRD6xe7Gw.C67kvZ8Ny47axExtTTQaux
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Ygo8G3FjnTg5le0qijPxmzcd27hhAPsEWdrTsJHV8phnv8xXj4eRjg==

GET
H2 200 25.02e62d23.chunk.css
rc-fast-lane.js.driftt.com/core/assets/css/ Frame C70B 8 KB
2 KB 330ms
329ms Stylesheet
text/css 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/css/25.02e62d23.chunk.css

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

475dbccf84ca50f8d13df95ef5a85c58198fd65fefa481850453de7feb2d4bb2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:37 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:04 GMT
server: nginx
etag: W/"4a7ea3158114815c3ce4a439e64bb20f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: DM6N5c3u_UHWtuORL.AwHTyeASNgTjVJ
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: inVPvgSByE2CspdcL1UFMiQSy9BIGMOLFZauf6MeLZlYyzK9kRriIQ==

GET
H2 200 25.cfbdda59.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame C70B 65 KB
19 KB 158ms
158ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/25.cfbdda59.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

f185fcfb4f993dd716a2e82b7e203fc719a5403f2f597bdf38a398552b889707

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:37 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:06 GMT
server: nginx
etag: W/"f390de0b8d6e5d6cb5d2a6d8927956e3"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: eXV8VBBsJAD2sbwBcZP2haY4Ay_8_IFh
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: BqFQTfcLRe9ljQ3dE1xOSMX885l1YFZllWLRMILrD4XlUaRtYoL2Gg==

GET
H2 200 28krvx2uf9n3.json Show response
embeds.driftcdn.com/embeds/ Frame C70B 104 KB
17 KB 497ms
423ms XHR
application/json 13.226.159.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://embeds.driftcdn.com/embeds/28krvx2uf9n3.json
Requested by: Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/38.feef3c6b.chunk.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.159.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-159-45.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 75bbd66c9610b8e4d1e21d85e16832f31913d8492771ee642bf71ee837e680eb

Request headers

Accept: application/json, text/plain, */*
Referer: https://rc-fast-lane.js.driftt.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:39 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 10:09:00 GMT
server: AmazonS3
etag: W/"2c69812b995202fccd0c38c71d85fba3"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json; charset=UTF-8
via: 1.1 0406d08716a9781a5c19ff86db2debd3.cloudfront.net (CloudFront)
cache-control: public, max-age=30
x-amz-cf-id: YpsruhZbisiLyIHxGsUEzH2joqoi2hwHbO0kCMWeXuWBbajQD86rwA==

POST
H/1.1 200
OK v2 Show response
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame C70B 25 B
697 B 122ms
121ms XHR
application/json 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/widget/init/v2

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-16-7-188.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://rc-fast-lane.js.driftt.com/
Authorization
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 15 Mar 2021 16:00:38 GMT
server: istio-envoy
requestid: efce114fdaf10865
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
x-envoy-upstream-service-time: 12
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 25
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

OPTIONS
H/1.1 200
OK v2
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame 0
0 441ms
108ms Preflight
text/plain 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/widget/init/v2

Protocol

HTTP/1.1

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-16-7-188.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://rc-fast-lane.js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 15 Mar 2021 16:00:38 GMT
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/plain
allow: POST,OPTIONS
requestid: drifte88fca04442806f22f73905c607
content-length: 13
x-envoy-upstream-service-time: 0
server: istio-envoy

GET
H2 200 43.0bd3f7fc.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame C70B 17 KB
6 KB 148ms
147ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/43.0bd3f7fc.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

f79a8aa00d3bd94f428463ac9c44896172d23e0f0f6d6fe4f05f1c9b593e702c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=791a334e-5f14-4e88-b36c-550e8f946192&sessionStarted=1615824036&campaignRefreshToken=cffcdefa-4324-493d-8a79-1bc28e7cd01e&pageLoadStartTime=1615824032601
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:38 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 15 Mar 2021 14:53:06 GMT
server: nginx
etag: W/"533cfc95735c653dd37e8e6b8d17383d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: d3WXBd0z_T6cOnTQL4v2jA8dubJ_6Gqf
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: tr0V8PmdavgGpEwu--WmzPJJUZi12uUf30t-OYbW5Z7KyBNs8QxBIg==

POST
H2 200 widget_bootstrap Show response
bootstrap.api.drift.com/ Frame C70B 6 KB
3 KB 892ms
666ms XHR
application/json 52.22.71.46
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://bootstrap.api.drift.com/widget_bootstrap

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.22.71.46 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-22-71-46.compute-1.amazonaws.com

Software

Resource Hash

1f9824ab7b3afb7b3b24e128c01bbd598e0424ea032eae7964b1feae12ee07b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://rc-fast-lane.js.driftt.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 15 Mar 2021 16:00:39 GMT
content-encoding: gzip
requestid: 7e2487012ea6f0de
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 2293
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

OPTIONS
H2 200 28krvx2uf9n3
targeting.api.drift.com/hours/availability/combined/ Frame 0
0 324ms
107ms Preflight
text/plain 100.24.186.63
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/hours/availability/combined/28krvx2uf9n3

Protocol

Server

100.24.186.63 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization
Origin: https://rc-fast-lane.js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 15 Mar 2021 16:00:40 GMT
content-type: text/plain
content-length: 18
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
allow: HEAD,GET,OPTIONS
requestid: driftb673f584ccc83c0fb1909faecd2

OPTIONS
H2 200 track
event.api.drift.com/ Frame 0
0 326ms
107ms Preflight
text/plain 54.145.60.34
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://event.api.drift.com/track

Protocol

Server

54.145.60.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-145-60-34.compute-1.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://rc-fast-lane.js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 15 Mar 2021 16:00:40 GMT
content-type: text/plain
content-length: 13
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
allow: POST,OPTIONS
requestid: drift869e38741e180193f4e7a239935

GET
H2 200 28krvx2uf9n3 Show response
targeting.api.drift.com/hours/availability/combined/ Frame C70B 53 B
496 B 838ms
838ms XHR
application/json 100.24.186.63
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/hours/availability/combined/28krvx2uf9n3

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.186.63 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

862023af41d657861a71dd6c293d995b1a758a36e5d7ece5b71ddf27c1497faa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://rc-fast-lane.js.driftt.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI4OTYyOTc3ODA1IiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTQ1Mjg2OCIsImV4cCI6MTY0NzM2MDAzOSwiaWF0IjoxNjE1ODI0MDM5fQ.06if3F_QkqKF0ubr-cG7v9Ye17JcZMF2chaHRGCGKCxyy-oNdecjwsjyRt4BXRyIEEkEpheXCKOgYUC-hxhn5g

Response headers

date: Mon, 15 Mar 2021 16:00:40 GMT
requestid: 5d681cc3d222e605
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 53
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

GET
H2 200 css
fonts.googleapis.com/ Frame C70B 4 KB
752 B 14ms
14ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open%20Sans|Open%20Sans:bold&display=swap

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/2.71f04a13.chunk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1476c101cda6283fbd6a7b4381767b7ecde6d8e1bd871dd43bfba89f1b950a87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://rc-fast-lane.js.driftt.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 15 Mar 2021 15:52:21 GMT
server: ESF
date: Mon, 15 Mar 2021 16:00:39 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 15 Mar 2021 16:00:39 GMT

POST
H2 200 track Show response
event.api.drift.com/ Frame C70B 607 B
1 KB 108ms
108ms XHR
application/json 54.145.60.34
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://event.api.drift.com/track

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.145.60.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-145-60-34.compute-1.amazonaws.com

Software

Resource Hash

1cc05ae98d289f46b27a5a8f80fdfaa83b0222ce74e68b845aa3d08a0c2c9f97

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://rc-fast-lane.js.driftt.com/
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI4OTYyOTc3ODA1IiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTQ1Mjg2OCIsImV4cCI6MTY0NzM2MDAzOSwiaWF0IjoxNjE1ODI0MDM5fQ.06if3F_QkqKF0ubr-cG7v9Ye17JcZMF2chaHRGCGKCxyy-oNdecjwsjyRt4BXRyIEEkEpheXCKOgYUC-hxhn5g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 15 Mar 2021 16:00:40 GMT
requestid: 2b4190e0ebee2d5a
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 607

GET
H2 200 43.0bd3f7fc.chunk.js Show response
rc-fast-lane.js.driftt.com/core/assets/js/ Frame B4CF 17 KB
6 KB 36ms
36ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/core/assets/js/43.0bd3f7fc.chunk.js

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/runtime~main.04b859d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

f79a8aa00d3bd94f428463ac9c44896172d23e0f0f6d6fe4f05f1c9b593e702c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rc-fast-lane.js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 07 Feb 2021 02:23:35 GMT
content-encoding: gzip
age: 3159424
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:45 GMT
server: nginx
etag: W/"533cfc95735c653dd37e8e6b8d17383d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: ERTUxDMtR8wGkYOicn7jsyBINk5Gat3C
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: v3AU3FtIdXZlSDwJo-Zp5xs2PqTX9Mg7Q1PA7wNp-xGxqwjzhlwweQ==

GET
H3-Q050 200 css
fonts.googleapis.com/ Frame B4CF 4 KB
1 KB 45ms
30ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open%20Sans|Open%20Sans:bold&display=swap

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/2.71f04a13.chunk.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1476c101cda6283fbd6a7b4381767b7ecde6d8e1bd871dd43bfba89f1b950a87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://rc-fast-lane.js.driftt.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 15 Mar 2021 14:27:31 GMT
server: ESF
date: Mon, 15 Mar 2021 16:00:39 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 15 Mar 2021 16:00:39 GMT

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0b.woff2
fonts.gstatic.com/s/opensans/v18/ Frame B4CF 14 KB
14 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0b.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open%20Sans|Open%20Sans:bold&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 11 Mar 2021 02:04:09 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:22 GMT
server: sffe
age: 395790
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14380
x-xss-protection: 0
expires: Fri, 11 Mar 2022 02:04:09 GMT

GET
H2 200 mem5YaGs126MiZpBA-UN7rgOUuhp.woff2
fonts.gstatic.com/s/opensans/v18/ Frame B4CF 15 KB
15 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN7rgOUuhp.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open%20Sans|Open%20Sans:bold&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74201a4b97ec1d5e86252dd0180eafd8c5378a9235864dbcd682f3575b41c85b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 08 Mar 2021 18:15:32 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:11:00 GMT
server: sffe
age: 596707
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15056
x-xss-protection: 0
expires: Tue, 08 Mar 2022 18:15:32 GMT

OPTIONS
H/1.1 200
OK bulk
metrics.api.drift.com/monitoring/metrics/event2/ Frame 0
0 110ms
109ms Preflight
text/plain 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/event2/bulk

Protocol

HTTP/1.1

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-16-7-188.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://rc-fast-lane.js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 15 Mar 2021 16:00:40 GMT
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/plain
allow: POST,OPTIONS
requestid: drift881d3864df9b85c42f0bf900e2c
content-length: 13
x-envoy-upstream-service-time: 1
server: istio-envoy

POST
H/1.1 200
OK bulk Show response
metrics.api.drift.com/monitoring/metrics/event2/ Frame C70B 25 B
697 B 128ms
128ms XHR
application/json 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/event2/bulk

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-16-7-188.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://rc-fast-lane.js.driftt.com/
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI4OTYyOTc3ODA1IiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTQ1Mjg2OCIsImV4cCI6MTY0NzM2MDAzOSwiaWF0IjoxNjE1ODI0MDM5fQ.06if3F_QkqKF0ubr-cG7v9Ye17JcZMF2chaHRGCGKCxyy-oNdecjwsjyRt4BXRyIEEkEpheXCKOgYUC-hxhn5g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 15 Mar 2021 16:00:40 GMT
server: istio-envoy
requestid: fedb169191f85b29
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
x-envoy-upstream-service-time: 16
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 25
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

OPTIONS
H2 200 evaluate_with_log
targeting.api.drift.com/targeting/ Frame 0
0 108ms
107ms Preflight
text/plain 100.24.186.63
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/targeting/evaluate_with_log

Protocol

Server

100.24.186.63 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://rc-fast-lane.js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 15 Mar 2021 16:00:41 GMT
content-type: text/plain
content-length: 13
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
allow: POST,OPTIONS
requestid: drift9ef22be49979d0258e682ae2fef

POST
H2 200 evaluate_with_log Show response
targeting.api.drift.com/targeting/ Frame C70B 2 KB
1 KB 107ms
107ms XHR
application/json 100.24.186.63
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/targeting/evaluate_with_log

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.186.63 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

894b0b270323ecaa628bc0a2f138bd4f895b09c75f29d7737993ab1a8e23ef3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://rc-fast-lane.js.driftt.com/
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI4OTYyOTc3ODA1IiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTQ1Mjg2OCIsImV4cCI6MTY0NzM2MDAzOSwiaWF0IjoxNjE1ODI0MDM5fQ.06if3F_QkqKF0ubr-cG7v9Ye17JcZMF2chaHRGCGKCxyy-oNdecjwsjyRt4BXRyIEEkEpheXCKOgYUC-hxhn5g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 15 Mar 2021 16:00:41 GMT
content-encoding: gzip
requestid: c8bad0876bbbac5a
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 705
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

OPTIONS
H/1.1 200
OK render_initial
flow.api.drift.com/flows/ Frame 0
0 449ms
112ms Preflight
text/plain 3.94.218.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://flow.api.drift.com/flows/render_initial

Protocol

HTTP/1.1

Server

3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-94-218-138.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://rc-fast-lane.js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 15 Mar 2021 16:00:41 GMT
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/plain
allow: POST,OPTIONS
requestid: drift142dfff4873a5a430d470e21181
content-length: 13
x-envoy-upstream-service-time: 0
server: istio-envoy

POST
H/1.1 200
OK render_initial Show response
flow.api.drift.com/flows/ Frame C70B 4 KB
3 KB 154ms
154ms XHR
application/json 3.94.218.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://flow.api.drift.com/flows/render_initial

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-94-218-138.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

58169511472cd541a264a8e027e479ba9bc66fa0b95406721fa62dc413c1ac9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://rc-fast-lane.js.driftt.com/
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI4OTYyOTc3ODA1IiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTQ1Mjg2OCIsImV4cCI6MTY0NzM2MDAzOSwiaWF0IjoxNjE1ODI0MDM5fQ.06if3F_QkqKF0ubr-cG7v9Ye17JcZMF2chaHRGCGKCxyy-oNdecjwsjyRt4BXRyIEEkEpheXCKOgYUC-hxhn5g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 15 Mar 2021 16:00:41 GMT
content-encoding: gzip
server: istio-envoy
requestid: 6c117a64b62a50fd
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
x-envoy-upstream-service-time: 42
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 2021
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

OPTIONS
H2 200 widget
targeting.api.drift.com/impressions/ Frame 0
0 107ms
107ms Preflight
text/plain 100.24.186.63
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/impressions/widget

Protocol

Server

100.24.186.63 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://rc-fast-lane.js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 15 Mar 2021 16:00:41 GMT
content-type: text/plain
content-length: 13
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
allow: POST,OPTIONS
requestid: drift25f539643ed956337098cd3a505

POST
H2 204 widget Show response
targeting.api.drift.com/impressions/ Frame C70B 0
380 B 115ms
115ms XHR
text/plain 100.24.186.63
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/impressions/widget

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.186.63 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://rc-fast-lane.js.driftt.com/
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI4OTYyOTc3ODA1IiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTQ1Mjg2OCIsImV4cCI6MTY0NzM2MDAzOSwiaWF0IjoxNjE1ODI0MDM5fQ.06if3F_QkqKF0ubr-cG7v9Ye17JcZMF2chaHRGCGKCxyy-oNdecjwsjyRt4BXRyIEEkEpheXCKOgYUC-hxhn5g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 15 Mar 2021 16:00:42 GMT
requestid: 3a80aa81be6aaa11
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

GET
H2 200 https%3A%2F%2Fdriftt.imgix.net%2Fhttps%253A%252F%252Fs3.amazonaws.com%252Fcustomer-api-avatars-prod%252F2106400%252F13690614ba4dc30e40747e74e1535a5adzn4mi89fik3%3Ffit%3Dmax%26fm%3Dpng%26h%3D200%26w...
driftt.imgix.net/ Frame C70B 26 KB
26 KB 22ms
6ms Image
image/png 2a04:4e42:1b::720
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://driftt.imgix.net/https%3A%2F%2Fdriftt.imgix.net%2Fhttps%253A%252F%252Fs3.amazonaws.com%252Fcustomer-api-avatars-prod%252F2106400%252F13690614ba4dc30e40747e74e1535a5adzn4mi89fik3%3Ffit%3Dmax%26fm%3Dpng%26h%3D200%26w%3D200%26s%3D3d628948700c6adffa763ed302d1aec1?fit=max&fm=png&h=200&w=200&s=b89b9dce21f66015eedf860da053c36f

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::720 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

imgix /

Resource Hash

11a41838971be0f75a5c082cfc1d6a648846a20140750a0f616e239e4f97b3f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://rc-fast-lane.js.driftt.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 16:00:41 GMT
x-content-type-options: nosniff
last-modified: Sat, 06 Feb 2021 01:05:07 GMT
server: imgix
age: 3250534
x-cache: HIT, HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=315360000
x-imgix-id: 77c60c9066aae2191ffc547c4d7c96cd8f35e6ba
accept-ranges: bytes
content-length: 26435
x-served-by: cache-sjc10072-SJC, cache-hhn4072-HHN

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0b.woff2
fonts.gstatic.com/s/opensans/v18/ Frame C70B 14 KB
14 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0b.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open%20Sans|Open%20Sans:bold&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://rc-fast-lane.js.driftt.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 11 Mar 2021 02:04:09 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:22 GMT
server: sffe
age: 395792
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14380
x-xss-protection: 0
expires: Fri, 11 Mar 2022 02:04:09 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
82 B 13ms
13ms XHR
text/plain 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j88&aip=1&a=742120417&t=event&ni=1&_s=1&dl=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&ul=en-us&de=UTF-8&dt=AutoHotKey%20Leveraged%20by%20Metamorfo%2FMekotio%20Banking%20Trojan&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Drift%20Widget&ea=Playbook%20Fired&el=Playbook%20ID%3A%202216778&_u=aHDAAUADQAAAAG~&jid=2032102632&gjid=1787694309&cid=1639249986.1615824035&tid=UA-114787942-1&_gid=1024769513.1615824035&_r=1&gtm=2wg3305RQ37KH&z=280634909

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 Mar 2021 16:00:41 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cofense.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
70 B 15ms
14ms XHR
text/plain 2a00:1450:400c:c09::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j88&tid=UA-114787942-1&cid=1639249986.1615824035&jid=2032102632&gjid=1787694309&_gid=1024769513.1615824035&_u=aHDAAUADQAAAAG~&z=755388285

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c09::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 15 Mar 2021 16:00:41 GMT
content-type: text/plain
access-control-allow-origin: https://cofense.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
111 B 30ms
29ms Image
image/gif 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-114787942-1&cid=1639249986.1615824035&jid=2032102632&_u=aHDAAUADQAAAAG~&z=867028200

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 Mar 2021 16:00:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 30ms
30ms Image
image/gif 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-114787942-1&cid=1639249986.1615824035&jid=2032102632&_u=aHDAAUADQAAAAG~&z=867028200

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 Mar 2021 16:00:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 4.0381974b.chunk.js Show response
rc-fast-lane.js.driftt.com/conductor/assets/ 158 B
817 B 42ms
41ms Script
application/javascript 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/conductor/assets/4.0381974b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1615824300000/28krvx2uf9n3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

f07b38fe121113f08e9d2f04c361cdd0b08d9b18f37bf22a0fd20a3cd79d90f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 13:55:45 GMT
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
age: 7496
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 158
last-modified: Mon, 15 Mar 2021 13:49:37 GMT
server: nginx
etag: "a4d711395522219497203ab311efdce9"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Yf.vc2RYh5DzmjIB8AO9VgBWlJS9P2mG
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
content-type: application/javascript
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: hrZPmw9ltTQc_DQHiJc-ymhmi-BMT0gyltWvEx9QSPr5YEgn7An60g==

GET
H2 206 notification.d46d7db1.mp3
rc-fast-lane.js.driftt.com/conductor/assets/media/ 20 KB
21 KB 60ms
60ms Media
audio/mpeg 13.226.159.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rc-fast-lane.js.driftt.com/conductor/assets/media/notification.d46d7db1.mp3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.159.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-159-75.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

ad80ac33ed04b4e6d78167b4162ecd3d2e8c29d17b43eb3df1f35b216b2ac5c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://cofense.com/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range: bytes=0-

Response headers

date: Mon, 15 Mar 2021 14:13:58 GMT
via: 1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
age: 6404
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
Content-Range: bytes 0-20896/20897
Content-Length: 20897
last-modified: Mon, 15 Mar 2021 13:57:17 GMT
server: nginx
etag: "d46d7db110874da77e094dcbc4bec8e6"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: FaGWsqOmAYINybpa6UiCyzrMzba5qHC5
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
content-type: audio/mpeg
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: MhRKxm1mVMNybmtaaT3-KnlhtF_kZm5dLv8PACc-DztNcd6gLhJDZw==

POST
H/1.1 200
OK bulk Show response
metrics.api.drift.com/monitoring/metrics/add/ Frame C70B 25 B
696 B 111ms
110ms XHR
application/json 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/add/bulk

Requested by

Host: rc-fast-lane.js.driftt.com
URL: https://rc-fast-lane.js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-16-7-188.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://rc-fast-lane.js.driftt.com/
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI4OTYyOTc3ODA1IiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTQ1Mjg2OCIsImV4cCI6MTY0NzM2MDAzOSwiaWF0IjoxNjE1ODI0MDM5fQ.06if3F_QkqKF0ubr-cG7v9Ye17JcZMF2chaHRGCGKCxyy-oNdecjwsjyRt4BXRyIEEkEpheXCKOgYUC-hxhn5g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 15 Mar 2021 16:00:43 GMT
server: istio-envoy
requestid: d04a45393e9dec13
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 25
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

OPTIONS
H/1.1 200
OK bulk
metrics.api.drift.com/monitoring/metrics/add/ Frame 0
0 112ms
112ms Preflight
text/plain 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/add/bulk

Protocol

HTTP/1.1

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-16-7-188.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://rc-fast-lane.js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 15 Mar 2021 16:00:43 GMT
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/plain
allow: POST,OPTIONS
requestid: drift0490b7242b089831a0c16899447
content-length: 13
x-envoy-upstream-service-time: 0
server: istio-envoy

Verdicts & Comments Add Verdict or Comment

249 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

15 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.app-ab46.marketo.com/	1970-01-19 16:50:25	Name: __cf_bm Value: 918e9f61814d00d19d4ee38497763720981edef7-1615824034-1800-ATjsaaCuw4c65mm0R0/QUBCJ+u2SalTmpL15tNl4PlgqYjtt+JkHKmPbH4TGD05Zd7aheOpgzImVttq8nw7085E=
.cofense.com/	1970-01-19 19:00:00	Name: _fbp Value: fb.1.1615824035506.517265359
.cofense.com/	1970-01-20 01:36:00	Name: __ar_v4 Value: %7CTFV7KNIV3VHWLJ6GAQ3KFT%3A20210314%3A1%7CJLU6TD3D6FA2JAELGSQWLD%3A20210314%3A1%7CLZCH7AGKEBFGLOFOIHTG7Q%3A20210314%3A1
.cofense.com/	1970-01-19 16:50:25	Name: _hjFirstSeen Value: 1
.cofense.com/	1970-01-19 16:50:25	Name: attr_last Value: %7B%22source%22%3A%22(direct)%22%2C%22medium%22%3A%22(none)%22%2C%22campaign%22%3A%22(not%20set)%22%2C%22term%22%3A%22(not%20provided)%22%2C%22content%22%3A%22(not%20set)%22%2C%22lp%22%3A%22cofense.com%2Fblog%2Fautohotkey-banking-trojan%2F%22%2C%22date%22%3A%222021-03-15%22%2C%22timestamp%22%3A1615824034510%7D
.cofense.com/	1970-01-20 01:36:21	Name: __adroll_fpc Value: e1b724bb7977511e2e9b5f85a77871e6-1615824035352
.cofense.com/	1970-01-20 01:36:00	Name: _hjid Value: 017b6476-80dc-4d84-80e9-c1c8f86d3024
.cofense.com/	1970-01-20 10:21:36	Name: _ga Value: GA1.2.1639249986.1615824035
.cofense.com/	1970-01-19 16:50:24	Name: _dc_gtm_UA-114787942-1 Value: 1
.cofense.com/	1970-01-19 18:56:09	Name: _gaexp Value: GAX1.2.Y916st7_TUq9exzEKHDaPA.18789.1
.cofense.com/	1970-01-19 19:00:00	Name: _gcl_au Value: 1.1.77400273.1615824034
.cofense.com/	1970-01-20 10:21:36	Name: _ga_0HTW6C6HJS Value: GS1.1.1615824034.1.0.1615824034.0
cofense.com/	1970-01-19 16:50:25	Name: drift_campaign_refresh Value: cffcdefa-4324-493d-8a79-1bc28e7cd01e
.cofense.com/	1970-01-19 16:51:50	Name: _gid Value: GA1.2.1024769513.1615824035
.cofense.com/	1970-01-20 10:21:36	Name: attr_first Value: %7B%22source%22%3A%22(direct)%22%2C%22medium%22%3A%22(none)%22%2C%22campaign%22%3A%22(not%20set)%22%2C%22term%22%3A%22(not%20provided)%22%2C%22content%22%3A%22(not%20set)%22%2C%22lp%22%3A%22cofense.com%2Fblog%2Fautohotkey-banking-trojan%2F%22%2C%22date%22%3A%222021-03-15%22%2C%22timestamp%22%3A1615824034510%7D

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/jquery-migrate-1.4.1-wp.js?ver=1.4.1-wp(Line 23) Message: JQMIGRATE: Migrate is installed with logging active, version 1.4.1
console-api	warning	URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/jquery-migrate-1.4.1-wp.js?ver=1.4.1-wp(Line 56) Message: JQMIGRATE: jQuery.fn.load() is deprecated
console-api	log	URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/jquery-migrate-1.4.1-wp.js?ver=1.4.1-wp(Line 58) Message: console.trace
console-api	warning	URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/jquery-migrate-1.4.1-wp.js?ver=1.4.1-wp(Line 56) Message: JQMIGRATE: 'ready' event is deprecated
console-api	log	URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/jquery-migrate-1.4.1-wp.js?ver=1.4.1-wp(Line 58) Message: console.trace

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.yahoo.com
analytics.shareaholic.com
analytics.twitter.com
app-ab46.marketo.com
bootstrap.api.drift.com
cdn.iubenda.com
cdnjs.cloudflare.com
cm.g.doubleclick.net
cofense.com
connect.facebook.net
d.adroll.com
d.adroll.mgr.consensu.org
driftt.imgix.net
dsms0mj1bbhn4.cloudfront.net
dsum-sec.casalemedia.com
eb2.3lift.com
embeds.driftcdn.com
event.api.drift.com
flow.api.drift.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
hits-i.iubenda.com
ib.adnxs.com
js.driftt.com
lltrck.com
m9m6e2w5.stackpathcdn.com
metrics.api.drift.com
munchkin.marketo.net
partner.shareaholic.com
pi.pardot.com
pixel.advertising.com
pixel.rubiconproject.com
px.ads.linkedin.com
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
rc-fast-lane.js.driftt.com
s.adroll.com
script.hotjar.com
simage2.pubmatic.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
sync.outbrain.com
sync.taboola.com
t.co
t.sf14g.com
targeting.api.drift.com
us-u.openx.net
use.fontawesome.com
vars.hotjar.com
ws.zoominfo.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.iubenda.com
www.linkedin.com
www.shareaholic.net
x.bidswitch.net
100.24.186.63
104.16.94.80
104.244.42.195
104.244.42.197
107.20.140.231
108.161.188.228
13.226.159.122
13.226.159.3
13.226.159.45
13.226.159.75
13.226.159.79
141.226.228.48
142.250.185.226
142.250.186.130
151.139.128.11
18.158.85.202
18.184.153.186
184.73.100.94
185.33.220.244
185.64.190.80
199.232.136.157
2.17.181.202
23.111.9.35
2600:9000:2182:a400:c:d51b:4400:21
2606:4700::6810:125e
2606:4700::6810:650c
2620:119:50e1:101::6cae:b25
2620:1ec:21::14
2a00:1288:80:800::7000
2a00:1450:4001:800::2003
2a00:1450:4001:800::200e
2a00:1450:4001:802::2004
2a00:1450:4001:810::2003
2a00:1450:4001:813::2004
2a00:1450:4001:827::2008
2a00:1450:4001:828::200e
2a00:1450:4001:829::2002
2a00:1450:4001:82a::2003
2a00:1450:4001:82a::200a
2a00:1450:400c:c09::9d
2a02:26f0:2100:1a6::25ea
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a04:4e42:1b::720
3.248.28.111
3.94.218.138
34.253.2.147
34.98.64.218
35.174.150.168
35.188.168.180
46.101.132.18
50.16.7.188
52.22.71.46
52.28.196.155
52.44.242.176
54.145.60.34
54.147.47.240
64.202.112.127
65.9.58.125
69.173.144.139
84.53.188.140
84.53.189.33
88.221.60.75
014bdcd85899b1e128d977bbb8f899d6c9623e68cfb63b3a637d39f61ff01ff5
014de295141a456ceda8e3c4762085e53dca50f91ddf65906d227f70cf0b1a55
01ce75526fbe1b6dce324233fc46e7f15e7ae9efe2fbcfd6f8233384ead5277b
026c031ea4bf0b31b0819e6576940574507c6293d8dc6c8200363b54ac7030a8
08e8886e305db1744d2c9f1439f28abc73bef383f7a14da5f6e45e3f9e905cd0
0b0200866fae3fcc0c3f1acf6d8dc18fb93ce8b7a55cc7fbc31b231b01764ddb
0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c
0f0a82edad8aa60a62ae9ee4816366b69c8212b1068f6ecbf7da97f6796a8056
0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a
0f3ffa7f0b928b893a75953b1b233b2bf8dc84f94851a6d24225a59d862c270b
0f73cdb5b4ff4fc3339c1d8ddcdf35ea878691e8c33a0a299676f2b0352bb8e7
102f598e077a43ea681594e0750b0e835960f288bada922fff4107785b3c7e31
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11a41838971be0f75a5c082cfc1d6a648846a20140750a0f616e239e4f97b3f6
11c0f76b0414f025f6d8790a111f70421b4b0e816a93317188736671360192ba
12823d585605238121554aff8bb060a235dc36f37efd9fb1e7e6ea1a9622bc35
12a5ec5674ef088f8c198091b7eb6d0478cf5aae6465c09634abae505332d149
12ac633816bca5cff8ab286eb140927b6270fa0ba11b5490f868e66bfe554bb9
1476c101cda6283fbd6a7b4381767b7ecde6d8e1bd871dd43bfba89f1b950a87
14c52b4f1daa1aa3a92d960a311d4518da07e80b7b1a443d3f1a55c0968c99a0
16bab25394f47e60db69b3a75ace1574b150a268353e17096619ba5ba96e208d
1824e38c8fe9b23fb54ed5deafd63f31fcceed673d89111bebc8f05d1aa7b126
19b00d994015088ded16ddd49891ade9c288232431be63c161f5c411e4666121
1a613cec529d335c4758874a4b8249ddf6921d238969f33ac58289dddada5388
1a71c8fe9799162a1bbb1faf1f7e60c7db8e90eb15779a9b6b1bf4e0812890f3
1b889b5222373b8a0485f3fb325564e3b2b017a6cbb518d12a045a407d1eca83
1c17b4f782ea41735ea096c4fdacb9a2b62feed4efc2ab130bd0132919af3ac7
1cc05ae98d289f46b27a5a8f80fdfaa83b0222ce74e68b845aa3d08a0c2c9f97
1d355d2a4e8ff0e3eba6acd9b35c7972985fa371cbff6b3ba72d9735e04c057b
1f9824ab7b3afb7b3b24e128c01bbd598e0424ea032eae7964b1feae12ee07b1
201ac106aa78dbaf7062e570803b878ae8d4e909608bc19dc77bdfdc39fe85d0
21110fa48987dc5804b08b84e1008e7c922f7b028c6291c64a6845fbb868014f
21a7fd6ffd2b55bfa0ccf4acfd4d9cc37e78151ce5cb9e65b2d665baafab02af
24369e1b2461af9dcefecaf9cc93d64cf22a4c5bac32506100b9e21014507bcf
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2873d6a697066988a7c518ff3b6879df210054eca5df4f1bceb0095caa568b48
29f6da0a8c21c5681511bb9b08663d3fd2c5d09c9bd8054ec354c563b8c8b7c1
2a141ce8eb4c5191e2b0a3af6e81189bc118436ad1b0c0bf12b0d52e6f8edd87
2cf13ef8a0e548d45203297ecc6e21ad5f82fe24e759acbf9a9600996aa4528c
2d3474f74f49ea05fe008ac0707fa6e2f3adba2b990b5c46d61f3a465023eae2
2e27b9cf011c3d5b006906bed6b2b64fbf0b82b2d4821f21dfdf00291c8c07be
2fb8bbf7561a7cb3f3e25d6cbd650e311544c2f6dad6cf7d805a0ef51e1c5ade
347cd2766d64da2e2d3ba740c9b07659352d583fd5e42a3d6b794acd43748129
366c3f9d43d021bf672904a0b643c0271c1588b2cfe2ed09fb5dfc1ae61e4645
368daab67b1a5b2b2802edbbac79a2aa4ba992a2ebf9c67b98ad784d8004018c
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
370906bac81874da17c967e44e9da639b9350fd22e910b2711fbe946a7e1f978
37c44613f0abf20e665fe6ee9c920f61abb65bf4d6c4f45327e465959806ff29
3a20dd690bb8b873e65040ac190e289a3c2d6c4debee865f4619f306cf2c9544
3bb2621a4c0c710f6e78404473aebff8e115a28f8d53f44339b867c63ad93b26
3ca275e3abc25d28d1687290d7022fbdc1dbc65897a57edf625612becc7cd4cd
3f0489789316418cf97a21654f8d1ffb3a73785a667c9c4db11c87e31cec1edf
408b59dca880b3a79fe69a8609c87ca6b680b1ce701d88cbce6101d279559c54
40edb045b0a503756f56b4b5cbded5795d314ba4fc386d19cf514b72d90e6438
457b4bd3410faf074da387900f87abc1e845269e857219560bce3ead8260d103
459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc
46e6f42a22054a793841935920cbbc723856e339fead50fa33c1f1bb3ec5a251
475dbccf84ca50f8d13df95ef5a85c58198fd65fefa481850453de7feb2d4bb2
48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3
49d1ffb246bfc28d97c64df45b43df0d98dfbe1310f1e7dbe911eabb2a7bdb83
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4cf52cc73734aa71f26f6a10be9aeec89602af45bf0f9abd5c8445a076c1ae1a
4d371899aba195b1f0cba3a70de300fb5b327a322cfbe3a30d77af8456d8494e
4dc068edecd14f25d56b1f3093a42c9162e0f66a937827f0f1392359094e1208
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
523b4316eb8e2bcdd2df9f714e53bae45c0e13fe9cd1e6d7de09ee1f2f5ddf37
539420f5aec3cbe2d186a82f224e80c2628dd05f1c7f2815cb8bee3e270a45a1
53fe7d6860d0d3d09f82e41a1d1db6d7bc302b662a7e0bdb096f27b5cbda40ea
5430d6fe02af3c64feb8afbc260c7aceb1204fa869aa422f421f7d921dd382ea
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
551c24fb8497e8befef657134a4dc50f8cb6191edf8512a53eb32591da35275c
55f8adec4b29514b52eb85f0f39875bb441683fa05aeae00f82b9d79ab8d27dd
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
58169511472cd541a264a8e027e479ba9bc66fa0b95406721fa62dc413c1ac9e
5a6b2f0487eee2503a9443992282db18bd97997f71570e34fb5b07a79c9cfccd
5abeb1ce56d0537be73f02849471e39b01338e6d410327b3e0b9eac492e99874
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5c722519d5b20bb22f0453889d36e0ba6ce9bd967d93fbbe7a9682d31cf31be5
5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55
5cc2e47701ee7dc9e0ba16303e170db0fcb2df2989b7763ac705893d37b4e237
5d9190292acdd48ba0fc35080f7e7448f3cdf0d79199a4d23f0f49b5341fdf29
5f3b103a1268f862a5e432d607f8e5220dea9d301d13565b0ecded3ad9c25ab2
60fc31875f78865acddb5c715176e982b12e8532097184b38a59f793f1691b43
643ced756fe32f82d14c178ac0002a181a12d128402bd63b9b74c3cbdd85e66a
65d29e040c59a5e843952c3f0da27028455dc63372440602d129681883891276
65effed019c96df30638340081f21c1fe64e87f1230ddb0d48e2e8b763dbd131
66f396314193bfe4809457b6c8004d026e3c503befe550e29ea068667f84ce39
6b171db7ca7ffee17e14f5d432d37e4ec87d6e7a5ce361670e329f705ee34364
6b251fb950a81e0947386320b408ba05a9cd60ef73329331502aa4adfb171e37
6c6e96f0ca3b8dd53783957016e257a37442b01987bcd0cd0f8f952d261f11c8
6cd0b7f49bdab851ed2aa1876108ffc7002ccaf1ba967b166e876070d1c7d95d
6f5de1c3d3d57632417dc1dc3c3a9584d1c3b17a8898b92f3f4da70543222db8
708883a21754b3f7e1653d1d358663d65309e97d673a5934990c73f46df22d4c
70bedf6699398da0f7fa3be459809c0701fe7de1de2e4fff0718be5f65600db9
70fabc58ca55af5ac394614cce6a2288a3eeba4cd5f429eea53eaa443f6ca52e
71209f63fc1592e55fcff12d74e9f6108505190c6e70df5cc7d5748af32b9365
734976c4bb5a252fb49c7380c9b1dca1d36d2c14462716ab6c5f5a732637c82a
7373ca9ed2c272959213699ab6c34d53f342a2d01d996ebc543743312911a6dc
737dadb23f48c0823c3d5f597c2f9d34d81a8e964f013109fb366d7d84dffdc1
74201a4b97ec1d5e86252dd0180eafd8c5378a9235864dbcd682f3575b41c85b
75bbd66c9610b8e4d1e21d85e16832f31913d8492771ee642bf71ee837e680eb
76dc4285400dc948e9fa22bafee1f1779703e6aa6fe0064d003b4d4fdb586d23
787db1c0a78ac6ebc0acecdbc222455f2f113fd0d1b631af04b57bfdccdd04c8
7971bffa44c1c86543b6747b7ac333564decf57d2696acb1f939e521bb49f766
7cc5de02e755067bd3c580c61e3cbe314b42aad5fc2e1a8219a22020048c8caa
7f4d3fd0a705dbf8403298aad91d5de6972e6b5d536068eba8b24954a5a0a8c7
7fb05d93d6e31f72eba8cfddc8128be22fc193f0665284d2058fc21be241c724
7fd52abcc46a46e1d1f39cf3677e2a581b4365872258b5fbc5e28eb183fb6410
817c7a8de5f73b3bd9358babbbd8f904fa639279f18bc86d320fcfb7fcfa8485
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83f6604f4c4ca11246131304ec9a76d75e3b2db2ece8a477c4f0bf580b26a093
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8509f8b66ce83784c82b29f557979cee1cdeafcfa4ea5b43e6301700ac1d6332
862023af41d657861a71dd6c293d995b1a758a36e5d7ece5b71ddf27c1497faa
876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84
88b758789019407fc4c2461c0d188aa776cb4b72d759e3c670b73d68fabf383a
88db5d9a8b1674c53ab7e86d59d0b0e67ea92f0003770c642b95883e23582ed6
894b0b270323ecaa628bc0a2f138bd4f895b09c75f29d7737993ab1a8e23ef3f
8b695f56517b6e927c365dfc1f09b6cedfafb869183074b0040399c4960a77c8
8b950c87c8fcca9e5a47bbe6143f7a2df9a783faf9a11b07559d35a7adddb504
8c3f327cab31c3d02e5bf8d08bac753e210f1f12588a1197226bccff955a0df9
8d9a46db80c58e316c5594342e8e62bb792d4706ae90d02e4af8a03218335117
9066c399df39fc448ea3597ef0b67e9f987a58d466b3dd3a61b1d505e18516eb
925be107869153b6120de872c1ae333977bfaee69a0f7c6271f32d4a8348bca8
938fefbc4f39e13fa1d382e19d72864b406f82f201df9d0376910adf439db117
9569ada5e169b65f93f33ce62107c2b75aaa5af5309706fca764beb2b550e700
9638c4b3ed25883972a0d3e5ef064f74e39fe248a07f62fdcb329abdcc9ad0bf
969d46e33813c8220b273c0404fed5658d41638f863800ed8fb2fca99d8920cd
98e89f927a0dd5f4fcb92a9f4a08b7d3ba87d95f4964fc0a213cfbf31029d5bc
99abd2ce5d6ec8c6a8df5735d98d5b37bb03b56c067b4e68de2335e265ade0e0
9a680b90260b5106d79f4075491ab31daafa7429eff686453c40b58357309649
9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52
9e02524ebecd813fc4bcb40336bb2b033871b1fdcbd234229dee4189dc44850d
9e7ea2b4ba8e2bcc4a964d6192e4671dc5f6863a1c7e35b52b229a3c1e67a68d
a05ce29b1660d2755713106d272474ec04a2524269517b23603f325230d2d4c9
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a46a8c9098978eb78708da11a88cf5b7d8f3d691c499aa23a56938beebed5adb
a6dcb2582661566fdc1517014d9eea855588c2a8409067eca719b8bb1da475dc
a7e8ed2d7bbdbcaeeee81c3433f057d64a32c000112bbd09b5969fc658d0a655
ab21fef3ac4ee12ebb305942f85de99b290b8a24654c69060e54673d5f3a11f2
abee3b66f6dd218919cfb15e9be9c474bc2797a331ff3d27659bb857468efda5
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ace7f6ae09ebbfc194975fa0fbc09e46f7da4670b1bcc23bbf16d9f7bcae9b73
ad80ac33ed04b4e6d78167b4162ecd3d2e8c29d17b43eb3df1f35b216b2ac5c5
adfc2225ba78f587e113da758bc1529b8804472defee127f272dcda3f2161dc2
af71da6e0b8871d0806f440e932cb3b99706330fa4306e8becc7cbf2c7860c4d
af8a20e6bd6c6de708d7aeffdd3afab1a47a00f91b53618d246cdb73410f147c
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3fd2bd251945091f3e856b2d244d662e7980d715b6d7f1722fde67e6dd321ef
b485b0babd7fec066e4763f2cfd2beee9fa94df2358fa9b46da7f6d47281178e
b4c873f99c6d9811d0b8663a59007825e1dd511a54336f08bac1df3a80a3fe29
b4d07892cde715d50bb69c1982df496385d1dfd8f9d1867c31f19a3c8634cfae
b643399710767e220dd2e5da8ae4ea284d8b7f1e936b50d77c2512d68d62ae98
b64e92c54cf8815d6fff0a70489dc30b8e5dae68c639c28b79df2ce8f2af9229
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bcf6b9b28cec8958f9d3f3ee39070e85ffd46d670f1f0baa7cd21aa24c188a00
be59eeb43ce977328d414c543d60c07cd284788a76f617cd433e1a484bfa33ff
bfe8ebbb9a154092de88c4c438e3721fe9622818aaa98a8852bb02550cd8342f
c066d830135d79d0b9aa4500ec1ba098dc25e08f606bcd9505fa94cb420c616b
c0ded025aa80c10d37920521c8de04536a6145d0e42eb4186c57b412fa50eb45
c255d210ac5b9d7aa2c40ca2d9c0dd8143f05bd61bb6fa611dbff9be22d1e0b5
c34294b171494a6c68a4eee25765b44496a737ca32b098a0f902e1edc5fe65e7
c346378eecdbc49f1af4027e1782ccfcf6daed7c02125d0c3efa715ae8273157
c4af296b65d25387b38e738018ce430397082b09449a7ce8da08baaa53c4c77d
c55c8751dbcb177cef9a5fd0b35d7bc18237574724c5e27432da0d857d0b0a49
c62435c37cac42a12a0f32ddbdd04939aafa71c401eafdd6a299c23516bc7ffa
c95b879561e19ae45fa002f19fab5a8d1b0ca8c9f975409eb3abd829cf83031d
ca57cc407c7eefa8e3901cc501b0988fdefbea8a5c2043cf9178dacbd4c197f9
cae6601eec3262f0496682bc1cced8b0fabc8636c4645562c4952a81d02c5283
caf646015e4d83c41c832b2f6bb4c79584265cb057b1a341f6ad752a1777fb61
cfa1739ee346d63a3d3cfdff8c18cbe8fdedbcb32d4b0895028c193ce828e7a5
d288049bf9a317db1fbbdfdde0dc4cb599d1abf49546be6a57c8d8fa1b9488b5
d2caf4e20c60ec1b01fb2b59d947b111d50d667850f9ef13af194183f0574bed
d2dcdaca89cc8422fd1d1ab405630bd6a5e6dd4adebe8723a11ed050a60461c4
d53d2be00a4528f66c74e090ff517d270fef7a9698d462ea122a1c58c75259a5
d5dd51858c25c8f35b6d808746ec3c11750d0b6796b607cf720fa3c86d6e1bb0
d5ed0d3bb98ae16ad90be29db3becf6153a1390b922506a19cccf2400bbdb1c1
d7dd05bfc68901dbb2c883a7bd65698c29b3917d61f0e12d1966dca14d5056c0
dabbb72e22cb1b6b46076eb52af87040bc18bcc082060fc20a86250896da0414
dc83f496595b1d3b55fd6aeae76471a9d89284e1026849b5ab805bc3e8116739
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
ddb54fd9f48bfd94fe644bfb5890741c8a330f1aa7e38ee8312ff8107116f46b
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
decb22061966d60e11818d21d2ac0a8886bf6908c98c9f3253546fc7697fbfc5
df0e1ab988d451dcf5eaca26de327dc716a2cbc85bd348aa33d4a42a5f996d66
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
df531f4d859b68297e2b1d3d0b989147f90b31a30559d137a2e634514da7e961
dff95065f38a434e84c6e9cfff039fc30f6981fc1b91f139fd6bace0dfe7ca61
e0377c505a7d560f42802298baa2f3aacb7903203ab235af12a055c558f9ba19
e0447c33437b68ce8263e7ce898c532cb1676e1dfc94662aea3300263e425265
e066e27304a41a9bd1eba18c512de3e7bc743488f4002fe21b97b222a822a9c4
e13c8733b82140ef6edef5f6ce96c0387419b93dd9b73fab8807a43a09d1fd73
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e53f793a5b8ac48587ffa08d392fddc565ccecc537528b94eb4c73eecad02e60
e6f24078660b09ece82cb18154ca70658e05e25be808029dd09c22668676a7fd
e89fa95988dcf7bf63bc92866b4ebd12c7ededfda65f8040105b51cb41f0414e
e9f1723d153401796dcde6f2d1fbf9a6e2181ac7e94049fc88126fbff1abd38d
eaa593bcfe485f4b5a8ac997cf9936604f9fbef91652db94a8e22b75d612bfc1
ed2fec0144162eef92fd358672643917fc5dbb486c1bbbd322a51cefe8e4795f
eea083b30a2be9a04bacbdd23fb38922b0ef3f861790dc055c8c14604e21ffd9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f07b38fe121113f08e9d2f04c361cdd0b08d9b18f37bf22a0fd20a3cd79d90f7
f0cd273dd31151f7c238927161bba7c45f7a62a762c33b179b69c8a44205825a
f185fcfb4f993dd716a2e82b7e203fc719a5403f2f597bdf38a398552b889707
f44f1645b4369ec43dcdba43b912942c0cca14392a473fbdcdbae7be9d8007c1
f498997e7a39cb345fb129f9158745de59167f8aee78cc573554bd2f5dbc92c7
f4f38c2e3b869558658a4303d42a3a0fc5f81ad2e72517be88f22da35c617b6f
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f5bda9607a2d871842fd3ff6807d30f35b336a9cebdea43f5a9820851b66c4a3
f6fa548f3755570ef254a6b934091fcd2634717a57060511fd414a704e7dc95c
f79a8aa00d3bd94f428463ac9c44896172d23e0f0f6d6fe4f05f1c9b593e702c
f80797422711c42dc269bd69c05123d535e1af0b1a6d06f85f560d53cdf2c238
f86e08b2390d477db93fb1f6549ef75530790c121d24a531a6acb0c0b811fceb
f8981397ca0b967449e9e9208109a2762f25d0edf7d7e458788592b6438e5fcc
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
f8e3f110b75b3f1951f50fb7795c6eaf5bee4f07b787a1b535b39e734c7f1723
fb192c1648b3f3f1d33c7cb0dc247f98d32e9995731598adb483fd34e25a5083
fde4dd0ab5add3a76f91f880c510718310cdf21d8fed6e65b5bd0a624a02ea69
fdf1d02d0e923da1e187476e11f688c61482e25abba482b857674fbb3d79ef45
fe9ad9796d39e706fe661ddf90151c0ebc03251164354d55f1ee95ca06878b40
ff04dd81bb93731c0d1f8e7d384b370f26b93f4352980404fcdc4518e386bedd
ff7382ee12375febef437bf18fe87fa40296eadb21853c0bf221de4fdceecd73

cofense.com Open in urlscan Pro 35.188.168.180 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

267 Requests

100 %HTTPS

33 %IPv6

48 Domains

62 Subdomains

61 IPs

6 Countries

5373 kBTransfer

14142 kBSize

15 Cookies

16 Outgoing links

Redirected requests

267 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 18 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

cofense.com Open in urlscan Pro
35.188.168.180 Public Scan

Screenshot
Live screenshot

Full Image

267
Requests

100 %
HTTPS

33 %
IPv6

48
Domains

62
Subdomains

61
IPs

6
Countries

5373 kB
Transfer

14142 kB
Size

15
Cookies

267 HTTP transactions
18 data transactions