URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022...
Submission Tags: falconsandbox
Submission: On February 17 via api from US — Scanned from DE

Summary

This website contacted 42 IPs in 6 countries across 34 domains to perform 220 HTTP transactions. The main IP is 141.193.213.20, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is www.menlosecurity.com.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on July 25th 2022. Valid for: a year.
This is the only time www.menlosecurity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
40 141.193.213.20 209242 (CLOUDFLAR...)
12 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
6 104.17.72.206 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700:440... 13335 (CLOUDFLAR...)
8 2a00:1450:400... 15169 (GOOGLE)
1 199.232.16.157 54113 (FASTLY)
1 18.66.97.10 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a02:26f0:11a... 20940 (AKAMAI-ASN1)
2 2a03:2880:f02... 32934 (FACEBOOK)
2 104.87.143.22 16625 (AKAMAI-AS)
1 2606:4700::68... 13335 (CLOUDFLAR...)
6 50.112.237.127 16509 (AMAZON-02)
1 2600:9000:230... 16509 (AMAZON-02)
6 34.202.126.200 14618 (AMAZON-AES)
65 18.66.112.55 16509 (AMAZON-02)
1 2600:9000:249... 16509 (AMAZON-02)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2001:4860:480... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 104.244.42.69 13414 (TWITTER)
1 52.222.236.74 16509 (AMAZON-02)
1 2600:9000:225... 16509 (AMAZON-02)
3 3 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.43.14 8068 (MICROSOFT...)
1 199.232.18.109 54113 (FASTLY)
15 104.96.140.70 16625 (AKAMAI-AS)
1 18.66.147.113 16509 (AMAZON-02)
2 34.111.208.231 396982 (GOOGLE-CL...)
8 18.66.97.101 16509 (AMAZON-02)
2 2a03:2880:f12... 32934 (FACEBOOK)
1 54.220.64.134 16509 (AMAZON-02)
1 37.252.171.85 29990 (ASN-APPNEX)
1 2a02:26f0:f70... 20940 (AKAMAI-ASN1)
2 35.156.53.215 16509 (AMAZON-02)
1 192.28.147.68 15224 (OMNITURE)
3 2a00:1450:400... 15169 (GOOGLE)
6 50.16.7.188 14618 (AMAZON-AES)
220 42
Apex Domain
Subdomains
Transfer
65 driftt.com
js.driftt.com — Cisco Umbrella Rank: 5448
749 KB
46 menlosecurity.com
www.menlosecurity.com
info.menlosecurity.com
2 MB
16 6sc.co
j.6sc.co — Cisco Umbrella Rank: 6594
c.6sc.co — Cisco Umbrella Rank: 9881
ipv6.6sc.co — Cisco Umbrella Rank: 7163
b.6sc.co — Cisco Umbrella Rank: 4814
17 KB
12 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 377
166 KB
8 fullcircleinsights.com
st.fullcircleinsights.com — Cisco Umbrella Rank: 83128
9 KB
7 hushly.com
app.hushly.com — Cisco Umbrella Rank: 63468
hubfront.hushly.com — Cisco Umbrella Rank: 219468
220 KB
6 drift.com
bootstrap.api.drift.com — Cisco Umbrella Rank: 6336
metrics.api.drift.com
441 B
6 stackadapt.com
tags.srv.stackadapt.com — Cisco Umbrella Rank: 3097
9 KB
5 gstatic.com
fonts.gstatic.com
116 KB
4 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 359
www.linkedin.com — Cisco Umbrella Rank: 567
px4.ads.linkedin.com — Cisco Umbrella Rank: 6448
3 KB
4 google.com
region1.analytics.google.com — Cisco Umbrella Rank: 4596
www.google.com — Cisco Umbrella Rank: 2
865 B
4 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 41
stats.g.doubleclick.net — Cisco Umbrella Rank: 77
2 KB
4 hotjar.com
static.hotjar.com — Cisco Umbrella Rank: 628
script.hotjar.com — Cisco Umbrella Rank: 767
vars.hotjar.com — Cisco Umbrella Rank: 914
in.hotjar.com — Cisco Umbrella Rank: 1676
74 KB
4 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 43
3 KB
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 35
20 KB
3 google.de
www.google.de — Cisco Umbrella Rank: 6232
669 B
3 techtarget.com
trk.techtarget.com — Cisco Umbrella Rank: 15151
ibc-flow.techtarget.com — Cisco Umbrella Rank: 19543
2 KB
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 10403
597 B
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 106
238 B
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 3233
6 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 149
136 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 50
172 KB
1 mktoresp.com
281-owv-899.mktoresp.com
318 B
1 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 385
826 B
1 vimeocdn.com
extend.vimeocdn.com — Cisco Umbrella Rank: 8802
6 KB
1 oribi.io
cdn.linkedin.oribi.io — Cisco Umbrella Rank: 824
375 B
1 t.co
t.co — Cisco Umbrella Rank: 522
376 B
1 cloudfront.net
d2i34c80a0ftze.cloudfront.net
11 KB
1 zoominfo.com
ws.zoominfo.com — Cisco Umbrella Rank: 4648
2 KB
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 729
5 KB
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 623
15 KB
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 611
295 B
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 196
7 KB
0 twitter.com Failed
analytics.twitter.com Failed
220 34
Domain Requested by
65 js.driftt.com www.menlosecurity.com
js.driftt.com
40 www.menlosecurity.com www.menlosecurity.com
13 b.6sc.co www.menlosecurity.com
12 cdn.cookielaw.org www.menlosecurity.com
cdn.cookielaw.org
8 st.fullcircleinsights.com d2i34c80a0ftze.cloudfront.net
6 tags.srv.stackadapt.com www.menlosecurity.com
tags.srv.stackadapt.com
6 app.hushly.com www.menlosecurity.com
app.hushly.com
6 info.menlosecurity.com www.menlosecurity.com
info.menlosecurity.com
5 fonts.gstatic.com fonts.googleapis.com
4 metrics.api.drift.com js.driftt.com
4 fonts.googleapis.com www.menlosecurity.com
info.menlosecurity.com
3 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
3 www.google.de www.menlosecurity.com
2 bootstrap.api.drift.com js.driftt.com
2 epsilon.6sense.com j.6sc.co
2 www.facebook.com www.menlosecurity.com
2 ibc-flow.techtarget.com trk.techtarget.com
2 px.ads.linkedin.com 2 redirects
2 www.google.com www.menlosecurity.com
2 stats.g.doubleclick.net www.googletagmanager.com
www.google-analytics.com
2 region1.analytics.google.com www.googletagmanager.com
2 munchkin.marketo.net www.menlosecurity.com
munchkin.marketo.net
2 connect.facebook.net www.menlosecurity.com
connect.facebook.net
2 googleads.g.doubleclick.net www.googletagmanager.com
2 www.googletagmanager.com www.menlosecurity.com
www.googletagmanager.com
1 281-owv-899.mktoresp.com munchkin.marketo.net
1 ipv6.6sc.co j.6sc.co
1 c.6sc.co j.6sc.co
1 secure.adnxs.com j.6sc.co
1 in.hotjar.com script.hotjar.com
1 vars.hotjar.com static.hotjar.com
1 j.6sc.co www.menlosecurity.com
1 extend.vimeocdn.com www.googletagmanager.com
1 px4.ads.linkedin.com www.menlosecurity.com
1 www.linkedin.com 1 redirects
1 cdn.linkedin.oribi.io snap.licdn.com
1 script.hotjar.com static.hotjar.com
1 t.co www.menlosecurity.com
1 trk.techtarget.com www.menlosecurity.com
1 d2i34c80a0ftze.cloudfront.net www.googletagmanager.com
1 hubfront.hushly.com www.menlosecurity.com
1 ws.zoominfo.com www.menlosecurity.com
1 snap.licdn.com www.googletagmanager.com
1 static.hotjar.com www.googletagmanager.com
1 static.ads-twitter.com www.googletagmanager.com
1 geolocation.onetrust.com cdn.cookielaw.org
1 cdnjs.cloudflare.com www.menlosecurity.com
0 analytics.twitter.com Failed www.menlosecurity.com
220 48
Subject Issuer Validity Valid
www.menlosecurity.com
DigiCert TLS RSA SHA256 2020 CA1
2022-07-25 -
2023-07-01
a year crt.sh
cookielaw.org
Cloudflare Inc ECC CA-3
2022-05-01 -
2023-05-01
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2022-08-03 -
2023-08-02
a year crt.sh
info.menlosecurity.com
Cloudflare Inc ECC CA-3
2022-04-30 -
2023-04-30
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2023-02-01 -
2023-04-26
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2023-02-01 -
2023-04-26
3 months crt.sh
onetrust.com
Cloudflare Inc ECC CA-3
2022-12-13 -
2023-12-13
a year crt.sh
*.gstatic.com
GTS CA 1C3
2023-02-01 -
2023-04-26
3 months crt.sh
ads-twitter.com
DigiCert TLS RSA SHA256 2020 CA1
2022-07-22 -
2023-08-22
a year crt.sh
*.hotjar.com
Amazon
2022-10-25 -
2023-11-23
a year crt.sh
*.g.doubleclick.net
GTS CA 1C3
2023-02-01 -
2023-04-26
3 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2023-02-01 -
2024-01-31
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2022-11-26 -
2023-02-24
3 months crt.sh
*.marketo.net
DigiCert TLS RSA SHA256 2020 CA1
2023-02-06 -
2024-02-05
a year crt.sh
zoominfo.com
Cloudflare Inc ECC CA-3
2022-04-21 -
2023-04-21
a year crt.sh
*.hushly.com
Amazon RSA 2048 M01
2023-02-08 -
2023-09-12
7 months crt.sh
*.srv.stackadapt.com
Amazon
2022-10-09 -
2023-11-07
a year crt.sh
drift.com
Amazon
2022-08-24 -
2023-09-21
a year crt.sh
*.cloudfront.net
Amazon RSA 2048 M01
2022-12-08 -
2023-12-07
a year crt.sh
www.google.de
GTS CA 1C3
2023-02-01 -
2023-04-26
3 months crt.sh
www.google.com
GTS CA 1C3
2023-02-01 -
2023-04-26
3 months crt.sh
t.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-07 -
2023-03-06
a year crt.sh
linkedin.oribi.io
Amazon
2022-07-07 -
2023-08-06
a year crt.sh
*.vimeocdn.com
GlobalSign Atlas R3 DV TLS CA 2022 Q2
2022-05-17 -
2023-06-18
a year crt.sh
*.6sc.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-08 -
2023-03-11
a year crt.sh
ibc-flow.techtarget.com
GTS CA 1D4
2023-02-05 -
2023-05-06
3 months crt.sh
aws-st.fullcircleinsights.com
Amazon
2022-06-13 -
2023-07-11
a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2022-02-11 -
2023-03-14
a year crt.sh
*.6sense.com
Amazon RSA 2048 M01
2023-02-13 -
2023-06-29
5 months crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1
2022-10-05 -
2023-11-05
a year crt.sh

This page contains 6 frames:

Primary Page: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Frame ID: 1589E183223871865454F3EDF615071F
Requests: 140 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-e031119f9e9e307a08fa610f85dbfb52.html
Frame ID: AF7015334C5463B581D9F2AF9FE8A15A
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 86858E5F47EA81BBD3E1E72312CA752C
Requests: 1 HTTP requests in this frame

Frame: https://info.menlosecurity.com/index.php/form/XDFrame
Frame ID: B42B0D270AFFE73597BE9BE840326EF5
Requests: 2 HTTP requests in this frame

Frame: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
Frame ID: 7838BB04E533471156FC0FC9149C6893
Requests: 33 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
Frame ID: 937BFB7A4B44E872A61258DE7D1A4A0F
Requests: 34 HTTP requests in this frame

Screenshot

Page Title

An anatomy of HEAT attacks used by Qakbot campaigns - Blog | Menlo SecurityBack ButtonFilter Button

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • //static\.hotjar\.com/

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • lodash.*\.js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

220
Requests

99 %
HTTPS

50 %
IPv6

34
Domains

48
Subdomains

42
IPs

6
Countries

3451 kB
Transfer

8166 kB
Size

45
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 78
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1676653698761&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D474058%26time%3D1676653698761%26url%3Dhttps%253A%252F%252Fwww.menlosecurity.com%252Fblog%252Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%252F%253Futm_campaign%253Dcontentnewsletter-nov2022%2526utm_medium%253Demail%2526utm_source%253Doutboundemail%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1676653698761&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1676653698761&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&liSync=true&e_ipv6=AQKUwwVBeJXXpgAAAYZgWSDmBFVcyRUf7IhufkVRJDwzQmN77kEsb8uwHxSlJI2lnwsCIpU3fu_bPg

220 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/
96 KB
20 KB
Document
General
Full URL
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / WP Engine
Resource Hash
eafc7d8ba1973825498b57acebb0bbe55a12f1dd45260b7986e5704ac232239c
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
79b01fc6dc929207-FRA
content-encoding
br
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
content-type
text/html; charset=UTF-8
date
Fri, 17 Feb 2023 17:08:17 GMT
link
<https://www.menlosecurity.com/wp-json/>; rel="https://api.w.org/" <https://www.menlosecurity.com/wp-json/wp/v2/posts/4681>; rel="alternate"; type="application/json" <https://www.menlosecurity.com/?p=4681>; rel=shortlink
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains;
vary
Accept-Encoding Accept-Encoding Accept-Encoding
x-content-type-options
nosniff
x-frame-options
DENY
x-pass-why
custom-path
x-pingback
https://www.menlosecurity.com/xmlrpc.php
x-powered-by
WP Engine
OtAutoBlock.js
cdn.cookielaw.org/consent/1a750de4-f18f-43d4-8b13-4ead3aa824f4/
19 KB
5 KB
Script
General
Full URL
https://cdn.cookielaw.org/consent/1a750de4-f18f-43d4-8b13-4ead3aa824f4/OtAutoBlock.js
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0503c814907e89f314f04881ae04704a4467463310b6fe2e0ed6ce026ad85ed4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 17 Feb 2023 17:08:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
xbkivWkbqcCSJWIhDeVCAQ==
age
23966
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
4073
x-ms-lease-status
unlocked
last-modified
Wed, 25 Jan 2023 02:22:44 GMT
server
cloudflare
etag
0x8DAFE7B0AF02EAC
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
39e1a5e5-d01e-013d-7a64-302b95000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
79b01fcd0b969956-FRA
expires
Sat, 18 Feb 2023 17:08:18 GMT
otSDKStub.js
cdn.cookielaw.org/scripttemplates/
25 KB
9 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
83f8393c6593831a76ea84324c946029082b5c72507176c13387468d21c651ff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 17 Feb 2023 17:08:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
4ki7PtkHDuSPC1vGdOaknQ==
age
63889
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
8384
x-ms-lease-status
unlocked
last-modified
Thu, 16 Feb 2023 03:35:01 GMT
server
cloudflare
etag
0x8DB0FCEC949F70C
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
0123c4fa-001e-017b-5f43-42f503000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
79b01fcd0b989956-FRA
lodash.min.js
cdnjs.cloudflare.com/ajax/libs/lodash.js/0.10.0/
18 KB
7 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/lodash.js/0.10.0/lodash.min.js
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
958c2ecbdd6c6708cf566ceb9b10ffd133ceef822ce81ef460db8ca29e44bcb5
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
684543
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
6419
last-modified
Mon, 04 May 2020 16:12:02 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ed2-464d"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TeIa8aCEhxwaFclYQ0f9islgP0%2F0lSs9XT5q8pIjUaOlI3j9ieWfSYaUIlTpO01Hnh%2BhvtqT49SuRZrebq1sAkYV2AigfPhaQcgX5I0nbihBhoqWIuZ%2FqzUKOuXVpS5oGLQZmp%2BaG5mnaDfAqQ%2BTCakE"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
79b01fcd0b5d90c7-FRA
expires
Wed, 07 Feb 2024 17:08:18 GMT
autoptimize_942f5db80e97ff591f63147ab4de69f3.css
www.menlosecurity.com/wp-content/cache/autoptimize/1/css/
433 KB
62 KB
Stylesheet
General
Full URL
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e68e4d995a6756eae9c598330a2301656196eb26a47ae26d40cb359bfe721a4c
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
MISS
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 02 Feb 2023 14:00:20 GMT
server
cloudflare
etag
W/"63dbc1f4-6c26d"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
DENY
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
79b01fcc3bf69207-FRA
dashicons.min.css
www.menlosecurity.com/wp-includes/css/
58 KB
35 KB
Stylesheet
General
Full URL
https://www.menlosecurity.com/wp-includes/css/dashicons.min.css?ver=6.1.1
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:17 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
491730
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 02 Feb 2023 13:58:41 GMT
server
cloudflare
etag
W/"63dbc191-e688"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
DENY
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
79b01fcc3bf79207-FRA
jquery.min.js
www.menlosecurity.com/wp-includes/js/jquery/
88 KB
31 KB
Script
General
Full URL
https://www.menlosecurity.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.1
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:17 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
1140104
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 02 Feb 2023 13:58:40 GMT
server
cloudflare
etag
W/"63dbc190-15e54"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
DENY
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
79b01fcc3bf89207-FRA
icon-search.svg
www.menlosecurity.com/wp-content/themes/menlo/resources/images/temp/
384 B
2 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/resources/images/temp/icon-search.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d31c8324cb19809562244b53cc52b67032e5cb663b758de4cdc5a28169743d99
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
376030
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 02 Feb 2023 13:59:27 GMT
server
cloudflare
etag
W/"63dbc1bf-180"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
DENY
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
79b01fcdaab891de-FRA
icon-close.svg
www.menlosecurity.com/wp-content/themes/menlo/resources/images/temp/
577 B
2 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/resources/images/temp/icon-close.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2b065a0026be768ecfa77a6645a074c5c65a789f2889c1d1c4b22e96fd38f1da
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
910190
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 02 Feb 2023 13:59:27 GMT
server
cloudflare
etag
W/"63dbc1bf-241"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
DENY
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
79b01fce2bb191de-FRA
Qakbot_blog_new.jpg
www.menlosecurity.com/wp-content/uploads/2022/08/
78 KB
79 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/08/Qakbot_blog_new.jpg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
54a0681713a967b8cd83cd375a85f8ed8eaf3ced1491c62a7c58153f589bf185
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
MISS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
79729
last-modified
Thu, 02 Feb 2023 13:59:15 GMT
server
cloudflare
etag
"63dbc1b3-13771"
vary
Accept-Encoding
x-frame-options
DENY
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
79b01fce3bc891de-FRA
email-decode.min.js
www.menlosecurity.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/
1 KB
871 B
Script
General
Full URL
https://www.menlosecurity.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 15 Feb 2023 14:31:01 GMT
server
cloudflare
etag
W/"63ececa5-4d7"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/javascript
cache-control
max-age=172800, public
cf-ray
79b01fcd4a2a91de-FRA
expires
Sun, 19 Feb 2023 17:08:18 GMT
forms2.min.js
info.menlosecurity.com/js/forms2/js/
208 KB
69 KB
Script
General
Full URL
https://info.menlosecurity.com/js/forms2/js/forms2.min.js
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 12 Jan 2023 20:56:20 GMT
server
cloudflare
age
7051
etag
"1e4042e-33e51-5f217594de500"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
79b01fd0686a3819-FRA
expires
Fri, 17 Feb 2023 21:08:18 GMT
autoptimize_2040124c393dcca48f6fb68678e75a1b.js
www.menlosecurity.com/wp-content/cache/autoptimize/1/js/
235 KB
64 KB
Script
General
Full URL
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/js/autoptimize_2040124c393dcca48f6fb68678e75a1b.js
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
54dfaa802246829b57282653d0b2a0746944a8af138037b658d9f5537d985e01
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
375568
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 02 Feb 2023 14:00:24 GMT
server
cloudflare
etag
W/"63dbc1f8-3aa4a"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
DENY
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
79b01fce3bca91de-FRA
1a750de4-f18f-43d4-8b13-4ead3aa824f4.json
cdn.cookielaw.org/consent/1a750de4-f18f-43d4-8b13-4ead3aa824f4/
4 KB
2 KB
XHR
General
Full URL
https://cdn.cookielaw.org/consent/1a750de4-f18f-43d4-8b13-4ead3aa824f4/1a750de4-f18f-43d4-8b13-4ead3aa824f4.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc9f3b200f98b6e1f663777330bc8dedcb8fa807b1426ed6b04b89262f7d6e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 17 Feb 2023 17:08:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
3QEWgAa0ZqeFtz35m0nilQ==
age
13925
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
1561
x-ms-lease-status
unlocked
last-modified
Wed, 25 Jan 2023 02:22:44 GMT
server
cloudflare
etag
0x8DAFE7B0AD5CCCB
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
87eeff94-c01e-0040-6464-30f108000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
79b01fcd9c7d9956-FRA
expires
Sat, 18 Feb 2023 17:08:18 GMT
gtm.js
www.googletagmanager.com/
270 KB
90 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:806::2008 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
75683be31d4f1729afdb2e1100747ef222a8008ad7082d86f44c6b5238eaadf9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
91548
x-xss-protection
0
last-modified
Fri, 17 Feb 2023 15:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 17 Feb 2023 17:08:18 GMT
css2
fonts.googleapis.com/
10 KB
738 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Raleway:wght@300;400;600;700;800;900&display=swap
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
ea6028aa03c2eda8725a67ffaff79e8498b464975d8a1744f983d9809c6810e5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Fri, 17 Feb 2023 17:08:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 17 Feb 2023 17:08:18 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 17 Feb 2023 17:08:18 GMT
css2
fonts.googleapis.com/
4 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Fri, 17 Feb 2023 17:08:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 17 Feb 2023 15:51:44 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 17 Feb 2023 17:08:18 GMT
css2
fonts.googleapis.com/
4 KB
709 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:wght@400;700&display=swap
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e87a8ee30b7f3e1fd90688380586a85641bc7a432e83be99cce7526e5f702136
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Fri, 17 Feb 2023 17:08:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 17 Feb 2023 15:43:33 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 17 Feb 2023 17:08:18 GMT
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/
59 B
295 B
XHR
General
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2b9e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept
application/json
Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cf-ray
79b01fce389539ca-FRA
access-control-allow-headers
Content-Type
logo.svg
www.menlosecurity.com/wp-content/themes/menlo/resources/images/
5 KB
3 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/resources/images/logo.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b8bc4ed1493c1977120d12182cb046732ffad208a75d936ce32944c7deddddd2
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
491729
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 02 Feb 2023 13:59:26 GMT
server
cloudflare
etag
W/"63dbc1be-134c"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
DENY
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
79b01fce4bd491de-FRA
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/
15 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.menlosecurity.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Thu, 16 Feb 2023 13:13:56 GMT
x-content-type-options
nosniff
age
100462
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15744
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 16 Feb 2024 13:13:56 GMT
arrow-dropdown.svg
www.menlosecurity.com/wp-content/themes/menlo/dist/images/
207 B
2 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/dist/images/arrow-dropdown.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a7d6070b955f11f31a679ff7742f6fe382348f7b71934cf2e8596ef1908c684a
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
375568
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 02 Feb 2023 13:59:27 GMT
server
cloudflare
etag
W/"63dbc1bf-cf"
vary
Accept-Encoding, Accept-Encoding
x-frame-options
DENY
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
79b01fce4bd791de-FRA
zYXgKVElMYYaJe8bpLHnCwDKhdHeFQ.woff2
fonts.gstatic.com/s/ibmplexsans/v14/
18 KB
18 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ibmplexsans/v14/zYXgKVElMYYaJe8bpLHnCwDKhdHeFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:wght@400;700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
fcecb97c12786d7a9387a81e74e4179790fd84425c9c75be1aec3aed645bf6e2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.menlosecurity.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Thu, 16 Feb 2023 21:45:24 GMT
x-content-type-options
nosniff
age
69774
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
18000
x-xss-protection
0
last-modified
Tue, 26 Apr 2022 15:46:52 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 16 Feb 2024 21:45:24 GMT
1Ptug8zYS_SKggPNyC0ITw.woff2
fonts.gstatic.com/s/raleway/v28/
45 KB
46 KB
Font
General
Full URL
https://fonts.gstatic.com/s/raleway/v28/1Ptug8zYS_SKggPNyC0ITw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Raleway:wght@300;400;600;700;800;900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
405ceee1c2f5c31f1cb94ebc63d49a43fddd1471c2c7401a01c7c11bb1d93826
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.menlosecurity.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Thu, 16 Feb 2023 12:08:31 GMT
x-content-type-options
nosniff
age
104387
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
46524
x-xss-protection
0
last-modified
Mon, 18 Jul 2022 19:58:01 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 16 Feb 2024 12:08:31 GMT
fa-solid-900.woff2
www.menlosecurity.com/wp-content/themes/menlo/dist/fonts/@fortawesome/fontawesome-free/webfonts/
76 KB
78 KB
Font
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/dist/fonts/@fortawesome/fontawesome-free/webfonts/fa-solid-900.woff2
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
Origin
https://www.menlosecurity.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
375568
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
78196
last-modified
Thu, 02 Feb 2023 13:59:27 GMT
server
cloudflare
etag
"63dbc1bf-13174"
vary
Accept-Encoding
x-frame-options
DENY
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
79b01fce4bd891de-FRA
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/
15 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.menlosecurity.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Thu, 16 Feb 2023 12:23:05 GMT
x-content-type-options
nosniff
age
103513
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15860
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:42 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 16 Feb 2024 12:23:05 GMT
Video_DelOroHEAT_NavImg-200x196.png
www.menlosecurity.com/wp-content/uploads/2022/10/
31 KB
33 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/10/Video_DelOroHEAT_NavImg-200x196.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
20849c348f89509a3e20c96249a30a3ab086a18e3183024853579c54f8047159
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
375568
cf-polished
origFmt=png, origSize=49886
content-disposition
inline; filename="Video_DelOroHEAT_NavImg-200x196.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
31770
cf-bgj
imgq:100,h2pri
last-modified
Thu, 02 Feb 2023 13:59:16 GMT
server
cloudflare
etag
"63dbc1b4-c2de"
vary
Accept
x-frame-options
DENY
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
79b01fce5be491de-FRA
eBook_HEAT-Ultimate-Buyers-Guide-NavImg-200x196.png
www.menlosecurity.com/wp-content/uploads/2022/10/
35 KB
36 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/10/eBook_HEAT-Ultimate-Buyers-Guide-NavImg-200x196.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2d2cf9c13130a9801a2cd2954984af9eba617b687b612bfdb0d67dd8100911f0
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
375568
cf-polished
origFmt=png, origSize=54408
content-disposition
inline; filename="eBook_HEAT-Ultimate-Buyers-Guide-NavImg-200x196.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
35410
cf-bgj
imgq:100,h2pri
last-modified
Thu, 02 Feb 2023 13:59:16 GMT
server
cloudflare
etag
"63dbc1b4-d488"
vary
Accept
x-frame-options
DENY
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
79b01fce7c2b91de-FRA
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/202301.1.0/
395 KB
94 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/202301.1.0/otBannerSdk.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0cda584e7c5036ad66d7d528d2209bc596a14179fa1792a559e2ae9eaa91e851
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 17 Feb 2023 17:08:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
TPatHKMti4L8TVrK0PWkxg==
age
82424
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
96303
x-ms-lease-status
unlocked
last-modified
Tue, 14 Feb 2023 03:33:27 GMT
server
cloudflare
etag
0x8DB0E3C3C205B1E
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
b1163b84-801e-0080-72c2-407b4c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
79b01fce8dd49956-FRA
eBook_How-hybrid-work-fuels-ransomware-attacks-NavImg-200x196.png
www.menlosecurity.com/wp-content/uploads/2022/10/
45 KB
47 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/10/eBook_How-hybrid-work-fuels-ransomware-attacks-NavImg-200x196.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
dfac8944df586764444a3ea1a93226eb86e111d0994656478d5ae89f7ae613a4
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
375568
cf-polished
origFmt=png, origSize=73269
content-disposition
inline; filename="eBook_How-hybrid-work-fuels-ransomware-attacks-NavImg-200x196.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
46220
cf-bgj
imgq:100,h2pri
last-modified
Thu, 02 Feb 2023 13:59:16 GMT
server
cloudflare
etag
"63dbc1b4-11e35"
vary
Accept
x-frame-options
DENY
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
79b01fce8c4991de-FRA
eBook_The-Ultimate-Buyer-Guide-Zero-Trust-Network-Access_NavImg-200x196.png
www.menlosecurity.com/wp-content/uploads/2022/10/
36 KB
38 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/10/eBook_The-Ultimate-Buyer-Guide-Zero-Trust-Network-Access_NavImg-200x196.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
47b1e4dacf35ebb6c332932414175722f425bd1c628b1ec3c075b41f5328b90b
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
21315
cf-polished
origFmt=png, origSize=57561
content-disposition
inline; filename="eBook_The-Ultimate-Buyer-Guide-Zero-Trust-Network-Access_NavImg-200x196.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
36942
cf-bgj
imgq:100,h2pri
last-modified
Thu, 02 Feb 2023 13:59:16 GMT
server
cloudflare
etag
"63dbc1b4-e0d9"
vary
Accept
x-frame-options
DENY
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
79b01fce8c4d91de-FRA
globe-icon-purple.png
www.menlosecurity.com/wp-content/themes/menlo/resources/images/
278 B
2 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/resources/images/globe-icon-purple.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0e80fa7380340a7651059a8b3d0d8ee3612d68c21a82206eaa5b0322b8263725
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
375568
cf-polished
origFmt=png, origSize=671
content-disposition
inline; filename="globe-icon-purple.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
278
cf-bgj
imgq:100,h2pri
last-modified
Thu, 02 Feb 2023 13:59:26 GMT
server
cloudflare
etag
"63dbc1be-29f"
vary
Accept
x-frame-options
DENY
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
79b01fce9c7091de-FRA
section-article-pattern.svg
www.menlosecurity.com/wp-content/themes/menlo/dist/images/
190 B
2 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/dist/images/section-article-pattern.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6f51bbe7b57914a96209c33c6a7a2d21f01b93f346fe27e5349249bc6a991679
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
375568
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 02 Feb 2023 13:59:27 GMT
server
cloudflare
etag
W/"63dbc1bf-be"
vary
Accept-Encoding, Accept-Encoding
x-frame-options
DENY
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
79b01fce9c7291de-FRA
section-article-pattern2.svg
www.menlosecurity.com/wp-content/themes/menlo/dist/images/
4 KB
2 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/dist/images/section-article-pattern2.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
11374f38070555c45a2cf29c753bcd7442517ef7d7afdbe2d381f8235efeffcc
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
375568
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 02 Feb 2023 13:59:27 GMT
server
cloudflare
etag
W/"63dbc1bf-1133"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
DENY
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
79b01fce9c7691de-FRA
article-single-right-pattern.svg
www.menlosecurity.com/wp-content/themes/menlo/dist/images/
569 B
2 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/dist/images/article-single-right-pattern.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
62c994195bf30d1607e2d7b8cc5eaf8d9c30c7f78e6e32eecc676a3f74932e43
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
21315
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 02 Feb 2023 13:59:27 GMT
server
cloudflare
etag
W/"63dbc1bf-239"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
DENY
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
79b01fce9c7e91de-FRA
article-single-left-pattern.svg
www.menlosecurity.com/wp-content/themes/menlo/dist/images/
595 B
2 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/dist/images/article-single-left-pattern.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e1cd92144ff9e7af94bc45cac521e92d5534c7447b4de28afc365dbbf8828658
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
375568
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 02 Feb 2023 13:59:27 GMT
server
cloudflare
etag
W/"63dbc1bf-253"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
DENY
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
79b01fce9c8091de-FRA
section-contact-pattern.svg
www.menlosecurity.com/wp-content/themes/menlo/dist/images/
2 KB
2 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/dist/images/section-contact-pattern.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
01cbac3c4e6bb2c6e2006fc5b2c60181bb18f6c0e75c3d12e5030508bd0afdfc
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
21315
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 02 Feb 2023 13:59:27 GMT
server
cloudflare
etag
W/"63dbc1bf-892"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
DENY
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
79b01fce9c8191de-FRA
fa-brands-400.woff2
www.menlosecurity.com/wp-content/themes/menlo/dist/fonts/@fortawesome/fontawesome-free/webfonts/
75 KB
77 KB
Font
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/dist/fonts/@fortawesome/fontawesome-free/webfonts/fa-brands-400.woff2
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
Origin
https://www.menlosecurity.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
385660
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
76764
last-modified
Thu, 02 Feb 2023 13:59:27 GMT
server
cloudflare
etag
"63dbc1bf-12bdc"
vary
Accept-Encoding
x-frame-options
DENY
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
79b01fce9c8291de-FRA
Menlo_Labs_Nav_image.png
www.menlosecurity.com/wp-content/uploads/2022/10/
214 KB
216 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/10/Menlo_Labs_Nav_image.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
234e8daa7494fde711ebbdd46ae03550d93b25013eb452c96e03b1270e7ab808
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
375568
cf-polished
origFmt=png, origSize=331938
content-disposition
inline; filename="Menlo_Labs_Nav_image.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
219100
cf-bgj
imgq:100,h2pri
last-modified
Thu, 02 Feb 2023 13:59:14 GMT
server
cloudflare
etag
"63dbc1b2-510a2"
vary
Accept
x-frame-options
DENY
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
79b01fcebcb591de-FRA
icon-question.svg
www.menlosecurity.com/wp-content/uploads/2021/05/
1 KB
2 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2021/05/icon-question.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1c27bb55dc2fe6453e72fdfa7726fc8b74473bbffdbc424df999dc7751bf7ce3
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
375568
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 02 Feb 2023 13:59:35 GMT
server
cloudflare
etag
W/"63dbc1c7-430"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
DENY
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
79b01fceccd091de-FRA
icon-phone.svg
www.menlosecurity.com/wp-content/uploads/2021/05/
1 KB
2 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2021/05/icon-phone.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ba482add0c02c927f05b5078b949334e4d1db145525061a0bb29b70bda92b9c7
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
21315
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 02 Feb 2023 13:59:35 GMT
server
cloudflare
etag
W/"63dbc1c7-488"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
DENY
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
79b01fceccd191de-FRA
qakbot-email-lure-payload-2.png
www.menlosecurity.com/wp-content/uploads/2022/08/
33 KB
34 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/08/qakbot-email-lure-payload-2.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8358f672996016e2cce823d94f7233ae8c7c79dfd05b61ecb64b3a125b4e4d86
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
MISS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
33748
last-modified
Thu, 02 Feb 2023 13:59:16 GMT
server
cloudflare
etag
"63dbc1b4-83d4"
vary
Accept-Encoding
x-frame-options
DENY
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
79b01fceccd691de-FRA
qakbot-email-lure-evasion.png
www.menlosecurity.com/wp-content/uploads/2022/08/
22 KB
23 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/08/qakbot-email-lure-evasion.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ca73c5f7c8006bebfa4f10a3a227e9cfee08e4859faeb9a98a7938d62036b231
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
MISS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
22130
last-modified
Thu, 02 Feb 2023 13:59:16 GMT
server
cloudflare
etag
"63dbc1b4-5672"
vary
Accept-Encoding
x-frame-options
DENY
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
79b01fceccd891de-FRA
qakbot-email-lure-malicious-lnk-download.png
www.menlosecurity.com/wp-content/uploads/2022/08/
56 KB
58 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/08/qakbot-email-lure-malicious-lnk-download.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9d4c59b0db5e61fe2e21d4a8d397879fa140ce12d303a5dd3edeeaecadbef1d7
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
MISS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
57759
last-modified
Thu, 02 Feb 2023 13:59:16 GMT
server
cloudflare
etag
"63dbc1b4-e19f"
vary
Accept-Encoding
x-frame-options
DENY
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
79b01fceccda91de-FRA
qakbot-email-lure-js.png
www.menlosecurity.com/wp-content/uploads/2022/08/
185 KB
187 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/08/qakbot-email-lure-js.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9d2ef0022ea6062c3f3cdf522963e17a155b5eb699453082b9223a1cffb97e8f
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
MISS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
189455
last-modified
Thu, 02 Feb 2023 13:59:16 GMT
server
cloudflare
etag
"63dbc1b4-2e40f"
vary
Accept-Encoding
x-frame-options
DENY
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
79b01fceccdc91de-FRA
qakbot-excel-40-macros-diagram.png
www.menlosecurity.com/wp-content/uploads/2022/08/
13 KB
14 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/08/qakbot-excel-40-macros-diagram.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6bf6491ee571abd1aa94b9c1e6da91d09a18ea15a32027fd9efeb173e00ab9ad
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
MISS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
13043
last-modified
Thu, 02 Feb 2023 13:59:16 GMT
server
cloudflare
etag
"63dbc1b4-32f3"
vary
Accept-Encoding
x-frame-options
DENY
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
79b01fceccde91de-FRA
qakbot-excel-40-email-contents-1024x440.png
www.menlosecurity.com/wp-content/uploads/2022/08/
72 KB
73 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/08/qakbot-excel-40-email-contents-1024x440.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
aa9fb0bc90718761ce9804402766fc5c6f8b602a4b2d9140b60c8faa5fc52ba6
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
MISS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
73303
last-modified
Thu, 02 Feb 2023 13:59:16 GMT
server
cloudflare
etag
"63dbc1b4-11e57"
vary
Accept-Encoding
x-frame-options
DENY
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
79b01fcecce091de-FRA
qakbot-excel-40-enable-macros.png
www.menlosecurity.com/wp-content/uploads/2022/08/
21 KB
23 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/08/qakbot-excel-40-enable-macros.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
283a8128e600ea21b56c8eb876ec2dafd52e734ee55c8658b5edc9d1299fde66
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
MISS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
21996
last-modified
Thu, 02 Feb 2023 13:59:16 GMT
server
cloudflare
etag
"63dbc1b4-55ec"
vary
Accept-Encoding
x-frame-options
DENY
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
79b01fcecce891de-FRA
qakbot-excel-40-payload.png
www.menlosecurity.com/wp-content/uploads/2022/08/
86 KB
88 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/08/qakbot-excel-40-payload.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cc98abda3818699035ccda57eac97e25e4578bb59f2c2764160f82e1e168b900
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
MISS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
88150
last-modified
Thu, 02 Feb 2023 13:59:16 GMT
server
cloudflare
etag
"63dbc1b4-15856"
vary
Accept-Encoding
x-frame-options
DENY
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
79b01fcecce991de-FRA
en.json
cdn.cookielaw.org/consent/1a750de4-f18f-43d4-8b13-4ead3aa824f4/d2455243-ab24-4927-854a-4111d3e6abf4/
104 KB
21 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/consent/1a750de4-f18f-43d4-8b13-4ead3aa824f4/d2455243-ab24-4927-854a-4111d3e6abf4/en.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202301.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
df4cfb00c128eca08c272608e8782760abaca3d46f32f69cb9f9bcd9384a8cd6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 17 Feb 2023 17:08:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
g2ny9uVER+3ASvIdf8mcsg==
age
13925
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
21357
x-ms-lease-status
unlocked
last-modified
Wed, 25 Jan 2023 02:22:47 GMT
server
cloudflare
etag
0x8DAFE7B0CCB5EBF
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
6184f322-901e-017e-2a82-42017c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
79b01fcefea59956-FRA
expires
Sat, 18 Feb 2023 17:08:18 GMT
otFloatingFlat.json
cdn.cookielaw.org/scripttemplates/202301.1.0/assets/
10 KB
3 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/202301.1.0/assets/otFloatingFlat.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202301.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
179a0ba55c3bbf759340ba2a57846f81a7de249ed7e502b5e8814af2ef964533
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 17 Feb 2023 17:08:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
Ia/R79Q17DdIRmrGbonvaA==
age
84563
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
2702
x-ms-lease-status
unlocked
last-modified
Tue, 14 Feb 2023 03:33:21 GMT
server
cloudflare
etag
0x8DB0E3C386D7328
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
f55fde0f-501e-00e4-3f3f-40cbec000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
79b01fcf5f519956-FRA
otPcTab.json
cdn.cookielaw.org/scripttemplates/202301.1.0/assets/v2/
62 KB
13 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/202301.1.0/assets/v2/otPcTab.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202301.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a9c89c2a0df62b9bd73d859ae616ffe92cb9e86e1428a1a0fc797418f3e03dd9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 17 Feb 2023 17:08:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
5x5OTvRos5JBKPa+Qbpqxg==
age
84563
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
13354
x-ms-lease-status
unlocked
last-modified
Tue, 14 Feb 2023 03:33:22 GMT
server
cloudflare
etag
0x8DB0E3C397F3273
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
5db2dfbf-d01e-015b-2e3f-4099cf000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
79b01fcf5f559956-FRA
otCommonStyles.css
cdn.cookielaw.org/scripttemplates/202301.1.0/assets/
21 KB
4 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/202301.1.0/assets/otCommonStyles.css
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202301.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
930239150e702d9d4bf43c3881aa70f8ad5fd9068dcbecb7c8bcca654784f7f1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 17 Feb 2023 17:08:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
XcxlleAcPGO2n5kTZrHH2Q==
age
65991
x-ms-lease-status
unlocked
last-modified
Tue, 14 Feb 2023 03:33:31 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
8adc0a2c-601e-0081-2e63-407ab1000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
cf-ray
79b01fcf5f579956-FRA
uwt.js
static.ads-twitter.com/
56 KB
15 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.16.157 Vienna, Austria, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-encoding
gzip
last-modified
Thu, 27 Oct 2022 16:56:53 GMT
etag
"32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary
Accept-Encoding,Host
x-cache
HIT, HIT
content-type
application/javascript; charset=utf-8
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn
FT
cache-control
no-cache
accept-ranges
bytes
content-length
15375
x-served-by
cache-iad-kjyo7100081-IAD, cache-vie6353-VIE
hotjar-1854968.js
static.hotjar.com/c/
9 KB
4 KB
Script
General
Full URL
https://static.hotjar.com/c/hotjar-1854968.js?sv=7
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-97-10.fra56.r.cloudfront.net
Software
/
Resource Hash
811058844b02eadec8da887030aa5ce50c6dcf23cba6b63cce7f07ace5d4b7be
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=2592000; includeSubDomains
via
1.1 3f52d342c56014599dee37446f6c9f2e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P2
etag
W/c4ae585a541c514b93535e438ab91ccb
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=60
x-cache-hit
1
cross-origin-resource-policy
cross-origin
x-amz-cf-id
YXZyzklzxv3cPcIF2n1K-LDiXYJcCU_W9u4Jr96mIERdzZruJa7nFg==
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/684820168/
43 B
571 B
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/684820168/?random=1676653698570&cv=11&fst=1676653698570&bg=ffffff&guid=ON&async=1&gtm=45He32f0&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&tiba=An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security&rdp=1&auid=1423674974.1676653699&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Feb 2023 17:08:18 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
37
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/
13 KB
5 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:11a::217:9a4a Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 10 Jan 2023 17:22:56 GMT
x-cdn
AKAM
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=37342
accept-ranges
bytes
content-length
4777
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/10976805707/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10976805707/?random=1676653698573&cv=11&fst=1676653698573&bg=ffffff&guid=ON&async=1&gtm=45He32f0&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&tiba=An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security&auid=1423674974.1676653699&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1e3d2833a35eab3bee7823c5b20a0bcb5eba35d0e57082abd558aac575e1eace
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Feb 2023 17:08:18 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
992
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
fbevents.js
connect.facebook.net/en_US/
106 KB
28 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
dca9b6afcb6c37d6a32456973fe5f2986a348a70d11774e102de6fc420992a19
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Fri, 17 Feb 2023 17:08:18 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
27843
x-fb-rlafr
0
x-xss-protection
0
pragma
public
x-fb-debug
0LxOBO06+zclP1kINFmx+rUQ4fU3Oi3UH9Y9eHLXnFTiG1fN0KhJyaIHJzgD9728V0HfheH2APDF43ZKJkVseg==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
x-fb-trip-id
917726464
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
x-frame-options
DENY
cache-control
public, max-age=1200
expires
Sat, 01 Jan 2000 00:00:00 GMT
munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.87.143.22 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-87-143-22.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
8de86d71297dc0c8a04caeab00e28f1fcadaa2574558098cccfddd3aa27b8172

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Fri, 17 Feb 2023 17:08:19 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 Feb 2023 02:55:32 GMT
Server
AkamaiNetStorage
ETag
"d59e4096b6b551f06e189b1a016fc70a:1676602532.716228"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
746
GQ57xOfAtqXGOqCfMFaF
ws.zoominfo.com/pixel/
2 KB
2 KB
Script
General
Full URL
https://ws.zoominfo.com/pixel/GQ57xOfAtqXGOqCfMFaF
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:a852 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
985a78086b7a7fa7e71394bc9e8e508e2a9a3de4b363de41c69deac4cfd2c641
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
via
1.1 google
server
cloudflare
x-powered-by
Express
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
access-control-allow-credentials
true
cf-ray
79b01fd08dd0bbc7-FRA
access-control-allow-headers
Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
widget.js
app.hushly.com/runtime/
1 KB
2 KB
Script
General
Full URL
https://app.hushly.com/runtime/widget.js?aid=83162
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.112.237.127 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-50-112-237-127.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
e056bba7897b73bea51340aadecc3ef98722ac58c0538bace432c30787754fd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

content-type
text/javascript;charset=utf-8
pragma
no-cache
date
Fri, 17 Feb 2023 17:08:19 GMT
cache-control
no-cache, no-store, must-revalidate
expires
Thu, 01 Jan 1970 00:00:00 GMT
embed.js
hubfront.hushly.com/
194 KB
58 KB
Script
General
Full URL
https://hubfront.hushly.com/embed.js
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2304:ac00:13:a3bc:6800:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
e76500eb2a449d3bf9ccee7a8ef85c5d8b9c2564df9a9223dd8df354dcab2abf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:19 GMT
content-encoding
gzip
via
1.1 127e1ddb6224f10ae9e484392afd1b6c.cloudfront.net (CloudFront)
last-modified
Fri, 16 Dec 2022 08:41:34 GMT
server
nginx
x-amz-cf-pop
VIE50-P1
etag
W/"639c2f3e-30924"
x-cache
Miss from cloudfront
content-type
application/javascript
x-amz-cf-id
oc4Skfs7m9L67i9iYJs7yOiDXrxJmRh37c-H0HVork7rmCKC-piNYA==
events.js
tags.srv.stackadapt.com/
17 KB
6 KB
Script
General
Full URL
https://tags.srv.stackadapt.com/events.js
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.202.126.200 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-202-126-200.compute-1.amazonaws.com
Software
/
Resource Hash
fcb446df87e25088aa01ac7eaf382f723b59d22c9caad056db88be943aa8e50a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 17 Feb 2023 17:08:19 GMT
Cache-Control
max-age=5
Content-Encoding
gzip
Connection
keep-alive
Content-Length
5382
Content-Type
text/javascript
trrsm2wf4gwm.js
js.driftt.com/include/1676653800000/
213 KB
60 KB
Script
General
Full URL
https://js.driftt.com/include/1676653800000/trrsm2wf4gwm.js
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
3c11c380f0fd80c64976a059ff85d9e5086ef0ec55f9f5cb04c46ed077aa0598
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
x-amz-version-id
Nis4lMjZRHlFhKjiQGqo.DcRhQulBBy6
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront
x-envoy-upstream-service-time
31
last-modified
Thu, 16 Feb 2023 17:15:02 GMT
server
istio-envoy
etag
W/"7d0c72d0766948f876c7b7adb113e8d3"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
DXrLeJ2OCt-BfWrZyheO9rfLSZcKrzCZaqdkhv-sL6sHOmjWO4VaiQ==
fullcircle.js
d2i34c80a0ftze.cloudfront.net/
31 KB
11 KB
Script
General
Full URL
https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=187d2103-bdc5-4e3f-b070-b5c6a4000840&domain=menlosecurity.com
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2490:b000:9:14eb:6280:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
dee770f9587ee7473c64234480725ea4cb67f90458a87e8ccb876dfac8310839

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 05:58:40 GMT
via
1.1 0baa339c02d06988c65d8623d1b3c6ec.cloudfront.net (CloudFront), 1.1 c0c6d7afa25d841027d75444425d2010.cloudfront.net (CloudFront)
content-encoding
gzip
x-amz-cf-pop
FRA56-P2, FRA56-P6
age
40178
x-amzn-requestid
ac42f8d9-e714-41e9-9c33-4110d06fa62c
x-amzn-trace-id
Root=1-63ef1790-59c8538a43a4dc074ac6c547;Sampled=0
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
x-amz-apigw-id
AeCemGjQvHcFlLg=
x-amz-cf-id
7zGGuWGUE5fVgDfLzFlrk8rsvQessOdJhsybAxe_CpUc77tPXZ_NVg==
tracking.js
trk.techtarget.com/
3 KB
2 KB
Script
General
Full URL
https://trk.techtarget.com/tracking.js
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:d9f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-encoding
br
cf-cache-status
HIT
cf-bgj
minify
last-modified
Tue, 13 Dec 2022 15:01:39 GMT
server
cloudflare
age
288
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=1200
cf-ray
79b01fd14ef690ba-FRA
expires
Fri, 17 Feb 2023 17:13:30 GMT
js
www.googletagmanager.com/gtag/
246 KB
82 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-C2G0PCSJKE&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:806::2008 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
8fee1a230bc4ebb0ffa9c31cdc58ea7441499cfbca82ee57b5e83d437ffc3bfe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
84118
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Fri, 17 Feb 2023 17:08:18 GMT
1626328370711236
connect.facebook.net/signals/config/
377 KB
108 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/1626328370711236?v=2.9.96&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
d0f8159f0af983f454b8b87626671c305cb2c5e823906916f21e82bfbb9b65ce
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Fri, 17 Feb 2023 17:08:18 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-fb-rlafr
0
x-xss-protection
0
pragma
public
x-fb-debug
3FICKbtmZK4LNyirwlBtUow2XPiuCgMKSeEK5Mmp9yGTayY6aJNlTu5zgTrcKm69FUSYol14T40uqBUjHXqx0g==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
x-fb-trip-id
917726464
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
x-frame-options
DENY
origin-agent-cluster
?0
cache-control
public, max-age=1200
expires
Sat, 01 Jan 2000 00:00:00 GMT
collect
region1.analytics.google.com/g/
0
258 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-C2G0PCSJKE&gtm=45je32f0&_p=1232861254&_gaz=1&cid=2083676563.1676653699&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1676653698&sct=1&seg=0&dl=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&dt=An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-C2G0PCSJKE&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Feb 2023 17:08:18 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.menlosecurity.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/
0
249 B
Ping
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-C2G0PCSJKE&cid=2083676563.1676653699&gtm=45je32f0&aip=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-C2G0PCSJKE&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Feb 2023 17:08:18 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.menlosecurity.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
107 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-C2G0PCSJKE&cid=2083676563.1676653699&gtm=45je32f0&aip=1&z=1319369975
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Feb 2023 17:08:18 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
getForm
info.menlosecurity.com/index.php/form/
22 KB
5 KB
Script
General
Full URL
https://info.menlosecurity.com/index.php/form/getForm?munchkinId=281-OWV-899&form=2571&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F&callback=jQuery1124021530511634445948_1676653698722&_=1676653698723
Requested by
Host: info.menlosecurity.com
URL: https://info.menlosecurity.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bc18e73f36db814981a427412d398138ed0737021b6cd9fbcf2879e620922d4b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:20 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
x-form-service-request-id
f4e4#1866059215f
x-marketo-source
Form Service
cf-ray
79b01fd139fe3819-FRA
cached
false
/
www.google.com/pagead/1p-user-list/10976805707/
42 B
455 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/10976805707/?random=1676653698573&cv=11&fst=1676653200000&bg=ffffff&guid=ON&async=1&gtm=45He32f0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&tiba=An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security&fmt=3&is_vtc=1&random=1278792786&rmt_tld=0&ipr=y
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/10976805707/
42 B
455 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/10976805707/?random=1676653698573&cv=11&fst=1676653200000&bg=ffffff&guid=ON&async=1&gtm=45He32f0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&tiba=An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security&fmt=3&is_vtc=1&random=1278792786&rmt_tld=1&ipr=y
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
adsct
t.co/i/
43 B
376 B
Image
General
Full URL
https://t.co/i/adsct?bci=3&eci=2&event_id=33601cbf-e290-4efe-864b-b75e0dc9bc06&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=19359b7f-f927-4954-b766-642b89c63a4e&tw_document_href=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nx5nr&type=javascript&version=2.3.29
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

x-response-time
108
date
Fri, 17 Feb 2023 17:08:18 GMT
strict-transport-security
max-age=0
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
8cd24af3fd90687f
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
500ada6fa8f72ff0081a3346dbe9d199bab84af0a905264a374f8ad48e6e0a44
content-length
43
adsct
analytics.twitter.com/i/
0
0

modules.7659de6e9a796dae10e4.js
script.hotjar.com/
263 KB
67 KB
Script
General
Full URL
https://script.hotjar.com/modules.7659de6e9a796dae10e4.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1854968.js?sv=7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.236.74 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-236-74.fra56.r.cloudfront.net
Software
/
Resource Hash
673dd7296f7b2fc51cc430503be6c982706ef1d0fa1ec2ce3c05bec4bbf0044b
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Thu, 16 Feb 2023 14:44:06 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=2592000; includeSubDomains
via
1.1 89e34e3fd814f1393ef77867b93dd12e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P4
age
95052
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
68524
last-modified
Thu, 16 Feb 2023 14:43:16 GMT
etag
"9896434e83f89e3cdb1a5ef8698a6247"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
JtCA49ScOnNbNco67V3i4Q6OId1maVTaLpic_lmeTfnzxhoyC3rjgA==
token
cdn.linkedin.oribi.io/partner/474058/domain/menlosecurity.com/
36 B
375 B
XHR
General
Full URL
https://cdn.linkedin.oribi.io/partner/474058/domain/menlosecurity.com/token
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2251:ba00:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept
*
Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 16:39:35 GMT
content-encoding
gzip
via
1.1 a54cda8ccda3480314f451558e4dd062.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P3
age
1723
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=3600
x-amz-cf-id
p4sm20QMKn7VzjjB-3VtanPeuo2Wy4KuMFVxBihgF8h-ZXfMg0K8TA==
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1676653698761&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D474058%26time%3D1676653698761%26url%3Dhttps%253A%252F%252Fwww.menlosecurity.com%2...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1676653698761&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1676653698761&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%...
0
264 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1676653698761&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&liSync=true&e_ipv6=AQKUwwVBeJXXpgAAAYZgWSDmBFVcyRUf7IhufkVRJDwzQmN77kEsb8uwHxSlJI2lnwsCIpU3fu_bPg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Server
13.107.43.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:19 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: DF469C2606774AE78441B4CE8772E7F8 Ref B: VIEEDGE1606 Ref C: 2023-02-17T17:08:19Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-lva1
x-li-proto
http/2
content-length
0
x-li-uuid
AAX06Fwsea6vT3I94ghGjw==

Redirect headers

date
Fri, 17 Feb 2023 17:08:19 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 3D90343B62284136A487552FF22F12E3 Ref B: DUS30EDGE0418 Ref C: 2023-02-17T17:08:19Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1676653698761&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&liSync=true&e_ipv6=AQKUwwVBeJXXpgAAAYZgWSDmBFVcyRUf7IhufkVRJDwzQmN77kEsb8uwHxSlJI2lnwsCIpU3fu_bPg
x-li-proto
http/2
content-length
0
x-li-uuid
AAX06FwoahV6I93lJtkxOQ==
footer-pattern.svg
www.menlosecurity.com/wp-content/themes/menlo/dist/images/
657 B
2 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/dist/images/footer-pattern.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f38bfa814ad4096dccf3892ea2c80c4d8b79e5e8ba7043c7c730b2061a2d2102
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
375567
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 02 Feb 2023 13:59:27 GMT
server
cloudflare
etag
W/"63dbc1bf-291"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
DENY
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
79b01fd159e491de-FRA
logo-footer.svg
www.menlosecurity.com/wp-content/themes/menlo/resources/images/
4 KB
3 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/resources/images/logo-footer.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6c45006c40d76e72f40e88dc8e91670aeb859178d60536c3b412f79fe5399b21
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
376027
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 02 Feb 2023 13:59:26 GMT
server
cloudflare
etag
W/"63dbc1be-105f"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
DENY
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
79b01fd159e791de-FRA
globe-icon.png
www.menlosecurity.com/wp-content/themes/menlo/resources/images/
276 B
2 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/resources/images/globe-icon.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cc9914192e0a743ae5573b812ab10411abd58039f8d1971fcf08f5591a8f2257
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_942f5db80e97ff591f63147ab4de69f3.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
375567
cf-polished
origFmt=png, origSize=2060
content-disposition
inline; filename="globe-icon.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
276
cf-bgj
imgq:100,h2pri
last-modified
Thu, 02 Feb 2023 13:59:26 GMT
server
cloudflare
etag
"63dbc1be-80c"
vary
Accept
x-frame-options
DENY
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
79b01fd159e991de-FRA
MITRE_ATT_CK_Initial_Access_Blog_b.jpg
www.menlosecurity.com/wp-content/uploads/2022/10/
94 KB
96 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/10/MITRE_ATT_CK_Initial_Access_Blog_b.jpg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/js/autoptimize_2040124c393dcca48f6fb68678e75a1b.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
970d1c864a02c66e3cf5d1971f2c62c3e0da7553f9ce92c19c490758d66f22b1
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:19 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
MISS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
96631
last-modified
Thu, 02 Feb 2023 13:59:14 GMT
server
cloudflare
etag
"63dbc1b2-17977"
vary
Accept-Encoding
x-frame-options
DENY
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
79b01fd17a2191de-FRA
Menlo_labs_template_injection_attacks_part_3_Blog_c.jpg.webp
www.menlosecurity.com/wp-content/webp-express/webp-images/uploads/2022/12/
40 KB
42 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/webp-express/webp-images/uploads/2022/12/Menlo_labs_template_injection_attacks_part_3_Blog_c.jpg.webp
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/js/autoptimize_2040124c393dcca48f6fb68678e75a1b.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3725f4f84f1390a3a7d5acc7ab1d65495ce473b682296ffd619915c5b101d498
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
124664
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
41204
last-modified
Thu, 02 Feb 2023 13:58:48 GMT
server
cloudflare
etag
"63dbc198-a0f4"
vary
Accept-Encoding
x-frame-options
DENY
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
79b01fd17a2591de-FRA
Two_minutes_On-HEAT-attacks-evading-http-traffic-inspection_Blog.jpg
www.menlosecurity.com/wp-content/uploads/2022/10/
65 KB
67 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/10/Two_minutes_On-HEAT-attacks-evading-http-traffic-inspection_Blog.jpg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/js/autoptimize_2040124c393dcca48f6fb68678e75a1b.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5bb0131177aa9022463bfc6f6c7b57f943e8c95c9176a6a6a75b908640582cda
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:18 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains;
cf-cache-status
HIT
age
124664
cf-polished
origFmt=jpeg, origSize=83125
content-disposition
inline; filename="Two_minutes_On-HEAT-attacks-evading-http-traffic-inspection_Blog.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
66730
cf-bgj
imgq:100,h2pri
last-modified
Thu, 02 Feb 2023 13:59:16 GMT
server
cloudflare
etag
"63dbc1b4-144b5"
vary
Accept
x-frame-options
DENY
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
79b01fd17a2891de-FRA
ot_close.svg
cdn.cookielaw.org/logos/static/
651 B
600 B
Image
General
Full URL
https://cdn.cookielaw.org/logos/static/ot_close.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 17 Feb 2023 17:08:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
pcXWFGpuVeSg/jVnYCseRg==
age
63744
x-ms-lease-status
unlocked
last-modified
Thu, 16 Feb 2023 03:35:03 GMT
server
cloudflare
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
4d3d77a6-a01e-00f1-581b-420975000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
cf-ray
79b01fd1dbb79956-FRA
ot_guard_logo.svg
cdn.cookielaw.org/logos/static/
497 B
494 B
Fetch
General
Full URL
https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202301.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 17 Feb 2023 17:08:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
tXyZydHjxQshFMbbBT1/8A==
age
82372
x-ms-lease-status
unlocked
last-modified
Wed, 15 Feb 2023 13:17:11 GMT
server
cloudflare
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
0125634b-c01e-00a5-2c6b-41e3ff000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
cf-ray
79b01fd1ebcb9956-FRA
Logo_MenloSecurity_Signature_Purple_RGB.png
cdn.cookielaw.org/logos/2f43eebf-9aac-4632-87e4-6268b1418b72/90dd6f8b-4c69-4515-bc68-3c27f610be65/9430bd48-82b5-4ae6-b08d-761d94b06151/
12 KB
12 KB
Image
General
Full URL
https://cdn.cookielaw.org/logos/2f43eebf-9aac-4632-87e4-6268b1418b72/90dd6f8b-4c69-4515-bc68-3c27f610be65/9430bd48-82b5-4ae6-b08d-761d94b06151/Logo_MenloSecurity_Signature_Purple_RGB.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
073b97779f9dc3c731a8c153f3f8dcfe2dc8f99a2c5ad7a279361a08e0302dc0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 17 Feb 2023 17:08:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
lwzbnoHyDnRH4s89KRrv8A==
age
23964
content-length
12496
x-ms-lease-status
unlocked
last-modified
Tue, 29 Jun 2021 19:44:30 GMT
server
cloudflare
etag
0x8D93B364FFCA162
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
x-ms-request-id
58a1a39b-801e-002a-553b-5aada3000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
79b01fd22c339956-FRA
powered_by_logo.svg
cdn.cookielaw.org/logos/static/
5 KB
2 KB
Image
General
Full URL
https://cdn.cookielaw.org/logos/static/powered_by_logo.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 17 Feb 2023 17:08:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
Y+c301RBZNK39PvKQWrIBw==
age
62347
x-ms-lease-status
unlocked
last-modified
Thu, 16 Feb 2023 03:35:04 GMT
server
cloudflare
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
0154e9cd-201e-0123-3f3d-42f178000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
cf-ray
79b01fd22c379956-FRA
79031691.js
extend.vimeocdn.com/ga/
17 KB
6 KB
Script
General
Full URL
https://extend.vimeocdn.com/ga/79031691.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.18.109 Vienna, Austria, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache /
Resource Hash
6c649cc3d4aee7683250622541a6045ad4ac3beb93df1fcdd3ec1f7f12a1ff44

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

x-cache-hits
48616
date
Fri, 17 Feb 2023 17:08:19 GMT
content-encoding
gzip
via
1.1 varnish
age
14592976
x-cache
HIT
content-length
5579
x-served-by
cache-vie6347-VIE
last-modified
Thu, 01 Sep 2022 18:23:26 GMT
server
Apache
x-timer
S1676653699.070534,VS0,VE0
etag
"421e-5e7a1b598e380-gzip"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
x-vimeo-dc
ge
x-bapp-server
assets-67ff759c65-khkw6
cache-control
max-age=86400
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 29 Aug 2032 19:32:03 GMT
6si.min.js
j.6sc.co/
33 KB
10 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.96.140.70 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-96-140-70.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
beeb705b69f299ad7567ae7ba292ae685556a7082531220a088a0d3b3307c410
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Feb 2023 17:08:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 09 Feb 2023 18:18:39 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63e538ff-820b"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
10438
expires
Fri, 17 Feb 2023 17:08:19 GMT
box-e031119f9e9e307a08fa610f85dbfb52.html
vars.hotjar.com/ Frame AF70
2 KB
1 KB
Document
General
Full URL
https://vars.hotjar.com/box-e031119f9e9e307a08fa610f85dbfb52.html
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1854968.js?sv=7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-113.fra60.r.cloudfront.net
Software
/
Resource Hash
f92333a45b532bdb5248178674b041b1c35edfd33a55df48192256f0bfe49e4e
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

Referer
https://www.menlosecurity.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
1223892
cache-control
max-age=31536000
content-encoding
br
content-length
1034
content-type
text/html
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Fri, 03 Feb 2023 13:10:06 GMT
etag
"112fdf47cdb80b9ce3d033ed09717460"
last-modified
Fri, 03 Feb 2023 13:09:45 GMT
strict-transport-security
max-age=2592000; includeSubDomains
vary
Accept-Encoding
via
1.1 32db37931b5639dc27ebaba3ad4f3d2c.cloudfront.net (CloudFront)
x-amz-cf-id
ae3CvpaAsX3gTuQYR9KaCN066jJhwNCNP-CCAAK93qBT8LE1YW_MsA==
x-amz-cf-pop
FRA60-P4
x-cache
Hit from cloudfront
x-robots-tag
none
gif.gif
ibc-flow.techtarget.com/a/
43 B
468 B
XHR
General
Full URL
https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=16648054&r=1676653698926&ref=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&version=2.4
Requested by
Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
231.208.111.34.bc.googleusercontent.com
Software
nginx/1.20.2 /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

ibc_rate_tier
16648054
Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:19 GMT
via
1.1 google
x-guploader-uploadid
ADPycdsK45gkkb8g0Lde3DnND1fFQNEuFPdli4toJxOgXOb1gQl1YQ1I5C9xfy6_TaYABHOlRg8n9_o4Yod0WUm784t3LstK0t8z
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
last-modified
Thu, 08 Dec 2022 21:19:29 GMT
server
nginx/1.20.2
etag
"fc94fb0c3ed8a8f909dbc7630a0987ff"
vary
Origin
x-goog-generation
1670534369365034
content-type
image/gif
access-control-allow-origin
*
x-goog-hash
crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
cache-control
public, max-age=3600
access-control-allow-methods
GET, POST, OPTIONS
x-goog-stored-content-length
43
accept-ranges
bytes
access-control-allow-headers
ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
expires
Fri, 17 Feb 2023 18:08:19 GMT
gif.gif
ibc-flow.techtarget.com/a/ Frame
0
0
Preflight
General
Full URL
https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=16648054&r=1676653698926&ref=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&version=2.4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
231.208.111.34.bc.googleusercontent.com
Software
nginx/1.20.2 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
ibc_rate_tier
Access-Control-Request-Method
GET
Origin
https://www.menlosecurity.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

access-control-allow-headers
ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-length
0
content-type
text/html; charset=UTF-8
date
Fri, 17 Feb 2023 17:08:19 GMT
expires
Fri, 17 Feb 2023 17:08:19 GMT
server
nginx/1.20.2
vary
Origin
via
1.1 google
x-guploader-uploadid
ADPycdttFGlvp8wAFq3k8382BFIQZEP23TiTFzMmOyi4_kHc2tYZ3NQkeoAhUN7T420iTTcg2zuSRfmOGYRshVrffF8KfJxkzLWb
create
st.fullcircleinsights.com/v1/visitors/
1 KB
2 KB
XHR
General
Full URL
https://st.fullcircleinsights.com/v1/visitors/create
Requested by
Host: d2i34c80a0ftze.cloudfront.net
URL: https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=187d2103-bdc5-4e3f-b070-b5c6a4000840&domain=menlosecurity.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-97-101.fra56.r.cloudfront.net
Software
/
Resource Hash
a5d55252f098d60e559b04bbaab7942674fa05acb7759b2bc49f9628f7c11463

Request headers

origin-fci
https://www.menlosecurity.com
Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
js-version
1.0.57
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
x-api-key
uSI2bzqNHv34zA8znmW0LgfsY9TBayMx9gZJf430
Content-Type
text/plain;charset=UTF-8

Response headers

date
Fri, 17 Feb 2023 17:08:19 GMT
via
1.1 e9101023ffbe04130b9d4cac0cf9eebc.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P2
x-amzn-trace-id
Root=1-63efb483-1cd8d6911d728b6673b5a7ff;Sampled=0
x-amzn-requestid
e3abde7b-1eaa-4041-86e8-0529945ecf1d
vary
Origin
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
https://www.menlosecurity.com
x-amz-apigw-id
AfkknFTMPHcFmAg=
content-length
1428
x-amz-cf-id
pw78IpdyZqfKGWN7xtMSuP6WMcZ9jxz2S4LpdPriuZAZ34R4--CgCw==
create
st.fullcircleinsights.com/v1/visitors/ Frame
0
0
Preflight
General
Full URL
https://st.fullcircleinsights.com/v1/visitors/create
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-97-101.fra56.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
js-version,origin-fci,x-api-key
Access-Control-Request-Method
POST
Origin
https://www.menlosecurity.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
https://www.menlosecurity.com
content-length
1
content-type
application/json
date
Fri, 17 Feb 2023 17:08:19 GMT
via
1.1 e9101023ffbe04130b9d4cac0cf9eebc.cloudfront.net (CloudFront)
x-amz-apigw-id
AfkkiHwrPHcFlLw=
x-amz-cf-id
tVyMS2L7tb_DUXogLa4bMwX851DKXZg9Wiwiw7LMxX-qfYVhqtSsCQ==
x-amz-cf-pop
FRA56-P2
x-amzn-requestid
620b4d82-4a6a-412a-b669-56e0ade652a5
x-cache
Miss from cloudfront
/
www.facebook.com/tr/
0
185 B
Image
General
Full URL
https://www.facebook.com/tr/?id=1626328370711236&ev=PageView&dl=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&rl=&if=false&ts=1676653698974&sw=1600&sh=1200&v=2.9.96&r=stable&ec=0&o=30&cs_est=true&fbp=fb.1.1676653698973.1233934603&it=1676653698666&coo=false&rqm=GET
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Fri, 17 Feb 2023 17:08:19 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
visit-data
in.hotjar.com/api/v2/client/sites/1854968/
148 B
323 B
XHR
General
Full URL
https://in.hotjar.com/api/v2/client/sites/1854968/visit-data?sv=7
Requested by
Host: script.hotjar.com
URL: https://script.hotjar.com/modules.7659de6e9a796dae10e4.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.220.64.134 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-220-64-134.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e06e9fa0c40a8cc645b697a45747eb06cb230ca0a48862a26847435d314ab228

Request headers

Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
Content-Type
text/plain; charset=UTF-8

Response headers

date
Fri, 17 Feb 2023 17:08:19 GMT
content-encoding
br
vary
Accept-Encoding
access-control-max-age
86400
content-type
application/json
access-control-allow-origin
*
cache-control
no-cache, no-store
access-control-allow-credentials
true
getuidj
secure.adnxs.com/
11 B
826 B
XHR
General
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.171.85 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
1006.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 17 Feb 2023 17:08:19 GMT
AN-X-Request-Uuid
4336d33a-224d-4af2-8a23-2a73bb9961ed
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
application/json; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.menlosecurity.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
217.114.218.23; 217.114.218.23; 1006.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length
11
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
c.6sc.co/
7 B
206 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.96.140.70 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-96-140-70.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:19 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://www.menlosecurity.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/
24 B
266 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:f700:4bf::1c91 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
b7bab399e87338ff7e75ac15e592a194fce5a9bce2b7e899f6510af38c5c4177

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Feb 2023 17:08:19 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://www.menlosecurity.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2001:1b60:2:240:3247::10
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
24
expires
Fri, 17 Feb 2023 17:08:19 GMT
sa.css
tags.srv.stackadapt.com/
65 B
292 B
Stylesheet
General
Full URL
https://tags.srv.stackadapt.com/sa.css
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.202.126.200 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-202-126-200.compute-1.amazonaws.com
Software
/
Resource Hash
82e8cd748cf783ef9a94084d6273dfb1521495f6e421788f3f42659f955e9060

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 17 Feb 2023 17:08:19 GMT
Cache-Control
only-if-cached, no-transform, private, max-age=7776000
Connection
keep-alive
Content-Length
65
Content-Type
text/css
sa.jpeg
tags.srv.stackadapt.com/
0
881 B
Fetch
General
Full URL
https://tags.srv.stackadapt.com/sa.jpeg
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.202.126.200 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-202-126-200.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 17 Feb 2023 17:08:19 GMT
Cache-Control
only-if-cached, no-transform, private, max-age=7776000
Connection
keep-alive
Content-Length
651
Content-Type
image/jpeg
sa.jpeg
tags.srv.stackadapt.com/
0
881 B
Fetch
General
Full URL
https://tags.srv.stackadapt.com/sa.jpeg
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.202.126.200 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-202-126-200.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 17 Feb 2023 17:08:19 GMT
Cache-Control
only-if-cached, no-transform, private, max-age=7776000
Connection
keep-alive
Content-Length
651
Content-Type
image/jpeg
img.gif
b.6sc.co/v1/beacon/
43 B
494 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=eb791c6e-994e-4338-81dc-ddd80513d57f&session=0424f783-1e2a-4b57-80ce-9445c286747e&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Fri%2C%2017%20Feb%202023%2017%3A08%3A19%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2017%20Feb%202023%2017%3A08%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22978e5d07c2a3a90aa4884115fca62376%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2017%20Feb%202023%2017%3A08%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22cb6b946368e1bb01c6dac9732a72e3bc7e1fdd12%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2017%20Feb%202023%2017%3A08%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2017%20Feb%202023%2017%3A08%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2017%20Feb%202023%2017%3A08%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Menlo%20Labs%20research%20team%20analyzes%20Qakbot%2C%20one%20of%20the%20leading%20banking%20Trojans%20around%20the%20globe.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&pageViewId=19059956-05bc-4023-82ac-7a6627b2ab99&an_uid=0
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.96.140.70 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-96-140-70.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:19 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
munchkin.js
munchkin.marketo.net/162/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/162/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.87.143.22 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-87-143-22.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Fri, 17 Feb 2023 17:08:19 GMT
Content-Encoding
gzip
Last-Modified
Fri, 01 Jul 2022 00:59:12 GMT
Server
AkamaiNetStorage
ETag
"75daf56f6191efe42577301908659c29:1656637152.894482"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4677
Expires
Sun, 28 May 2023 17:08:19 GMT
5672437d-1ff1-4eae-8a93-b85fb8bf6c1b
https://www.menlosecurity.com/
43 B
0
Image
General
Full URL
blob:https://www.menlosecurity.com/5672437d-1ff1-4eae-8a93-b85fb8bf6c1b
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Content-Length
43
Content-Type
image/gif
widget-501241365316ccaa6a710fa6a5f52abb.js
app.hushly.com/assets/
422 KB
126 KB
Script
General
Full URL
https://app.hushly.com/assets/widget-501241365316ccaa6a710fa6a5f52abb.js
Requested by
Host: app.hushly.com
URL: https://app.hushly.com/runtime/widget.js?aid=83162
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.112.237.127 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-50-112-237-127.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
180cc8c07b9ddcaafa56301137f7054af4c50c4b117d9dd62d0610942eb7fd64

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:19 GMT
content-encoding
gzip
last-modified
Thu, 16 Feb 2023 09:41:58 GMT
etag
"widget-501241365316ccaa6a710fa6a5f52abb.js"
vary
Accept-Encoding
content-type
application/javascript;charset=UTF-8
cache-control
public, max-age=31536000
content-length
128263
details
epsilon.6sense.com/v3/company/
770 B
597 B
XHR
General
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.156.53.215 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-156-53-215.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
47c237678f5bde045688185ede7a749a10c65de5b68c511cce9310bf66853cbb

Request headers

Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
Authorization
Token cb6b946368e1bb01c6dac9732a72e3bc7e1fdd12
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:19 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.menlosecurity.com
access-control-allow-credentials
true
content-length
408
details
epsilon.6sense.com/v3/company/ Frame
0
0
Preflight
General
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.156.53.215 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-156-53-215.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization
Access-Control-Request-Method
GET
Origin
https://www.menlosecurity.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
authorization
access-control-allow-methods
OPTIONS,GET
access-control-allow-origin
https://www.menlosecurity.com
access-control-max-age
1800
date
Fri, 17 Feb 2023 17:08:19 GMT
server
nginx
visitWebPage
281-owv-899.mktoresp.com/webevents/
2 B
318 B
Ping
General
Full URL
https://281-owv-899.mktoresp.com/webevents/visitWebPage?_mchNc=1676653699310&_mchCn=&_mchId=281-OWV-899&_mchTk=_mch-menlosecurity.com-1676653699309-31151&_mchHo=www.menlosecurity.com&_mchPo=&_mchRu=%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F&_mchPc=https%3A&_mchVr=162&_mchEcid=&_mchHa=&_mchRe=&_mchQp=utm_campaign%3Dcontentnewsletter-nov2022__-__utm_medium%3Demail__-__utm_source%3Doutboundemail
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/162/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Fri, 17 Feb 2023 17:08:20 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
9cdfa1c6-e4d0-4bb9-a1c1-eab6b74c586e
img.gif
b.6sc.co/v1/beacon/
43 B
494 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=eb791c6e-994e-4338-81dc-ddd80513d57f&session=0424f783-1e2a-4b57-80ce-9445c286747e&event=ipv6&q=%7B%22address%22%3A%222001%3A1b60%3A2%3A240%3A3247%3A%3A10%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Menlo%20Labs%20research%20team%20analyzes%20Qakbot%2C%20one%20of%20the%20leading%20banking%20Trojans%20around%20the%20globe.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&pageViewId=19059956-05bc-4023-82ac-7a6627b2ab99&an_uid=0
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.96.140.70 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-96-140-70.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:19 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
/
www.facebook.com/tr/ Frame 8685
0
53 B
Document
General
Full URL
https://www.facebook.com/tr/
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://www.menlosecurity.com
Referer
https://www.menlosecurity.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://www.menlosecurity.com
alt-svc
h3=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Fri, 17 Feb 2023 17:08:19 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
saq_pxl
tags.srv.stackadapt.com/
94 B
403 B
XHR
General
Full URL
https://tags.srv.stackadapt.com/saq_pxl?uid=Xve1da1krYlzEarKmNXl-g&is_js=true&landing_url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&t=An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security&tip=UIt0VHYR4KP7BDNiNZ5LIok2dM2xCPUyQ44_IDCCMOE&host=https://www.menlosecurity.com&sa_conv_data_css_value=%20%220-6c0595c9-a2f9-40c3-5f72-8ca0989b2e93%22&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd975de8fabc0384ad06a320e0784b72b5fd972da17&sa-user-id-v2=s%253AbAWVyaL5QMNfcoygmJsuk9ly2hc.o0KzfqoHUTZMzTEQNSJ4DUQJ968r4MvarViwtCu3T4Q&sa-user-id=s%253A0-6c0595c9-a2f9-40c3-5f72-8ca0989b2e93.gVY8Mbss0DNjtDXBWfiErTZ1vIVYSwlvQfkm1hpdzcc
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.202.126.200 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-202-126-200.compute-1.amazonaws.com
Software
/
Resource Hash
078f3dd88e751c3c421b2007e1cb27bcb65a95daf278bd25de81ba7b2bf3c4e4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Fri, 17 Feb 2023 17:08:19 GMT
Access-Control-Allow-Methods
GET
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
https://www.menlosecurity.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
94
saq_pxl
tags.srv.stackadapt.com/
94 B
403 B
XHR
General
Full URL
https://tags.srv.stackadapt.com/saq_pxl?uid=Qx2zgcBp28NGsaKUIZmZkg&is_js=true&landing_url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&t=An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security&tip=UIt0VHYR4KP7BDNiNZ5LIok2dM2xCPUyQ44_IDCCMOE&host=https://www.menlosecurity.com&sa_conv_data_css_value=&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd9cffa957a134143e246cf00517094775ad972da17&sa-user-id-v2=s%253AbAWVyaL5QMNfcoygmJsuk9ly2hc.o0KzfqoHUTZMzTEQNSJ4DUQJ968r4MvarViwtCu3T4Q&sa-user-id=s%253A0-6c0595c9-a2f9-40c3-5f72-8ca0989b2e93.gVY8Mbss0DNjtDXBWfiErTZ1vIVYSwlvQfkm1hpdzcc
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.202.126.200 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-202-126-200.compute-1.amazonaws.com
Software
/
Resource Hash
078f3dd88e751c3c421b2007e1cb27bcb65a95daf278bd25de81ba7b2bf3c4e4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Fri, 17 Feb 2023 17:08:19 GMT
Access-Control-Allow-Methods
GET
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
https://www.menlosecurity.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
94
analytics.js
www.google-analytics.com/
49 KB
20 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:806::200e , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Fri, 17 Feb 2023 15:12:06 GMT
last-modified
Tue, 10 Jan 2023 21:29:14 GMT
server
Golfe2
age
6973
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20085
expires
Fri, 17 Feb 2023 17:12:06 GMT
queue
st.fullcircleinsights.com/v1/visits/
2 KB
3 KB
XHR
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Requested by
Host: d2i34c80a0ftze.cloudfront.net
URL: https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=187d2103-bdc5-4e3f-b070-b5c6a4000840&domain=menlosecurity.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-97-101.fra56.r.cloudfront.net
Software
/
Resource Hash
8cfc8b8e060822ff5c24a6bc13a2380b72ff547e9ecddb5a12c18f6a2be805b3

Request headers

origin-fci
https://www.menlosecurity.com
Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
js-version
1.0.57
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
x-api-key
uSI2bzqNHv34zA8znmW0LgfsY9TBayMx9gZJf430
Content-Type
text/plain;charset=UTF-8

Response headers

date
Fri, 17 Feb 2023 17:08:20 GMT
via
1.1 e9101023ffbe04130b9d4cac0cf9eebc.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P2
x-amzn-trace-id
Root=1-63efb484-74dee354745bbb7e71e996b4;Sampled=0
x-amzn-requestid
b03dfd3a-f037-465f-a2fe-ee7b850491d7
vary
Origin
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
https://www.menlosecurity.com
x-amz-apigw-id
AfkkxEJRvHcFVRA=
content-length
2194
x-amz-cf-id
PNDlT97TJXAbSYiCk81Iw0AmChuze44nwfKTsLqkr1LAr5VJ7F2vxw==
queue
st.fullcircleinsights.com/v1/visits/ Frame
0
0
Preflight
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-97-101.fra56.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
js-version,origin-fci,x-api-key
Access-Control-Request-Method
POST
Origin
https://www.menlosecurity.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
https://www.menlosecurity.com
content-length
1
content-type
application/json
date
Fri, 17 Feb 2023 17:08:20 GMT
via
1.1 e9101023ffbe04130b9d4cac0cf9eebc.cloudfront.net (CloudFront)
x-amz-apigw-id
AfkksG-ePHcFb-A=
x-amz-cf-id
A230lhwFXitHv1ZDPcm2Y_IT37T5_dkne_xJGVqrt4oksMiaMQM8Ew==
x-amz-cf-pop
FRA56-P2
x-amzn-requestid
6628e231-658c-4bf9-b11c-d90e5d7c80be
x-cache
Miss from cloudfront
collect
www.google-analytics.com/j/
4 B
213 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j99&a=1232861254&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&ul=en-us&de=UTF-8&dt=An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=YADAAEABAAAAACAAI~&jid=1464248421&gjid=298149590&cid=2083676563.1676653699&tid=UA-41161362-2&_gid=663799756.1676653700&_r=1&_slc=1&gtm=45He32f0n81WL64MFJ&cd1=&cd2=&cd3=&cd4=&cd5=&cd6=&z=1104118592
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:806::200e , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 17 Feb 2023 17:08:19 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.menlosecurity.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/
4 B
151 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-41161362-2&cid=2083676563.1676653699&jid=1464248421&gjid=298149590&_gid=663799756.1676653700&_u=YADAAEAAAAAAACAAI~&z=190036124
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Fri, 17 Feb 2023 17:08:19 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.menlosecurity.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
107 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-41161362-2&cid=2083676563.1676653699&jid=1464248421&_u=YADAAEAAAAAAACAAI~&z=1854836967
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Feb 2023 17:08:19 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
107 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-41161362-2&cid=2083676563.1676653699&jid=1464248421&_u=YADAAEAAAAAAACAAI~&z=1854836967
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Feb 2023 17:08:19 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
forms2.css
info.menlosecurity.com/js/forms2/css/
13 KB
3 KB
Stylesheet
General
Full URL
https://info.menlosecurity.com/js/forms2/css/forms2.css
Requested by
Host: info.menlosecurity.com
URL: https://info.menlosecurity.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 12 Jan 2023 20:56:20 GMT
server
cloudflare
age
7052
etag
"9c1691-3437-5f217594de500"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
79b01fd939293819-FRA
content-length
2623
expires
Fri, 17 Feb 2023 21:08:20 GMT
forms2-theme-plain.css
info.menlosecurity.com/js/forms2/css/
828 B
331 B
Stylesheet
General
Full URL
https://info.menlosecurity.com/js/forms2/css/forms2-theme-plain.css
Requested by
Host: info.menlosecurity.com
URL: https://info.menlosecurity.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 12 Jan 2023 20:56:20 GMT
server
cloudflare
age
7052
etag
"1e403ea-33c-5f217594de500"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
79b01fd9492d3819-FRA
content-length
246
expires
Fri, 17 Feb 2023 21:08:20 GMT
css
fonts.googleapis.com/
2 KB
619 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Raleway
Requested by
Host: info.menlosecurity.com
URL: https://info.menlosecurity.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
7d3b9b124ab86b33b4c72d29ceca9c5a56e5205e546394f55e1ca7fac57d58d5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Fri, 17 Feb 2023 17:08:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 17 Feb 2023 16:57:29 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 17 Feb 2023 17:08:20 GMT
1Ptxg8zYS_SKggPN4iEgvnHyvveLxVvaorCIPrE.woff2
fonts.gstatic.com/s/raleway/v28/
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/raleway/v28/1Ptxg8zYS_SKggPN4iEgvnHyvveLxVvaorCIPrE.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c78a1da5fd0868a547cf285748c7fb73006571190385eb71c0d601b6b240ffaf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.menlosecurity.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Thu, 16 Feb 2023 01:06:16 GMT
x-content-type-options
nosniff
age
144124
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
21280
x-xss-protection
0
last-modified
Mon, 18 Jul 2022 19:57:59 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 16 Feb 2024 01:06:16 GMT
XDFrame
info.menlosecurity.com/index.php/form/ Frame B42B
2 KB
770 B
Document
General
Full URL
https://info.menlosecurity.com/index.php/form/XDFrame
Requested by
Host: info.menlosecurity.com
URL: https://info.menlosecurity.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b43508242f21a59b37bba45231dd25c6c861e079ef05607273c620337e217b9b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.menlosecurity.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=3600
cf-cache-status
DYNAMIC
cf-ray
79b01fda5b2b3819-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Fri, 17 Feb 2023 17:08:21 GMT
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff
queue
st.fullcircleinsights.com/v1/visits/
2 KB
3 KB
XHR
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Requested by
Host: d2i34c80a0ftze.cloudfront.net
URL: https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=187d2103-bdc5-4e3f-b070-b5c6a4000840&domain=menlosecurity.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-97-101.fra56.r.cloudfront.net
Software
/
Resource Hash
1e12de52ccf27ce49c9b683ba0023cdc257036882cc845ff5f33c773253e6053

Request headers

origin-fci
https://www.menlosecurity.com
Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
js-version
1.0.57
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
x-api-key
uSI2bzqNHv34zA8znmW0LgfsY9TBayMx9gZJf430
Content-Type
text/plain;charset=UTF-8

Response headers

date
Fri, 17 Feb 2023 17:08:20 GMT
via
1.1 e9101023ffbe04130b9d4cac0cf9eebc.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P2
x-amzn-trace-id
Root=1-63efb484-4dfce04455b99e8c42bef0f8;Sampled=0
x-amzn-requestid
b2d7ec08-6750-4b4f-90ce-5517f934a97b
vary
Origin
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
https://www.menlosecurity.com
x-amz-apigw-id
AfkkyFgCPHcFSEQ=
content-length
2194
x-amz-cf-id
c2F8Bdfz5ApAYL2e7HujxJZ-Ne31xT8eqh7iMLD7QHMG3bKZOzKANQ==
img.gif
b.6sc.co/v1/beacon/
43 B
494 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=eb791c6e-994e-4338-81dc-ddd80513d57f&session=0424f783-1e2a-4b57-80ce-9445c286747e&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2017%20Feb%202023%2017%3A08%3A20%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2017%20Feb%202023%2017%3A08%3A19%20GMT%22%2C%22timeSpent%22%3A%221054%22%2C%22totalTimeSpent%22%3A%221054%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Menlo%20Labs%20research%20team%20analyzes%20Qakbot%2C%20one%20of%20the%20leading%20banking%20Trojans%20around%20the%20globe.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&pageViewId=19059956-05bc-4023-82ac-7a6627b2ab99&an_uid=0
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.96.140.70 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-96-140-70.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:20 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
queue
st.fullcircleinsights.com/v1/visits/ Frame
0
0
Preflight
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-97-101.fra56.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
js-version,origin-fci,x-api-key
Access-Control-Request-Method
POST
Origin
https://www.menlosecurity.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
https://www.menlosecurity.com
content-length
1
content-type
application/json
date
Fri, 17 Feb 2023 17:08:20 GMT
via
1.1 e9101023ffbe04130b9d4cac0cf9eebc.cloudfront.net (CloudFront)
x-amz-apigw-id
AfkktGQlPHcFh3Q=
x-amz-cf-id
wG_PgvK1gkIZ9y3d0cJ_rOdqvUJ8ZBuLFJ1FMOHUpkxDntrAY_CM9g==
x-amz-cf-pop
FRA56-P2
x-amzn-requestid
0530935b-d2f9-4c7c-9e9b-e58b962ba8f7
x-cache
Miss from cloudfront
forms2.min.js
info.menlosecurity.com/js/forms2/js/ Frame B42B
208 KB
69 KB
Script
General
Full URL
https://info.menlosecurity.com/js/forms2/js/forms2.min.js
Requested by
Host: info.menlosecurity.com
URL: https://info.menlosecurity.com/index.php/form/XDFrame
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://info.menlosecurity.com/index.php/form/XDFrame
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 12 Jan 2023 20:56:20 GMT
server
cloudflare
age
7054
etag
"1e4042e-33e51-5f217594de500"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
79b01fe02e1d3819-FRA
expires
Fri, 17 Feb 2023 21:08:21 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=eb791c6e-994e-4338-81dc-ddd80513d57f&session=0424f783-1e2a-4b57-80ce-9445c286747e&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2017%20Feb%202023%2017%3A08%3A21%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2017%20Feb%202023%2017%3A08%3A20%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%222058%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Menlo%20Labs%20research%20team%20analyzes%20Qakbot%2C%20one%20of%20the%20leading%20banking%20Trojans%20around%20the%20globe.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&pageViewId=19059956-05bc-4023-82ac-7a6627b2ab99&an_uid=0
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.96.140.70 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-96-140-70.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:21 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=eb791c6e-994e-4338-81dc-ddd80513d57f&session=0424f783-1e2a-4b57-80ce-9445c286747e&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2017%20Feb%202023%2017%3A08%3A22%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2017%20Feb%202023%2017%3A08%3A21%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%223058%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Menlo%20Labs%20research%20team%20analyzes%20Qakbot%2C%20one%20of%20the%20leading%20banking%20Trojans%20around%20the%20globe.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&pageViewId=19059956-05bc-4023-82ac-7a6627b2ab99&an_uid=0
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-nov2022&utm_medium=email&utm_source=outboundemail
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.96.140.70 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-96-140-70.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:22 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
widget-86616d5946edd9a2cd99f210fd4931af.css
app.hushly.com/assets/
68 KB
12 KB
Stylesheet
General
Full URL
https://app.hushly.com/assets/widget-86616d5946edd9a2cd99f210fd4931af.css
Requested by
Host: app.hushly.com
URL: https://app.hushly.com/assets/widget-501241365316ccaa6a710fa6a5f52abb.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.112.237.127 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-50-112-237-127.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
ecb4cf1400337bb3e1f8d6e9c312534a7e4a786832b909799c1d26373371861e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:22 GMT
content-encoding
gzip
last-modified
Thu, 16 Feb 2023 09:41:58 GMT
etag
"widget-86616d5946edd9a2cd99f210fd4931af.css"
vary
Accept-Encoding
content-type
text/css;charset=UTF-8
cache-control
public, max-age=31536000
content-length
11705
83162
app.hushly.com/runtime/widgets/
5 KB
3 KB
XHR
General
Full URL
https://app.hushly.com/runtime/widgets/83162
Requested by
Host: app.hushly.com
URL: https://app.hushly.com/assets/widget-501241365316ccaa6a710fa6a5f52abb.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.112.237.127 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-50-112-237-127.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
91623c33aade4a8d9370f6b51c6baf9680e6de834d33185a4f672ba7778fbed6

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin
https://www.menlosecurity.com
date
Fri, 17 Feb 2023 17:08:22 GMT
content-encoding
gzip
access-control-allow-credentials
true
x-robots-tag
noindex
vary
Accept-Encoding
content-type
text/javascript
83162
app.hushly.com/runtime/visitor/
39 B
655 B
Script
General
Full URL
https://app.hushly.com/runtime/visitor/83162?callback=hushlyVisitorCallback&sid=ba6eb79a-6454-406b-9a50-250030611d35&vid=7e657c18-54de-4bce-9b55-a0a1f93ea609&version=2&hly-ip-address=&_=1676653702279
Requested by
Host: app.hushly.com
URL: https://app.hushly.com/assets/widget-501241365316ccaa6a710fa6a5f52abb.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.112.237.127 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-50-112-237-127.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
f595a7eeaf2e9ef60746074e0ff87a1b6bf60355ece3559d666b9b59041dc976

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:22 GMT
cache-control
max-age=31536000, public
content-encoding
gzip
x-robots-tag
noindex
vary
Accept-Encoding
content-type
text/javascript
core
js.driftt.com/ Frame 7838
2 KB
1 KB
Document
General
Full URL
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1676653800000/trrsm2wf4gwm.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
09d3561e03ada8fad9e775913a66b7d5abc4a2f16299f13f7b04d416b110f6dc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.menlosecurity.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-cache
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Fri, 17 Feb 2023 17:08:22 GMT
etag
W/"c67428c125d174aaf85216a5a50cf004"
last-modified
Thu, 16 Feb 2023 17:14:52 GMT
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-id
KLIIBhd696s6XJh3QHPwHDk3rXBkjlka3i3csEroKn0vvC8DVEz0HQ==
x-amz-cf-pop
FRA56-P5
x-amz-server-side-encryption
AES256
x-amz-version-id
ZTHwaOUorp1P5m9vEvyrK6g6S8PFGWM5
x-cache
RefreshHit from cloudfront
x-envoy-upstream-service-time
14
chat
js.driftt.com/core/ Frame 937B
2 KB
1 KB
Document
General
Full URL
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1676653800000/trrsm2wf4gwm.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
09d3561e03ada8fad9e775913a66b7d5abc4a2f16299f13f7b04d416b110f6dc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.menlosecurity.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-cache
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Fri, 17 Feb 2023 17:08:22 GMT
etag
W/"c67428c125d174aaf85216a5a50cf004"
last-modified
Thu, 16 Feb 2023 17:14:52 GMT
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-id
eQwEJ0vjoznylScojAp0gluJI7X63e3LkWIwXM4apv-WlkNSkq9s7g==
x-amz-cf-pop
FRA56-P5
x-amz-server-side-encryption
AES256
x-amz-version-id
ZTHwaOUorp1P5m9vEvyrK6g6S8PFGWM5
x-cache
RefreshHit from cloudfront
x-envoy-upstream-service-time
15
queue
st.fullcircleinsights.com/v1/visits/
2 KB
3 KB
XHR
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Requested by
Host: d2i34c80a0ftze.cloudfront.net
URL: https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=187d2103-bdc5-4e3f-b070-b5c6a4000840&domain=menlosecurity.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-97-101.fra56.r.cloudfront.net
Software
/
Resource Hash
ff34521a617922ef17afe7660d744964af7b8d3e815b9e70ca3cb5dfdae9c073

Request headers

origin-fci
https://www.menlosecurity.com
Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
js-version
1.0.57
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
x-api-key
uSI2bzqNHv34zA8znmW0LgfsY9TBayMx9gZJf430
Content-Type
text/plain;charset=UTF-8

Response headers

date
Fri, 17 Feb 2023 17:08:23 GMT
via
1.1 e9101023ffbe04130b9d4cac0cf9eebc.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P2
x-amzn-trace-id
Root=1-63efb487-4df84bd0572ce07343f50b6f;Sampled=0
x-amzn-requestid
84ed0a95-1422-4487-8dc5-8311fc28883e
vary
Origin
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
https://www.menlosecurity.com
x-amz-apigw-id
AfklPFySPHcFcqw=
content-length
2194
x-amz-cf-id
G9kz7mjNYJ0SCT8PLwrZNbMbq-UA1T1iKhDmyU-pemvqPnuttLtDAw==
queue
st.fullcircleinsights.com/v1/visits/ Frame
0
0
Preflight
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-97-101.fra56.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
js-version,origin-fci,x-api-key
Access-Control-Request-Method
POST
Origin
https://www.menlosecurity.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
https://www.menlosecurity.com
content-length
1
content-type
application/json
date
Fri, 17 Feb 2023 17:08:23 GMT
via
1.1 e9101023ffbe04130b9d4cac0cf9eebc.cloudfront.net (CloudFront)
x-amz-apigw-id
AfklKF7rvHcFcDQ=
x-amz-cf-id
Ardjb57N2j-id9P317l8_9Q_MDHwSfmNEigclNoXA_VgXOWcNG40Zw==
x-amz-cf-pop
FRA56-P2
x-amzn-requestid
cda2ec93-5ad4-43fd-b9c5-4642aa6ab506
x-cache
Miss from cloudfront
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j99&a=1232861254&t=pageview&_s=1&dl=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&ul=en-us&de=UTF-8&dt=An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aADAAEABAAAAACAAI~&jid=&gjid=&cid=2083676563.1676653699&tid=UA-41161362-2&_gid=663799756.1676653700&gtm=45He32f0n81WL64MFJ&cd1=&cd2=&cd3=&cd4=&cd5=&cd6=&z=1208816843
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:806::200e , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Feb 2023 00:08:42 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
61180
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
runtime~main.f28524d3.js
js.driftt.com/core/assets/js/ Frame 7838
6 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
dd8c7f7aae00c226824b8caad79b25703a1b017f6034e11ac53a4fa3dd564b1d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Thu, 16 Feb 2023 17:14:52 GMT
x-amz-version-id
kd17yzt.94F43DDJ5FwwRFZj9O5Kj1p6
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
86010
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
16
last-modified
Thu, 16 Feb 2023 17:02:31 GMT
server
istio-envoy
etag
W/"33b3081afd797e9b0eaa1bd3a7ffadd3"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
QckkGv0kz9DqYlKs-Uo_BWE1MrM_M8FwRuecVdTELAS1xkvtbwX89w==
9.4a3e9801.chunk.js
js.driftt.com/core/assets/js/ Frame 7838
35 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/9.4a3e9801.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
2a8a441d8086f20a64563edc759aba1de84d932e34ff77b8bb0279a730cdb428
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:56 GMT
x-amz-version-id
hzm2Healt7ZjvNDM3nYQ47BRwWjFuLrw
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813406
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
16
last-modified
Fri, 27 Jan 2023 17:00:22 GMT
server
istio-envoy
etag
W/"c6f58dd3d60f07462254b842dd4f9ca1"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
YjvRFP1XincXEYCgXTQNHFm06MTZuar8WD1QBkuTeVSBuq_Ga4BCBw==
main~493df0b3.6a8a7bc7.chunk.js
js.driftt.com/core/assets/js/ Frame 7838
7 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/main~493df0b3.6a8a7bc7.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
5ccd2287af72e2d56e11ebfcdb02dede2b9e39277e121ca53cbfbcc9cb529d3e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Wed, 15 Feb 2023 15:25:25 GMT
x-amz-version-id
pqJrRdr9rCUt5d48MN3IAyIbN5cCPBJp
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
178977
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
17
last-modified
Wed, 15 Feb 2023 15:10:14 GMT
server
istio-envoy
etag
W/"f0643a140ae55663635d2a3849d7a9ab"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
5HjMZ4Ttb1p8jlbTsrxSj2RrGJVGntRo0oY0dnUuK--tM3Rw99QKUQ==
52.b1edaf4a.chunk.js
js.driftt.com/core/assets/js/ Frame 7838
23 KB
8 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/52.b1edaf4a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
7cb58278c8f54a62c0afa6da0c67b3a45aad637a0bf614e9c0dd42b73cee266b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:56 GMT
x-amz-version-id
TtzAkuiFg5ajpar.KJembGW97mIyyYtK
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813406
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
16
last-modified
Fri, 27 Jan 2023 17:00:21 GMT
server
istio-envoy
etag
W/"cd29b9bc973e48a7fcd0ee7153bdf03b"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
vjdiPrOMmShI-BmO5-wRLOCpnJoD13X6uMlfaM4mE29l6jDSNXcnxg==
36.b49bf23f.chunk.js
js.driftt.com/core/assets/js/ Frame 7838
36 KB
10 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/36.b49bf23f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
c2b7a45d31339f18ed57fd095feca4da1b3fbab75a5afbc053957f6e8e1613a2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:56 GMT
x-amz-version-id
SWSsVLzyOcOhQhmvR.pbvKyQeo7W0A10
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813405
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
20
last-modified
Fri, 27 Jan 2023 17:00:21 GMT
server
istio-envoy
etag
W/"4ae92c53ef226eb2a201fc855ccb7835"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
8atj49f338dmbkpkXESKZaYeQO-asUIcMAkVkhBv8UMb67HJ0baZLQ==
25.22647a55.chunk.js
js.driftt.com/core/assets/js/ Frame 7838
32 KB
11 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/25.22647a55.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
ec547a2f9fde5ce8e398da2810828ba3c30c641ce2761f5bf915225efb35f919
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:56 GMT
x-amz-version-id
3Dq5XEj76miHFBtzwx_L1gh4_UbdDQYk
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813405
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
16
last-modified
Fri, 27 Jan 2023 17:00:20 GMT
server
istio-envoy
etag
W/"2ce6c446f71a395ff41647c9ba4b9c19"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
r97dndqA_xB3aGPB2bMzpELnfCbCLtOfMBvjdRfVpS8d6GLHW9HaCA==
20.2ffef383.chunk.js
js.driftt.com/core/assets/js/ Frame 7838
17 KB
6 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/20.2ffef383.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
f46108976666130f89c43a82ee045f7a3afb264494060ef6b3d9eb6589e49d16
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:57 GMT
x-amz-version-id
Sl_LzJMe7m6MkWEK9Fxqk3gRf.6SeAYu
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813405
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
26
last-modified
Fri, 27 Jan 2023 17:00:20 GMT
server
istio-envoy
etag
W/"ec6e94b6cea3a27506634867a8009ded"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
8t--T4TdspMplsdHDtsrw1tpX3Oo-0T6a_T8y4t6aLvRCjduE6xCUQ==
42.67956b13.chunk.js
js.driftt.com/core/assets/js/ Frame 7838
25 KB
8 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/42.67956b13.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
9d88866c6295ffc0cadaa1ccb951367e196737a413482176d5787b70aae04ef0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Wed, 15 Feb 2023 15:25:25 GMT
x-amz-version-id
LwoHxJH_FBDxYvxZo.xGVaPPrUBqnUk_
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
178976
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
20
last-modified
Wed, 15 Feb 2023 15:10:12 GMT
server
istio-envoy
etag
W/"d53cdfd4559700cfe085380882a8e897"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
wmRWo_QQOxkn_72DFLfVrsfEFSssVPThkck5L7GHeyivPvdnJ5PfXA==
21.b3438b1b.chunk.js
js.driftt.com/core/assets/js/ Frame 7838
74 KB
23 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/21.b3438b1b.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
3169ab3142fbf3ecf7eee1b5682a4556ed8a3d4ba940befa71c31b5a43991d92
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Wed, 15 Feb 2023 15:25:25 GMT
x-amz-version-id
VElN.rYQUfZc8FwuS3oQUAN0Q9xeEifo
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
178976
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
15
last-modified
Wed, 15 Feb 2023 15:10:12 GMT
server
istio-envoy
etag
W/"10e1bfa61646f14df045c581bc9410fd"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
xb2cvSqH9KrYge_JzdM-3XgG0vbc7jd3MCvkWj3GegcLMzgHJXWzng==
27.f44ab9c1.chunk.js
js.driftt.com/core/assets/js/ Frame 7838
59 KB
19 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/27.f44ab9c1.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
a04ca4a38cfded547daa7993112f5dcc2fbdf13f93b968d676e1313e8d8e98f6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:56 GMT
x-amz-version-id
wrgwLo8Ut7GsYvCwhzW617Km3EuBTw6K
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813405
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
24
last-modified
Fri, 27 Jan 2023 17:00:21 GMT
server
istio-envoy
etag
W/"768714622a8a2db20ece85777ba47642"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
d2LdVLnRjoinbEpRx_yQJcB0WRYym1s8R73R1YQwmzvMNwBNTyyomA==
15.699b0dc7.chunk.js
js.driftt.com/core/assets/js/ Frame 7838
91 KB
28 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/15.699b0dc7.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
047d14c117d25e9e0a1a2ba3f4aa23a602d417fc7402294e484d20b19140ecf1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:56 GMT
x-amz-version-id
jUF4GGgcG34JdLv0MHXRHyWvmwH3OQeO
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813405
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
17
last-modified
Fri, 27 Jan 2023 17:00:20 GMT
server
istio-envoy
etag
W/"43d1442a9d30453da9eaeb12b9daafff"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
pr-VD4eQkTyYqZFy-ScfrrUjbmh5uznOnhxhh9jp3ci8099dwGF7SQ==
12.d33926cb.chunk.js
js.driftt.com/core/assets/js/ Frame 7838
23 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/12.d33926cb.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
28816769ece0ee343025ff388216c645e175c92cce4db6bd812a321b1ad345c6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:57 GMT
x-amz-version-id
KyS4g55V4uBz7fjaZ0R1pHyOHsEBkZV6
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813405
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
27
last-modified
Fri, 27 Jan 2023 17:00:20 GMT
server
istio-envoy
etag
W/"bdcb035523ec144399213aa65a8430ff"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
jECNbTtnk3Uemx7xApVCNh7_4WhNxQBAMx5T5dxQh0nJXEU_zadhpA==
19.8e79a39a.chunk.js
js.driftt.com/core/assets/js/ Frame 7838
62 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/19.8e79a39a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
b7c5d1d3e03d31b9b450c0aac2972f3aef995be2a69ec5ecfa6200c4a321ef40
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Mon, 13 Feb 2023 04:02:34 GMT
x-amz-version-id
bwRea7wDCbR4ncTw_WLwO3izZD3MoPy9
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
392748
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
42
last-modified
Fri, 10 Feb 2023 18:18:27 GMT
server
istio-envoy
etag
W/"c478a5bb4d7885e2b9250c6beeb4fd6d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
b9ffaid5_NRROBDhUCv8klPhJugUaZrI6LzHAnHM0CM-ygFjmLQggg==
50.de3b5864.chunk.js
js.driftt.com/core/assets/js/ Frame 7838
105 KB
34 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/50.de3b5864.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
c8c302716cf94980a0d77e614d9fb6c430f166b5ef7c42b7c382771955e52ba6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:56 GMT
x-amz-version-id
1DnDsXjV5U2x4yjXf3GCnDIDPlyIffBu
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813406
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
19
last-modified
Fri, 27 Jan 2023 17:00:21 GMT
server
istio-envoy
etag
W/"114785899ceb423273fcc17aaad202e9"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
jPgd4PYmZf6B4n0O36cjmpL2x53F5xhx7HCMRy9Lh8JfkeKcjFwM2w==
41.a1867ad4.chunk.js
js.driftt.com/core/assets/js/ Frame 7838
12 KB
4 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/41.a1867ad4.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
d641c13a78017e11f15b152b78082bcd0cf474766f13ba649bfa6378d956c492
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:56 GMT
x-amz-version-id
X151O2if9SUzZhsBRIHlOqKUakbFDRo_
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813406
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
17
last-modified
Fri, 27 Jan 2023 17:00:21 GMT
server
istio-envoy
etag
W/"299dd262bf32831c99dc78a9c5b5ca43"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
g63DzBUfDVYh7s4vb6UFgV9JKCvPiV2UYVA3md8Krg_x0TDufU3ukg==
30.57dfb56c.chunk.js
js.driftt.com/core/assets/js/ Frame 7838
13 KB
6 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/30.57dfb56c.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
c96b2cd5b57e02ce65ab0a787a6c8ea69efbf424064e15500691847cd879e8ca
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:56 GMT
x-amz-version-id
PRu.RNHym52TA_hlIcQB1Vv5VUA1vVKS
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813406
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
17
last-modified
Fri, 27 Jan 2023 17:00:21 GMT
server
istio-envoy
etag
W/"b8addee34a5cd2241740a2e3094039b3"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
o7CFwR_LVacKu5DMO8xwPGOnBF_JISHAUj6AL7WVcWAnySbWiY0oQw==
22.4cb40074.chunk.js
js.driftt.com/core/assets/js/ Frame 7838
17 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/22.4cb40074.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
cdeb836f7f77cd2174fa0bb4aa3825963aa64faf657a24f988b82f1c4d28ce69
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Wed, 15 Feb 2023 15:25:26 GMT
x-amz-version-id
ykeUDE2sWwwza8uCQZo8fLwm_hGj240R
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
178976
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
39
last-modified
Wed, 15 Feb 2023 15:10:12 GMT
server
istio-envoy
etag
W/"6cf24f8ea74f43662c776ce6af09d469"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Xi0BpINNdci7VZDDsH_kpcBizarMf0hjFHOjWkxegI0rNVQVTVioNw==
10.18bfca70.chunk.css
js.driftt.com/core/assets/css/ Frame 7838
14 KB
3 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/10.18bfca70.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
8ab6891019c69c729441517bed2c703ec68058f913e9fe0d9840617f89473421
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:57 GMT
x-amz-version-id
W.Ed7skdAN0dSG59eVgsVvIsNBx.BMsL
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813405
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
20
last-modified
Fri, 27 Jan 2023 17:00:18 GMT
server
istio-envoy
etag
W/"dd670379de64b0621ee84574f3b8e73d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
c-lzgHpvqqPddaKRpfP6THuSwJmMjo3jE-_-zBZJ7NTdGsULLUC7Zw==
10.b76eb677.chunk.js
js.driftt.com/core/assets/js/ Frame 7838
79 KB
25 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/10.b76eb677.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
c878baf3b2bee3185daa3b0812e979a96e077fdf924b536f6c3e7e373882aa1e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Wed, 15 Feb 2023 18:44:11 GMT
x-amz-version-id
Fcq2O7wHOQRvkyxIvw6HFTAA4EV_e5Q7
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
167051
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
36
last-modified
Wed, 15 Feb 2023 18:18:24 GMT
server
istio-envoy
etag
W/"cbc9a75b208589ec9edc4611d5aaf6ae"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
aDASCU8EDQDI-_KKACNzGN3KU4foGMASXjdRkw1TW54JxKfSdOjVCg==
17.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame 7838
24 B
697 B
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/17.22abfce0.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Thu, 26 Jan 2023 20:13:51 GMT
x-amz-version-id
eR0JFDWwyA3gsnd_XajqmmtDUbC85CBL
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
FRA56-P5
age
1889671
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
22
content-length
24
last-modified
Tue, 11 Oct 2022 19:09:27 GMT
server
istio-envoy
etag
"0c5dad92482d9a7c7c253510f5082465"
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
T-dtqcEOJU3kSvSzXSm75IeZZsh8QhbDwaZe4DJzyQ7lMBRnZCe9vQ==
17.2d19c66a.chunk.js
js.driftt.com/core/assets/js/ Frame 7838
89 KB
23 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/17.2d19c66a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
a4ea37f8af67e84a4d330d3ccfb44eab01c877d0c4100c48c67ea57f1663552c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Wed, 15 Feb 2023 18:44:11 GMT
x-amz-version-id
ik3ByTJPnYyhtI0DOm2S_2nEjNOtG0Ct
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
167051
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
19
last-modified
Wed, 15 Feb 2023 18:18:25 GMT
server
istio-envoy
etag
W/"4de3ff81b975e5a8a5f39e782840df52"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Olj8kBYw1F-Ch0nLTRmZEnq8CE1ML0hV6qFaHY4kYjrHq_CIQudggQ==
26.804680a6.chunk.js
js.driftt.com/core/assets/js/ Frame 7838
50 KB
14 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/26.804680a6.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
672e9b04f273c7bc6b2b23413d590fa1ac1aec88429f4d73998a7cbfbae5bbe5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Thu, 16 Feb 2023 17:14:52 GMT
x-amz-version-id
pfpspt3Jz6W..QQ5vkwVPcMWjcOyyF7H
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
86010
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
16
last-modified
Thu, 16 Feb 2023 17:02:28 GMT
server
istio-envoy
etag
W/"4150cb239859b4872dfc55d0064ba661"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
UCcisBmL-1nYCoSsoWf6j4vjXhkQIqLS9Y02H6Orh_CL8ELo0mFTIQ==
18.34dac473.chunk.js
js.driftt.com/core/assets/js/ Frame 7838
40 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/18.34dac473.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
5d959e050c61344f264ee87cf81e9ffd30cb5ad5b5ae749218e9360a6403c1e4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Thu, 16 Feb 2023 17:14:52 GMT
x-amz-version-id
lv3aFKpN07qrROaTanaC4C4GvuUpSYk3
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
86010
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
19
last-modified
Thu, 16 Feb 2023 17:02:28 GMT
server
istio-envoy
etag
W/"084fc6a6981258c55945f0f6ddf4a771"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
U2rqUQdkdw3rpTe4Sja3BZrWQJaM3rR3pFsoCDvHckulhGPePUlRhw==
83162
app.hushly.com/runtime/countries/
75 KB
20 KB
Script
General
Full URL
https://app.hushly.com/runtime/countries/83162?callback=hushlyCountriesCallback&_=1676653702280
Requested by
Host: app.hushly.com
URL: https://app.hushly.com/assets/widget-501241365316ccaa6a710fa6a5f52abb.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.112.237.127 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-50-112-237-127.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
68b4b6fc343811ef9268a786ba1a6d45532277051d2db7804896df2b58a9b429

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:23 GMT
cache-control
max-age=31536000, public
content-encoding
gzip
x-robots-tag
noindex
vary
Accept-Encoding
content-type
text/javascript
0.0b2ebd4a.chunk.js
js.driftt.com/core/assets/js/ Frame 7838
9 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Sat, 28 Jan 2023 03:20:43 GMT
x-amz-version-id
bxbBo6tiShmSVkJPl3yRp.s0jVilttxU
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1777660
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
29
last-modified
Fri, 27 Jan 2023 17:00:19 GMT
server
istio-envoy
etag
W/"c5efcdc9e465604f32cf24af10fd6c13"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
1F8RPRajOZxcfY53iMIKuHzPbbiZ6OxLurQEujohwxgrtkpImpx1UQ==
28.01a0fe87.chunk.js
js.driftt.com/core/assets/js/ Frame 7838
35 KB
10 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/28.01a0fe87.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
fffcc021124d70080ddd0c52562645c46e03ff39c924ced85c1bfd62cb8b8767
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:57 GMT
x-amz-version-id
oCx9yWccW.dlty4hHqWiey7h_DwTeEBh
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813406
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
22
last-modified
Fri, 27 Jan 2023 17:00:21 GMT
server
istio-envoy
etag
W/"0ad089f0617a0fa8014a23c2afa90ddd"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
J2vosfPdPVDXzWUK3PEgGpx1zh000dZpfsJC28Xu5QJ8CrDX6j6JUw==
29.9bf46b67.chunk.css
js.driftt.com/core/assets/css/ Frame 7838
8 KB
2 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/29.9bf46b67.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
4eda4b5575532ad6a713d3d9bbcde581c519d9b8d0202363925ddc80049eed6d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:57 GMT
x-amz-version-id
qzro7282BXz7SnLdWr3hLeI1pZAqJ2A1
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813406
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
19
last-modified
Fri, 27 Jan 2023 17:00:18 GMT
server
istio-envoy
etag
W/"4f21faf2ba450e5fcdf7eda90813e185"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
07j8DXHancR4mgJ80DncsM5Vhe499ihwg9Qxj7ZPoWD6DhzTlS940Q==
29.e1a4ff99.chunk.js
js.driftt.com/core/assets/js/ Frame 7838
14 KB
6 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/29.e1a4ff99.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
01db0d203405ed4ec9c98bdcb0db8781188bcf88582788fb0e1c3c92c3e24f4f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Wed, 15 Feb 2023 18:44:12 GMT
x-amz-version-id
wkdbw8qtPlaabmxKODiZTD6dxLLQ34XZ
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
167051
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
23
last-modified
Wed, 15 Feb 2023 18:18:25 GMT
server
istio-envoy
etag
W/"deee6d1dc2f18623bf7e1f6bbb50a94e"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Xh45th_DQN7861znhjRzsO_kWngyx8DhYCTa3jxiVPVXgRSG65Vstw==
23.c695453b.chunk.css
js.driftt.com/core/assets/css/ Frame 7838
365 B
1 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/23.c695453b.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Wed, 15 Feb 2023 15:25:26 GMT
x-amz-version-id
JFaqZy69NwkYwPRskCJMqjuf0WwUdgeN
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
FRA56-P5
age
178977
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
24
content-length
365
last-modified
Wed, 15 Feb 2023 15:10:08 GMT
server
istio-envoy
etag
"06b2963b029c0824382815165bfea73e"
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
gLW6afkg-YYLcyyWGzlI-WZITN0pHoO4ILFGtO447StT_5_RqqwuGA==
23.1c26597e.chunk.js
js.driftt.com/core/assets/js/ Frame 7838
90 KB
25 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/23.1c26597e.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
af5b0b20321a33d0b6e139babf5aa8c775dff093cb035f24c1caeae16a9cf784
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=e7a005c0-2cae-4354-b345-e4fe906b8797&sessionStarted=1676653702.711&campaignRefreshToken=ac094bfe-c1be-49b3-a458-39253f14eb76&hideController=false&pageLoadStartTime=1676653697934&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Thu, 16 Feb 2023 00:06:27 GMT
x-amz-version-id
Jgyjp1qJtdFKSj8y4xwuXMW.KS3jNgyD
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
147716
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
24
last-modified
Wed, 15 Feb 2023 23:10:27 GMT
server
istio-envoy
etag
W/"c413e017bebe8cadf301a83ef747eb00"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
_QqesCjeVuDD6MDup2B-aWTMPBUqKTpDavDMD_VKeVS7NpqSH-xHwA==
runtime~main.f28524d3.js
js.driftt.com/core/assets/js/ Frame 937B
6 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
dd8c7f7aae00c226824b8caad79b25703a1b017f6034e11ac53a4fa3dd564b1d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Thu, 16 Feb 2023 17:14:52 GMT
x-amz-version-id
kd17yzt.94F43DDJ5FwwRFZj9O5Kj1p6
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
86011
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
16
last-modified
Thu, 16 Feb 2023 17:02:31 GMT
server
istio-envoy
etag
W/"33b3081afd797e9b0eaa1bd3a7ffadd3"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
iiSPoGuUIttqTmN52ZqIsv4QJqnPB_8LNDA4_Mo44DLebTbbmuuKxQ==
9.4a3e9801.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
35 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/9.4a3e9801.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
2a8a441d8086f20a64563edc759aba1de84d932e34ff77b8bb0279a730cdb428
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:56 GMT
x-amz-version-id
hzm2Healt7ZjvNDM3nYQ47BRwWjFuLrw
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813407
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
16
last-modified
Fri, 27 Jan 2023 17:00:22 GMT
server
istio-envoy
etag
W/"c6f58dd3d60f07462254b842dd4f9ca1"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
IX9W1_E6AKrdnzUnOWeMHDl2ZHg64Enn_GW9srGVP4C0jC8_mdXLdg==
main~493df0b3.6a8a7bc7.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
7 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/main~493df0b3.6a8a7bc7.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
5ccd2287af72e2d56e11ebfcdb02dede2b9e39277e121ca53cbfbcc9cb529d3e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Wed, 15 Feb 2023 15:25:25 GMT
x-amz-version-id
pqJrRdr9rCUt5d48MN3IAyIbN5cCPBJp
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
178978
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
17
last-modified
Wed, 15 Feb 2023 15:10:14 GMT
server
istio-envoy
etag
W/"f0643a140ae55663635d2a3849d7a9ab"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
iq4uSFUfxrOuWQ4ln3IH6nTgg97AUaMaODtqaMhBuP9QWg0Po3jSpg==
52.b1edaf4a.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
23 KB
8 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/52.b1edaf4a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
7cb58278c8f54a62c0afa6da0c67b3a45aad637a0bf614e9c0dd42b73cee266b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:56 GMT
x-amz-version-id
TtzAkuiFg5ajpar.KJembGW97mIyyYtK
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813407
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
16
last-modified
Fri, 27 Jan 2023 17:00:21 GMT
server
istio-envoy
etag
W/"cd29b9bc973e48a7fcd0ee7153bdf03b"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
bXh8hyrsSuxsQshkLmHLHoQup2TglrBYdJhILkiR0P_lLX7dw7TvgQ==
36.b49bf23f.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
36 KB
10 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/36.b49bf23f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
c2b7a45d31339f18ed57fd095feca4da1b3fbab75a5afbc053957f6e8e1613a2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:56 GMT
x-amz-version-id
SWSsVLzyOcOhQhmvR.pbvKyQeo7W0A10
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813406
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
20
last-modified
Fri, 27 Jan 2023 17:00:21 GMT
server
istio-envoy
etag
W/"4ae92c53ef226eb2a201fc855ccb7835"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
CZaetK4uVam9IufuP2ztvCQdnS1jgVOgpeU88HvCK1DYOxijf2xvDQ==
25.22647a55.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
32 KB
11 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/25.22647a55.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
ec547a2f9fde5ce8e398da2810828ba3c30c641ce2761f5bf915225efb35f919
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:56 GMT
x-amz-version-id
3Dq5XEj76miHFBtzwx_L1gh4_UbdDQYk
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813406
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
16
last-modified
Fri, 27 Jan 2023 17:00:20 GMT
server
istio-envoy
etag
W/"2ce6c446f71a395ff41647c9ba4b9c19"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
hunaSfB43l-hyyUn0JBcS0TVpaCBGwnDzUOrM1mWmITtg-3tF9c9UQ==
20.2ffef383.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
17 KB
6 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/20.2ffef383.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
f46108976666130f89c43a82ee045f7a3afb264494060ef6b3d9eb6589e49d16
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:57 GMT
x-amz-version-id
Sl_LzJMe7m6MkWEK9Fxqk3gRf.6SeAYu
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813406
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
26
last-modified
Fri, 27 Jan 2023 17:00:20 GMT
server
istio-envoy
etag
W/"ec6e94b6cea3a27506634867a8009ded"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
B4SWfKzUNiCCNx3wMrQtH0V47pz5YoySBHrkJQ9AVrQva9Aqd509Uw==
42.67956b13.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
25 KB
8 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/42.67956b13.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
9d88866c6295ffc0cadaa1ccb951367e196737a413482176d5787b70aae04ef0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Wed, 15 Feb 2023 15:25:25 GMT
x-amz-version-id
LwoHxJH_FBDxYvxZo.xGVaPPrUBqnUk_
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
178977
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
20
last-modified
Wed, 15 Feb 2023 15:10:12 GMT
server
istio-envoy
etag
W/"d53cdfd4559700cfe085380882a8e897"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
r1RulWE0PUMzRL584bsnd3plOih0bVA0sHLMyTFH_yZcnIkvyKN81w==
21.b3438b1b.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
74 KB
23 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/21.b3438b1b.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
3169ab3142fbf3ecf7eee1b5682a4556ed8a3d4ba940befa71c31b5a43991d92
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Wed, 15 Feb 2023 15:25:25 GMT
x-amz-version-id
VElN.rYQUfZc8FwuS3oQUAN0Q9xeEifo
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
178977
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
15
last-modified
Wed, 15 Feb 2023 15:10:12 GMT
server
istio-envoy
etag
W/"10e1bfa61646f14df045c581bc9410fd"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
K5SRF8hx-ePG3QmJ0AcaqtkloSjOIJYzPt2ZTfgiwrBtkjvgtPWZtw==
27.f44ab9c1.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
59 KB
19 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/27.f44ab9c1.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
a04ca4a38cfded547daa7993112f5dcc2fbdf13f93b968d676e1313e8d8e98f6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:56 GMT
x-amz-version-id
wrgwLo8Ut7GsYvCwhzW617Km3EuBTw6K
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813406
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
24
last-modified
Fri, 27 Jan 2023 17:00:21 GMT
server
istio-envoy
etag
W/"768714622a8a2db20ece85777ba47642"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
XcMjY6TZIBIspdJxi-VZtO2kvt3KqNXH6bm5bLsjGdMGeEiwkEC-2w==
15.699b0dc7.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
91 KB
28 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/15.699b0dc7.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
047d14c117d25e9e0a1a2ba3f4aa23a602d417fc7402294e484d20b19140ecf1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:56 GMT
x-amz-version-id
jUF4GGgcG34JdLv0MHXRHyWvmwH3OQeO
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813406
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
17
last-modified
Fri, 27 Jan 2023 17:00:20 GMT
server
istio-envoy
etag
W/"43d1442a9d30453da9eaeb12b9daafff"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
emqLhfs1YnwrFHhN-MqXILITPL4qxfMrfXRlTBOLoOE2bl8S-pUIuA==
12.d33926cb.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
23 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/12.d33926cb.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
28816769ece0ee343025ff388216c645e175c92cce4db6bd812a321b1ad345c6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:57 GMT
x-amz-version-id
KyS4g55V4uBz7fjaZ0R1pHyOHsEBkZV6
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813406
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
27
last-modified
Fri, 27 Jan 2023 17:00:20 GMT
server
istio-envoy
etag
W/"bdcb035523ec144399213aa65a8430ff"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
exqZrbH8yGMP6bKypXKhdZexrz4zKr_WAuZ4jQ3jKyNYQ76E40w9pQ==
19.8e79a39a.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
62 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/19.8e79a39a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
b7c5d1d3e03d31b9b450c0aac2972f3aef995be2a69ec5ecfa6200c4a321ef40
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Mon, 13 Feb 2023 04:02:34 GMT
x-amz-version-id
bwRea7wDCbR4ncTw_WLwO3izZD3MoPy9
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
392749
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
42
last-modified
Fri, 10 Feb 2023 18:18:27 GMT
server
istio-envoy
etag
W/"c478a5bb4d7885e2b9250c6beeb4fd6d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Y62-Zz5Uhg011R184-6-FPxK_p3AZ5VD7FBuUYBalMtjoU7A4Gp6Ag==
50.de3b5864.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
105 KB
34 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/50.de3b5864.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
c8c302716cf94980a0d77e614d9fb6c430f166b5ef7c42b7c382771955e52ba6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:56 GMT
x-amz-version-id
1DnDsXjV5U2x4yjXf3GCnDIDPlyIffBu
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813407
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
19
last-modified
Fri, 27 Jan 2023 17:00:21 GMT
server
istio-envoy
etag
W/"114785899ceb423273fcc17aaad202e9"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
0PT59u96UVhG_p9EMORFkGMJWnYMeq_jkB8Ln1gZYbmJDfmQZUhQmQ==
41.a1867ad4.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
12 KB
4 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/41.a1867ad4.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
d641c13a78017e11f15b152b78082bcd0cf474766f13ba649bfa6378d956c492
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:56 GMT
x-amz-version-id
X151O2if9SUzZhsBRIHlOqKUakbFDRo_
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813407
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
17
last-modified
Fri, 27 Jan 2023 17:00:21 GMT
server
istio-envoy
etag
W/"299dd262bf32831c99dc78a9c5b5ca43"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
jBkAuHQB0dlVVomnBWtvDw5kBfxzAdriY8q28LmrPVXxWirXhEUweg==
30.57dfb56c.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
13 KB
6 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/30.57dfb56c.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
c96b2cd5b57e02ce65ab0a787a6c8ea69efbf424064e15500691847cd879e8ca
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:56 GMT
x-amz-version-id
PRu.RNHym52TA_hlIcQB1Vv5VUA1vVKS
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813407
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
17
last-modified
Fri, 27 Jan 2023 17:00:21 GMT
server
istio-envoy
etag
W/"b8addee34a5cd2241740a2e3094039b3"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
0rZXt30IzibWGB7uav-MN-JILCEs0OoDW527zMeoyg6zVHrcHRHDuA==
22.4cb40074.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
17 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/22.4cb40074.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
cdeb836f7f77cd2174fa0bb4aa3825963aa64faf657a24f988b82f1c4d28ce69
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Wed, 15 Feb 2023 15:25:26 GMT
x-amz-version-id
ykeUDE2sWwwza8uCQZo8fLwm_hGj240R
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
178977
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
39
last-modified
Wed, 15 Feb 2023 15:10:12 GMT
server
istio-envoy
etag
W/"6cf24f8ea74f43662c776ce6af09d469"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
C7ets-bsOoK8EFM-QtgdNm90ZxR-BQwCahZGVAk6AXnluOpDSbw0ow==
10.18bfca70.chunk.css
js.driftt.com/core/assets/css/ Frame 937B
14 KB
3 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/10.18bfca70.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
8ab6891019c69c729441517bed2c703ec68058f913e9fe0d9840617f89473421
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:57 GMT
x-amz-version-id
W.Ed7skdAN0dSG59eVgsVvIsNBx.BMsL
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813406
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
20
last-modified
Fri, 27 Jan 2023 17:00:18 GMT
server
istio-envoy
etag
W/"dd670379de64b0621ee84574f3b8e73d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
gnQjrjNt2GnSj0t3e39lH9fB2YLYoa8k9wA4RMPF-WCWvlrmh5Nxjw==
10.b76eb677.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
79 KB
25 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/10.b76eb677.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
c878baf3b2bee3185daa3b0812e979a96e077fdf924b536f6c3e7e373882aa1e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Wed, 15 Feb 2023 18:44:11 GMT
x-amz-version-id
Fcq2O7wHOQRvkyxIvw6HFTAA4EV_e5Q7
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
167052
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
36
last-modified
Wed, 15 Feb 2023 18:18:24 GMT
server
istio-envoy
etag
W/"cbc9a75b208589ec9edc4611d5aaf6ae"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
spo5L-lhw_4fVpgigZtarbbyfKXvvt7qBR1VHQCgcCEqop1Ply-G5A==
17.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame 937B
24 B
696 B
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/17.22abfce0.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Thu, 26 Jan 2023 20:13:51 GMT
x-amz-version-id
eR0JFDWwyA3gsnd_XajqmmtDUbC85CBL
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
FRA56-P5
age
1889672
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
22
content-length
24
last-modified
Tue, 11 Oct 2022 19:09:27 GMT
server
istio-envoy
etag
"0c5dad92482d9a7c7c253510f5082465"
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
WSpFc5CW1UGaPLherpi8Ye1Q6fa3VRlPexU9a5y1XE2ZGOhSwWOSAA==
17.2d19c66a.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
89 KB
23 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/17.2d19c66a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
a4ea37f8af67e84a4d330d3ccfb44eab01c877d0c4100c48c67ea57f1663552c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Wed, 15 Feb 2023 18:44:11 GMT
x-amz-version-id
ik3ByTJPnYyhtI0DOm2S_2nEjNOtG0Ct
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
167052
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
19
last-modified
Wed, 15 Feb 2023 18:18:25 GMT
server
istio-envoy
etag
W/"4de3ff81b975e5a8a5f39e782840df52"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
AOR8raHrs9WpwfXG1GxA1u_deBCcNw1wCLw5A6R6vPgPg_8HziOAZw==
26.804680a6.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
50 KB
14 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/26.804680a6.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
672e9b04f273c7bc6b2b23413d590fa1ac1aec88429f4d73998a7cbfbae5bbe5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Thu, 16 Feb 2023 17:14:52 GMT
x-amz-version-id
pfpspt3Jz6W..QQ5vkwVPcMWjcOyyF7H
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
86011
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
16
last-modified
Thu, 16 Feb 2023 17:02:28 GMT
server
istio-envoy
etag
W/"4150cb239859b4872dfc55d0064ba661"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
LsvG-_CyxLyk6bImBMqUbI4STUMsMkMfzXqb0aDFVfLHuwp9WIFcfQ==
18.34dac473.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
40 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/18.34dac473.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
5d959e050c61344f264ee87cf81e9ffd30cb5ad5b5ae749218e9360a6403c1e4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Thu, 16 Feb 2023 17:14:52 GMT
x-amz-version-id
lv3aFKpN07qrROaTanaC4C4GvuUpSYk3
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
86011
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
19
last-modified
Thu, 16 Feb 2023 17:02:28 GMT
server
istio-envoy
etag
W/"084fc6a6981258c55945f0f6ddf4a771"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
BXjFXt3xHNQBRjTWcymVSi3OPODoKAL5_QX3_jO431r2Iz9xCcvEZw==
38.11d2b6a7.chunk.css
js.driftt.com/core/assets/css/ Frame 937B
3 KB
1 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/38.11d2b6a7.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:57 GMT
x-amz-version-id
hzHYKpyiaZmITNnBC_LqpsxusmNF7FFl
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813406
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
15
last-modified
Fri, 27 Jan 2023 17:00:18 GMT
server
istio-envoy
etag
W/"87532c4db85f1429fa6d759bc3332f36"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
V5eeOXbSdDc9ljEe42ZDjBLadPrmW8QvHr6RBVuWvF68Aegr7rbqtQ==
38.627f88e6.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
3 KB
2 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/38.627f88e6.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
43580e037fc59487c315cc0a33e1167f17c8430dd41aa375e21f4d6d325e8f28
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:57 GMT
x-amz-version-id
VrL4qVVdcSDrKVxDzMDZ1ibCwb1LgkQ.
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813406
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
18
last-modified
Fri, 27 Jan 2023 17:00:21 GMT
server
istio-envoy
etag
W/"d03d4e13d59e06f8ec44e39d9d85fa54"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
0nZaoxn3LdGZQ2dPDcI-X_a97BC3PHNgho82yI7M7qZizn5ujCUCBQ==
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=eb791c6e-994e-4338-81dc-ddd80513d57f&session=0424f783-1e2a-4b57-80ce-9445c286747e&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2017%20Feb%202023%2017%3A08%3A23%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2017%20Feb%202023%2017%3A08%3A22%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%224060%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Menlo%20Labs%20research%20team%20analyzes%20Qakbot%2C%20one%20of%20the%20leading%20banking%20Trojans%20around%20the%20globe.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&pageViewId=19059956-05bc-4023-82ac-7a6627b2ab99&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.96.140.70 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-96-140-70.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:23 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
0.0b2ebd4a.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
9 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Sat, 28 Jan 2023 03:20:43 GMT
x-amz-version-id
bxbBo6tiShmSVkJPl3yRp.s0jVilttxU
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1777660
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
29
last-modified
Fri, 27 Jan 2023 17:00:19 GMT
server
istio-envoy
etag
W/"c5efcdc9e465604f32cf24af10fd6c13"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
v4hpL3PNRraj01elq2kU59tMxPqQiCraGk9xFmUTCSc_wnv7UODrhg==
3.07aa08a5.chunk.css
js.driftt.com/core/assets/css/ Frame 937B
7 KB
2 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/3.07aa08a5.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 10 Feb 2023 05:12:45 GMT
x-amz-version-id
gVdN1RDJQn3fgJjMXCjyl2aSPTHaRcFJ
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
647738
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
75
last-modified
Wed, 08 Feb 2023 18:35:23 GMT
server
istio-envoy
etag
W/"189aeffd571884559dababa22c66d75a"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
HSjU7TdFWIqS9Q2s0QUHbklkjl13DHolqs7Rhmfh9CEiwhQAVzrATQ==
3.f50b964b.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
54 KB
15 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/3.f50b964b.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
d14e287ddae470b06c4639e73260ca21a4c9b7cfdf56e02965a8f50fb5333b42
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Sun, 15 Jan 2023 02:22:28 GMT
x-amz-version-id
XjyDJs7tJQ_66vN6EdQbFkXQ4j4BABRH
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
2904355
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
37
last-modified
Wed, 11 Jan 2023 18:48:21 GMT
server
istio-envoy
etag
W/"1ac37bf2b93050f29058b66a9ad43e10"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
4ByvrEm7hrq7c8VUrNKgGIETW37IkBHdHnuxlFMziGyUMzgncrkFRQ==
1.5b69d480.chunk.css
js.driftt.com/core/assets/css/ Frame 937B
44 KB
7 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/1.5b69d480.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
504ff3efe64294cb4fd8b982dadb288136e511a05d4b068356c371dc6057865f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Thu, 02 Feb 2023 15:28:31 GMT
x-amz-version-id
yFEFrbt3Vox_ceR8jg0L9VJqKO7sanHh
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1301992
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
47
last-modified
Thu, 02 Feb 2023 14:58:15 GMT
server
istio-envoy
etag
W/"3237f71ac06bcb0447f60fe4b1d5948e"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
p9S1POhyNtfcO5F_iWlY3b16kJynaizISeqnV7LBXy21_q8QxZdtNg==
1.24f0fded.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
54 KB
18 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/1.24f0fded.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
6556ae8681d92a9f36b8ad0cc99324bf66f58a72de301e3e8d3111f2763da457
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Wed, 15 Feb 2023 18:44:12 GMT
x-amz-version-id
PACtl77vzSIoWF597S6Kspns69JeHoaG
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
167051
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
17
last-modified
Wed, 15 Feb 2023 18:18:24 GMT
server
istio-envoy
etag
W/"6e339cc2be7ba9014460db695dae5832"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
FERl5l310EZskN68bcFY_ERMo_DBd01rei0k2RdIhy1c976jiccSpw==
4.ed93461c.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
23 KB
10 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/4.ed93461c.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
07aa00aa3aa0d7f661d70680b81bb38d1af1160d7b8d391b1812a51070620535
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Wed, 15 Feb 2023 18:44:12 GMT
x-amz-version-id
yVPbckZMywHJCh15VMsKBgjNpzoO6E7h
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
167051
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
19
last-modified
Wed, 15 Feb 2023 18:18:26 GMT
server
istio-envoy
etag
W/"9e6f90256eeae9f2d8530b147e4694e7"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
7LIweS6xR4zAojtT7ImBOsLJKv1xCa1cTO4Raiatj5Fg017YAN0nPw==
35.a3318c5e.chunk.css
js.driftt.com/core/assets/css/ Frame 937B
14 KB
3 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/35.a3318c5e.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
f3342c52eee43a2ea931cae2ee2d6d9a2939432ffcb03bb4f2983ac7e49b26cc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:57 GMT
x-amz-version-id
zduXhdkhoojuHNWfrJL3OG7UtCFvJe6h
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813406
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
15
last-modified
Fri, 27 Jan 2023 17:00:18 GMT
server
istio-envoy
etag
W/"b06e02b360914b25e58305b1b9b954dc"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
_p0hf8uQjKNrGWFnAFFU-ObcYoeAY_zqmiNSS-hWAU6EvTDKIoRnKw==
35.2db13da8.chunk.js
js.driftt.com/core/assets/js/ Frame 937B
12 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/35.2db13da8.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f28524d3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-55.fra56.r.cloudfront.net
Software
istio-envoy /
Resource Hash
7e05c4fabf6d02fa4c14937ca467cc7d4ebbb02f295e3cff6ba999e6369fc663
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1676653697934
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 27 Jan 2023 17:24:57 GMT
x-amz-version-id
cZsJMbphr0g_Rs503LmupKJPT7bBS_rp
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
1813406
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
19
last-modified
Fri, 27 Jan 2023 17:00:21 GMT
server
istio-envoy
etag
W/"b335cb429753b2c3dabe45686f46aee9"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
LfFG_L_ecPHZS5plLmlDbInk5QgRNXvl6GEhiI6mpgHH8UMzbgr9Pw==
ping
bootstrap.api.drift.com/widget_bootstrap/ Frame 7838
147 B
246 B
XHR
General
Full URL
https://bootstrap.api.drift.com/widget_bootstrap/ping
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/52.b1edaf4a.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-50-16-7-188.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
487d3252e04d702f033dd508688732af1b78b9a5a604a5699288b652ae9f9b5a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
application/json, text/plain, */*
Referer
https://js.driftt.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
Content-Type
application/json

Response headers

date
Fri, 17 Feb 2023 17:08:23 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
istio-envoy
requestid
98fea0314865852b
access-control-max-age
1209600
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
vary
Accept-Encoding
access-control-allow-credentials
true
x-envoy-upstream-service-time
11
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
147
ping
bootstrap.api.drift.com/widget_bootstrap/ Frame
0
0
Preflight
General
Full URL
https://bootstrap.api.drift.com/widget_bootstrap/ping
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-50-16-7-188.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://js.driftt.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin
*
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-max-age
1209600
allow
POST,OPTIONS
content-length
13
content-type
text/plain
date
Fri, 17 Feb 2023 17:08:23 GMT
requestid
drift9d9234942208a606c34e31e3190
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
1
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=eb791c6e-994e-4338-81dc-ddd80513d57f&session=0424f783-1e2a-4b57-80ce-9445c286747e&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2017%20Feb%202023%2017%3A08%3A24%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2017%20Feb%202023%2017%3A08%3A23%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%225062%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Menlo%20Labs%20research%20team%20analyzes%20Qakbot%2C%20one%20of%20the%20leading%20banking%20Trojans%20around%20the%20globe.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&pageViewId=19059956-05bc-4023-82ac-7a6627b2ab99&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.96.140.70 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-96-140-70.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:24 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
collect
region1.analytics.google.com/g/
0
45 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-C2G0PCSJKE&gtm=45je32f0&_p=1232861254&cid=2083676563.1676653699&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AAE&sid=1676653698&sct=1&seg=0&dl=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&dt=An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security&_s=2
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-C2G0PCSJKE&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 17 Feb 2023 17:08:24 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.menlosecurity.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
494 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=eb791c6e-994e-4338-81dc-ddd80513d57f&session=0424f783-1e2a-4b57-80ce-9445c286747e&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2017%20Feb%202023%2017%3A08%3A25%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2017%20Feb%202023%2017%3A08%3A24%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%226064%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Menlo%20Labs%20research%20team%20analyzes%20Qakbot%2C%20one%20of%20the%20leading%20banking%20Trojans%20around%20the%20globe.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&pageViewId=19059956-05bc-4023-82ac-7a6627b2ab99&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.96.140.70 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-96-140-70.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:25 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
bulk
metrics.api.drift.com/monitoring/metrics/event2/ Frame 7838
25 B
111 B
XHR
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/event2/bulk
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/52.b1edaf4a.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-50-16-7-188.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
application/json, text/plain, */*
Referer
https://js.driftt.com/
accept-language
de-DE,de;q=0.9
Authorization
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
Content-Type
application/json

Response headers

date
Fri, 17 Feb 2023 17:08:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
istio-envoy
requestid
10a1c235969d40c1
access-control-max-age
1209600
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
vary
Accept-Encoding
access-control-allow-credentials
true
x-envoy-upstream-service-time
24
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
25
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=eb791c6e-994e-4338-81dc-ddd80513d57f&session=0424f783-1e2a-4b57-80ce-9445c286747e&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2017%20Feb%202023%2017%3A08%3A26%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2017%20Feb%202023%2017%3A08%3A25%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%227065%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Menlo%20Labs%20research%20team%20analyzes%20Qakbot%2C%20one%20of%20the%20leading%20banking%20Trojans%20around%20the%20globe.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&pageViewId=19059956-05bc-4023-82ac-7a6627b2ab99&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.96.140.70 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-96-140-70.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:26 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
bulk
metrics.api.drift.com/monitoring/metrics/event2/ Frame
0
0
Preflight
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/event2/bulk
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-50-16-7-188.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,content-type
Access-Control-Request-Method
POST
Origin
https://js.driftt.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin
*
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-max-age
1209600
allow
POST,OPTIONS
content-length
13
content-type
text/plain
date
Fri, 17 Feb 2023 17:08:25 GMT
requestid
drift834586d490982362a35b4645d6a
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
0
img.gif
b.6sc.co/v1/beacon/
43 B
494 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=eb791c6e-994e-4338-81dc-ddd80513d57f&session=0424f783-1e2a-4b57-80ce-9445c286747e&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2017%20Feb%202023%2017%3A08%3A27%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2017%20Feb%202023%2017%3A08%3A26%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%228066%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Menlo%20Labs%20research%20team%20analyzes%20Qakbot%2C%20one%20of%20the%20leading%20banking%20Trojans%20around%20the%20globe.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&pageViewId=19059956-05bc-4023-82ac-7a6627b2ab99&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.96.140.70 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-96-140-70.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:27 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
494 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=eb791c6e-994e-4338-81dc-ddd80513d57f&session=0424f783-1e2a-4b57-80ce-9445c286747e&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2017%20Feb%202023%2017%3A08%3A28%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2017%20Feb%202023%2017%3A08%3A27%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%229067%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Menlo%20Labs%20research%20team%20analyzes%20Qakbot%2C%20one%20of%20the%20leading%20banking%20Trojans%20around%20the%20globe.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&pageViewId=19059956-05bc-4023-82ac-7a6627b2ab99&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.96.140.70 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-96-140-70.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:28 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
bulk
metrics.api.drift.com/monitoring/metrics/add/ Frame 7838
25 B
84 B
XHR
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/add/bulk
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/52.b1edaf4a.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-50-16-7-188.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
application/json, text/plain, */*
Referer
https://js.driftt.com/
accept-language
de-DE,de;q=0.9
Authorization
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
Content-Type
application/json

Response headers

date
Fri, 17 Feb 2023 17:08:28 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
istio-envoy
requestid
922a7879762661f6
access-control-max-age
1209600
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
vary
Accept-Encoding
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
25
bulk
metrics.api.drift.com/monitoring/metrics/add/ Frame
0
0
Preflight
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/add/bulk
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-50-16-7-188.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,content-type
Access-Control-Request-Method
POST
Origin
https://js.driftt.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin
*
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-max-age
1209600
allow
POST,OPTIONS
content-length
13
content-type
text/plain
date
Fri, 17 Feb 2023 17:08:28 GMT
requestid
driftcab89c64c3a8001dd014d418a3d
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
0
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=eb791c6e-994e-4338-81dc-ddd80513d57f&session=0424f783-1e2a-4b57-80ce-9445c286747e&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2017%20Feb%202023%2017%3A08%3A29%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2017%20Feb%202023%2017%3A08%3A28%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%2210071%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Menlo%20Labs%20research%20team%20analyzes%20Qakbot%2C%20one%20of%20the%20leading%20banking%20Trojans%20around%20the%20globe.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&pageViewId=19059956-05bc-4023-82ac-7a6627b2ab99&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.96.140.70 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-96-140-70.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:29 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"5e502810-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=eb791c6e-994e-4338-81dc-ddd80513d57f&session=0424f783-1e2a-4b57-80ce-9445c286747e&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2017%20Feb%202023%2017%3A08%3A32%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2017%20Feb%202023%2017%3A08%3A29%20GMT%22%2C%22timeSpent%22%3A%223001%22%2C%22totalTimeSpent%22%3A%2213072%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Menlo%20Labs%20research%20team%20analyzes%20Qakbot%2C%20one%20of%20the%20leading%20banking%20Trojans%20around%20the%20globe.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&pageViewId=19059956-05bc-4023-82ac-7a6627b2ab99&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.96.140.70 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-96-140-70.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Fri, 17 Feb 2023 17:08:32 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
analytics.twitter.com
URL
https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=33601cbf-e290-4efe-864b-b75e0dc9bc06&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=19359b7f-f927-4954-b766-642b89c63a4e&tw_document_href=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nx5nr&type=javascript&version=2.3.29

Verdicts & Comments Add Verdict or Comment

109 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 boolean| credentialless object| oncontentvisibilityautostatechange object| OneTrustStub function| OptanonWrapper object| dataLayer function| _ undefined| $ function| jQuery string| OnetrustActiveGroups string| OptanonActiveGroups object| otStubData object| Optanon object| OneTrust function| postscribe object| google_tag_manager_external object| google_tag_manager object| google_tag_data function| twq function| hj object| _hjSettings object| GooglebQhCsO string| _linkedin_data_partner_id function| fbq function| _fbq function| hushly object| __hly_widget_object object| HushlyEmbed object| __hly_embed_object function| saq function| _saq function| drift undefined| driftt object| techtargetic object| google_noFurtherRedirects function| onYouTubeIframeAPIReady object| gaGlobal object| MktoForms2 object| regeneratorRuntime object| twttr object| hjSiteSettings function| hjBootstrap object| hjBootstrapCalled object| hjLazyModules function| lintrk boolean| _already_called_lintrk object| addComment function| processEpsilonData string| epsilonName boolean| enabled function| callback number| version object| _6si object| ziws object| $jscomp object| fcdsc function| fcdscLoad function| ES6Promise object| Vimeo function| __vimeoRefresh function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin string| widgetSource boolean| _storagePopulated object| 3eiXJRXgVuLsYGH9303q object| _driftFrames object| __post_robot_10_0_16__ string| __DRIFT_ENV__ string| __DRIFT_BUILD_ID__ string| __DRIFT_BRANCH__ boolean| drift_invoked object| MunchkinTracker function| webpackHotUpdateHushlyEmbed object| core object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate boolean| _babelPolyfill function| hushlyForm string| res object| saCookies string| current_window_url_param string| GoogleAnalyticsObject function| ga object| gaplugins object| gaData function| addCaptchaScript object| jQuery1124021530511634445948 object| jQuery1124049423595761625716 function| hushlyCountriesCallback function| hushlyWidgetsCallback function| hushlyVisitorCallback function| hushlyFormSubmitCallback boolean| hushlyIsReady object| drift_event_listeners string| drift_display_mode string| drift_campaign_refresh number| drift_page_view_started number| drift_session_started string| drift_session_id

45 Cookies

Domain/Path Name / Value
.menlosecurity.com/ Name: _gcl_au
Value: 1.1.1423674974.1676653699
.info.menlosecurity.com/ Name: __cf_bm
Value: W90V37DkCMWriPmlqeuRHBCQr3B1oRSQolPICKpPJIU-1676653698-0-ARi2B8MATylkszkIpCCdVhULFPqpO0ogSONgimqjK8z50fylaWrnwmZgvvUSV9NisvyAuJl6ggKj9EzAhck0v44=
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
.techtarget.com/ Name: __cf_bm
Value: 1fEZcLMSDKh0PEdOMw9Xj0juUjnfsoDLcAWkaZ3ok6c-1676653698-0-AQWyOoeFc2hpATp7GmvSGJdS45y4zSKvQWBOqIXstKuYnLBfOkBEBcQO1I9K68JQ6Q2kMTOqLdDP80Izw+AU6KU=
.ws.zoominfo.com/ Name: visitorId
Value: dc38a28f5e8aa2b125ce392613453a7ae456226d17ba1c60e71cf1f6734a6adf
.zoominfo.com/ Name: __cf_bm
Value: vv5iQEhR6dsZ7ID4JrOPcMJ6DS3FNmwGyOjkvKjWmnM-1676653698-0-AcL1vcV14TzT96UQdHe1KqdAk30Zvnxes3SOXSACy+L20ciOaipDtAtBRC+Jc1P1bHRTjLvf0eoylV22cMhsAkA=
.zoominfo.com/ Name: _cfuvid
Value: wal1aqm_LPV0SrD8hF0yD.oLH3o49B7yCEp6rmxU2h4-1676653698795-0-604800000
.menlosecurity.com/ Name: OptanonConsent
Value: isGpcEnabled=0&datestamp=Fri+Feb+17+2023+17%3A08%3A18+GMT%2B0000+(GMT)&version=202301.1.0&isIABGlobal=false&hosts=&consentId=138be18d-1e55-43de-ae3d-da7de385c439&interactionCount=0&landingPath=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-nov2022%26utm_medium%3Demail%26utm_source%3Doutboundemail&groups=C0003%3A0%2CC0002%3A0%2CC0004%3A0%2CC0001%3A1
www.menlosecurity.com/ Name: ln_or
Value: eyI0NzQwNTgiOiJkIn0%3D
.menlosecurity.com/ Name: _fcdscst
Value: MTY3NjY1MzY5ODkyOA==
.menlosecurity.com/ Name: _fbp
Value: fb.1.1676653698973.1233934603
.t.co/ Name: muc_ads
Value: e22f891a-2b40-41f7-b2b6-3227436e50a0
.menlosecurity.com/ Name: _hjSessionUser_1854968
Value: eyJpZCI6IjFjNzMwN2E1LWY1M2EtNTAwOC1iNjMwLTBkMjE3OTE5Mzk3MSIsImNyZWF0ZWQiOjE2NzY2NTM2OTkwODMsImV4aXN0aW5nIjpmYWxzZX0=
.menlosecurity.com/ Name: _hjFirstSeen
Value: 1
.menlosecurity.com/ Name: _hjIncludedInSessionSample_1854968
Value: 0
.menlosecurity.com/ Name: _hjSession_1854968
Value: eyJpZCI6IjMzYTliOGU4LWRhNjAtNDJjMS04MDdiLWQzYjFlYjg3MWVlYiIsImNyZWF0ZWQiOjE2NzY2NTM2OTkwOTksImluU2FtcGxlIjpmYWxzZX0=
www.menlosecurity.com/ Name: _hjIncludedInPageviewSample
Value: 1
.menlosecurity.com/ Name: _hjAbsoluteSessionInProgress
Value: 0
.linkedin.com/ Name: UserMatchHistory
Value: AQLvugr1irl-OAAAAYZgWR_iCbYiLuAbLBbsPlShgKbYFyfsjWKuQD5IDJlBqyCh_Ne7PUbekl5BsQ
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQKbLcn4fTHNxQAAAYZgWR_iMGa3bWG-oQ77SRj57Bc05bTCi4ecBcYqvyChMryYmKbtYeeHuU2P7pcLYsp98g
.linkedin.com/ Name: bcookie
Value: "v=2&68d65d64-fb7c-4cd7-8168-36e6bdd11e36"
.linkedin.com/ Name: lidc
Value: "b=VGST04:s=V:r=V:a=V:p=V:g=2837:u=1:x=1:i=1676653699:t=1676740099:v=2:sig=AQH6H8mm2zNIK8-WD98uwLU4v75x0oa6"
tags.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-6c0595c9-a2f9-40c3-5f72-8ca0989b2e93.gVY8Mbss0DNjtDXBWfiErTZ1vIVYSwlvQfkm1hpdzcc
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3AbAWVyaL5QMNfcoygmJsuk9ly2hc.o0KzfqoHUTZMzTEQNSJ4DUQJ968r4MvarViwtCu3T4Q
www.menlosecurity.com/ Name: sa-user-id
Value: s%253A0-6c0595c9-a2f9-40c3-5f72-8ca0989b2e93.gVY8Mbss0DNjtDXBWfiErTZ1vIVYSwlvQfkm1hpdzcc
www.menlosecurity.com/ Name: sa-user-id-v2
Value: s%253AbAWVyaL5QMNfcoygmJsuk9ly2hc.o0KzfqoHUTZMzTEQNSJ4DUQJ968r4MvarViwtCu3T4Q
www.menlosecurity.com/ Name: _an_uid
Value: 0
www.menlosecurity.com/ Name: _gd_visitor
Value: eb791c6e-994e-4338-81dc-ddd80513d57f
www.menlosecurity.com/ Name: _gd_session
Value: 0424f783-1e2a-4b57-80ce-9445c286747e
.www.linkedin.com/ Name: bscookie
Value: "v=1&2023021717081933a3075a-6d68-4c13-824c-b1cd09bb6032AQEJpplS3xrU7_tmkrRULxfX58DPTXkx"
.linkedin.com/ Name: li_gc
Value: MTswOzE2NzY2NTM2OTk7MjswMjERzQFEz0H+GvZYAxCOHrupfbUqZFg/DwRpuPQgysKR6g==
app.hushly.com/ Name: JSESSIONID
Value: 68BA9B1096CF30DE52ED3D9834269CB7
.hushly.com/ Name: _hly_gvid
Value: 2a8c2d45-b285-43dc-97ee-8867a294a9c7
.menlosecurity.com/ Name: _mkto_trk
Value: id:281-OWV-899&token:_mch-menlosecurity.com-1676653699309-31151
.menlosecurity.com/ Name: _ga_C2G0PCSJKE
Value: GS1.1.1676653698.1.0.1676653699.59.0.0
.6sc.co/ Name: 6suuid
Value: 645b60683a5c000083b4ef638d02000000872b00
.menlosecurity.com/ Name: _fcdscv
Value: eyJDdXN0b21lcklkIjoiMTg3ZDIxMDMtYmRjNS00ZTNmLWIwNzAtYjVjNmE0MDAwODQwIiwiVmlzaXRvciI6eyJFbWFpbCI6bnVsbCwiRXh0ZXJuYWxWaXNpdG9ySWQiOiIwMzU4NDdkYy0yMjg3LTQ2MDMtYTg2MC0wOTRmMzRhMTQ2MTEifSwiVmlzaXRzIjpbXSwiQWN0aXZpdGllcyI6W10sIkRpYWdub3N0aWNNZXNzYWdlIjpudWxsfQ==
.menlosecurity.com/ Name: _ga
Value: GA1.2.2083676563.1676653699
.menlosecurity.com/ Name: _gid
Value: GA1.2.663799756.1676653700
.menlosecurity.com/ Name: _gat_UA-41161362-2
Value: 1
info.menlosecurity.com/ Name: BIGipServersj21web-nginx-app_https
Value: !4sO5kHm71hiSlg/MZROflEEG2tCikgC6Wm4/q8cRwI/GZdvw2+k4Ladn+i3g/cYYkKPogG9+wUOf1hk=
.menlosecurity.com/ Name: _hly_vid
Value: 7e657c18-54de-4bce-9b55-a0a1f93ea609
www.menlosecurity.com/ Name: _hly_sid
Value: ba6eb79a-6454-406b-9a50-250030611d35
www.menlosecurity.com/ Name: drift_campaign_refresh
Value: ac094bfe-c1be-49b3-a458-39253f14eb76
app.hushly.com/ Name: AWSALBCORS
Value: Nk3GOMnk51/eWYmZHta4tMNx1SmHPJpOF00DZh/plZjMXNPOf18ktfdEeeKYGQWjE7POhF2N7Zi30OXHhieBpIUZK1/lRi0C6Lnu4/TuPNUHY1NkoIGWm/oOLeuK

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

281-owv-899.mktoresp.com
analytics.twitter.com
app.hushly.com
b.6sc.co
bootstrap.api.drift.com
c.6sc.co
cdn.cookielaw.org
cdn.linkedin.oribi.io
cdnjs.cloudflare.com
connect.facebook.net
d2i34c80a0ftze.cloudfront.net
epsilon.6sense.com
extend.vimeocdn.com
fonts.googleapis.com
fonts.gstatic.com
geolocation.onetrust.com
googleads.g.doubleclick.net
hubfront.hushly.com
ibc-flow.techtarget.com
in.hotjar.com
info.menlosecurity.com
ipv6.6sc.co
j.6sc.co
js.driftt.com
metrics.api.drift.com
munchkin.marketo.net
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
script.hotjar.com
secure.adnxs.com
snap.licdn.com
st.fullcircleinsights.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
t.co
tags.srv.stackadapt.com
trk.techtarget.com
vars.hotjar.com
ws.zoominfo.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
www.menlosecurity.com
analytics.twitter.com
104.17.72.206
104.244.42.69
104.87.143.22
104.96.140.70
13.107.43.14
141.193.213.20
18.66.112.55
18.66.147.113
18.66.97.10
18.66.97.101
192.28.147.68
199.232.16.157
199.232.18.109
2001:4860:4802:34::36
2600:9000:2251:ba00:2:53b2:240:93a1
2600:9000:2304:ac00:13:a3bc:6800:93a1
2600:9000:2490:b000:9:14eb:6280:93a1
2606:4700:4400::6812:2b9e
2606:4700::6810:a852
2606:4700::6811:190e
2606:4700::6812:d9f
2606:4700::6813:bc61
2620:1ec:21::14
2a00:1450:4001:808::200a
2a00:1450:4001:80f::2002
2a00:1450:4001:831::2004
2a00:1450:400c:c00::9b
2a00:1450:400d:806::2003
2a00:1450:400d:806::2008
2a00:1450:400d:806::200e
2a02:26f0:11a::217:9a4a
2a02:26f0:f700:4bf::1c91
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
34.111.208.231
34.202.126.200
35.156.53.215
37.252.171.85
50.112.237.127
50.16.7.188
52.222.236.74
54.220.64.134
01cbac3c4e6bb2c6e2006fc5b2c60181bb18f6c0e75c3d12e5030508bd0afdfc
01db0d203405ed4ec9c98bdcb0db8781188bcf88582788fb0e1c3c92c3e24f4f
047d14c117d25e9e0a1a2ba3f4aa23a602d417fc7402294e484d20b19140ecf1
0503c814907e89f314f04881ae04704a4467463310b6fe2e0ed6ce026ad85ed4
0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849
073b97779f9dc3c731a8c153f3f8dcfe2dc8f99a2c5ad7a279361a08e0302dc0
078f3dd88e751c3c421b2007e1cb27bcb65a95daf278bd25de81ba7b2bf3c4e4
07aa00aa3aa0d7f661d70680b81bb38d1af1160d7b8d391b1812a51070620535
09d3561e03ada8fad9e775913a66b7d5abc4a2f16299f13f7b04d416b110f6dc
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0cda584e7c5036ad66d7d528d2209bc596a14179fa1792a559e2ae9eaa91e851
0e80fa7380340a7651059a8b3d0d8ee3612d68c21a82206eaa5b0322b8263725
11374f38070555c45a2cf29c753bcd7442517ef7d7afdbe2d381f8235efeffcc
179a0ba55c3bbf759340ba2a57846f81a7de249ed7e502b5e8814af2ef964533
180cc8c07b9ddcaafa56301137f7054af4c50c4b117d9dd62d0610942eb7fd64
1c27bb55dc2fe6453e72fdfa7726fc8b74473bbffdbc424df999dc7751bf7ce3
1e12de52ccf27ce49c9b683ba0023cdc257036882cc845ff5f33c773253e6053
1e3d2833a35eab3bee7823c5b20a0bcb5eba35d0e57082abd558aac575e1eace
20849c348f89509a3e20c96249a30a3ab086a18e3183024853579c54f8047159
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
234e8daa7494fde711ebbdd46ae03550d93b25013eb452c96e03b1270e7ab808
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
283a8128e600ea21b56c8eb876ec2dafd52e734ee55c8658b5edc9d1299fde66
28816769ece0ee343025ff388216c645e175c92cce4db6bd812a321b1ad345c6
2a8a441d8086f20a64563edc759aba1de84d932e34ff77b8bb0279a730cdb428
2b065a0026be768ecfa77a6645a074c5c65a789f2889c1d1c4b22e96fd38f1da
2d2cf9c13130a9801a2cd2954984af9eba617b687b612bfdb0d67dd8100911f0
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
3169ab3142fbf3ecf7eee1b5682a4556ed8a3d4ba940befa71c31b5a43991d92
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
3725f4f84f1390a3a7d5acc7ab1d65495ce473b682296ffd619915c5b101d498
3c11c380f0fd80c64976a059ff85d9e5086ef0ec55f9f5cb04c46ed077aa0598
405ceee1c2f5c31f1cb94ebc63d49a43fddd1471c2c7401a01c7c11bb1d93826
43580e037fc59487c315cc0a33e1167f17c8430dd41aa375e21f4d6d325e8f28
43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af
47b1e4dacf35ebb6c332932414175722f425bd1c628b1ec3c075b41f5328b90b
47c237678f5bde045688185ede7a749a10c65de5b68c511cce9310bf66853cbb
487d3252e04d702f033dd508688732af1b78b9a5a604a5699288b652ae9f9b5a
4eda4b5575532ad6a713d3d9bbcde581c519d9b8d0202363925ddc80049eed6d
504ff3efe64294cb4fd8b982dadb288136e511a05d4b068356c371dc6057865f
54a0681713a967b8cd83cd375a85f8ed8eaf3ced1491c62a7c58153f589bf185
54dfaa802246829b57282653d0b2a0746944a8af138037b658d9f5537d985e01
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
5bb0131177aa9022463bfc6f6c7b57f943e8c95c9176a6a6a75b908640582cda
5ccd2287af72e2d56e11ebfcdb02dede2b9e39277e121ca53cbfbcc9cb529d3e
5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57
5d959e050c61344f264ee87cf81e9ffd30cb5ad5b5ae749218e9360a6403c1e4
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
62c994195bf30d1607e2d7b8cc5eaf8d9c30c7f78e6e32eecc676a3f74932e43
6556ae8681d92a9f36b8ad0cc99324bf66f58a72de301e3e8d3111f2763da457
672e9b04f273c7bc6b2b23413d590fa1ac1aec88429f4d73998a7cbfbae5bbe5
673dd7296f7b2fc51cc430503be6c982706ef1d0fa1ec2ce3c05bec4bbf0044b
68b4b6fc343811ef9268a786ba1a6d45532277051d2db7804896df2b58a9b429
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
6adc9f3b200f98b6e1f663777330bc8dedcb8fa807b1426ed6b04b89262f7d6e
6bf6491ee571abd1aa94b9c1e6da91d09a18ea15a32027fd9efeb173e00ab9ad
6c45006c40d76e72f40e88dc8e91670aeb859178d60536c3b412f79fe5399b21
6c649cc3d4aee7683250622541a6045ad4ac3beb93df1fcdd3ec1f7f12a1ff44
6f51bbe7b57914a96209c33c6a7a2d21f01b93f346fe27e5349249bc6a991679
75683be31d4f1729afdb2e1100747ef222a8008ad7082d86f44c6b5238eaadf9
77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7cb58278c8f54a62c0afa6da0c67b3a45aad637a0bf614e9c0dd42b73cee266b
7d3b9b124ab86b33b4c72d29ceca9c5a56e5205e546394f55e1ca7fac57d58d5
7e05c4fabf6d02fa4c14937ca467cc7d4ebbb02f295e3cff6ba999e6369fc663
811058844b02eadec8da887030aa5ce50c6dcf23cba6b63cce7f07ace5d4b7be
82e8cd748cf783ef9a94084d6273dfb1521495f6e421788f3f42659f955e9060
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8358f672996016e2cce823d94f7233ae8c7c79dfd05b61ecb64b3a125b4e4d86
83f8393c6593831a76ea84324c946029082b5c72507176c13387468d21c651ff
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
8ab6891019c69c729441517bed2c703ec68058f913e9fe0d9840617f89473421
8cfc8b8e060822ff5c24a6bc13a2380b72ff547e9ecddb5a12c18f6a2be805b3
8de86d71297dc0c8a04caeab00e28f1fcadaa2574558098cccfddd3aa27b8172
8fee1a230bc4ebb0ffa9c31cdc58ea7441499cfbca82ee57b5e83d437ffc3bfe
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
91623c33aade4a8d9370f6b51c6baf9680e6de834d33185a4f672ba7778fbed6
930239150e702d9d4bf43c3881aa70f8ad5fd9068dcbecb7c8bcca654784f7f1
958c2ecbdd6c6708cf566ceb9b10ffd133ceef822ce81ef460db8ca29e44bcb5
970d1c864a02c66e3cf5d1971f2c62c3e0da7553f9ce92c19c490758d66f22b1
985a78086b7a7fa7e71394bc9e8e508e2a9a3de4b363de41c69deac4cfd2c641
9d2ef0022ea6062c3f3cdf522963e17a155b5eb699453082b9223a1cffb97e8f
9d4c59b0db5e61fe2e21d4a8d397879fa140ce12d303a5dd3edeeaecadbef1d7
9d88866c6295ffc0cadaa1ccb951367e196737a413482176d5787b70aae04ef0
a04ca4a38cfded547daa7993112f5dcc2fbdf13f93b968d676e1313e8d8e98f6
a4ea37f8af67e84a4d330d3ccfb44eab01c877d0c4100c48c67ea57f1663552c
a5d55252f098d60e559b04bbaab7942674fa05acb7759b2bc49f9628f7c11463
a7d6070b955f11f31a679ff7742f6fe382348f7b71934cf2e8596ef1908c684a
a9c89c2a0df62b9bd73d859ae616ffe92cb9e86e1428a1a0fc797418f3e03dd9
aa9fb0bc90718761ce9804402766fc5c6f8b602a4b2d9140b60c8faa5fc52ba6
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
af5b0b20321a33d0b6e139babf5aa8c775dff093cb035f24c1caeae16a9cf784
b43508242f21a59b37bba45231dd25c6c861e079ef05607273c620337e217b9b
b7bab399e87338ff7e75ac15e592a194fce5a9bce2b7e899f6510af38c5c4177
b7c5d1d3e03d31b9b450c0aac2972f3aef995be2a69ec5ecfa6200c4a321ef40
b8bc4ed1493c1977120d12182cb046732ffad208a75d936ce32944c7deddddd2
ba482add0c02c927f05b5078b949334e4d1db145525061a0bb29b70bda92b9c7
bc18e73f36db814981a427412d398138ed0737021b6cd9fbcf2879e620922d4b
beeb705b69f299ad7567ae7ba292ae685556a7082531220a088a0d3b3307c410
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205
c2b7a45d31339f18ed57fd095feca4da1b3fbab75a5afbc053957f6e8e1613a2
c78a1da5fd0868a547cf285748c7fb73006571190385eb71c0d601b6b240ffaf
c878baf3b2bee3185daa3b0812e979a96e077fdf924b536f6c3e7e373882aa1e
c8c302716cf94980a0d77e614d9fb6c430f166b5ef7c42b7c382771955e52ba6
c96b2cd5b57e02ce65ab0a787a6c8ea69efbf424064e15500691847cd879e8ca
ca73c5f7c8006bebfa4f10a3a227e9cfee08e4859faeb9a98a7938d62036b231
cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981
cc98abda3818699035ccda57eac97e25e4578bb59f2c2764160f82e1e168b900
cc9914192e0a743ae5573b812ab10411abd58039f8d1971fcf08f5591a8f2257
cdeb836f7f77cd2174fa0bb4aa3825963aa64faf657a24f988b82f1c4d28ce69
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef
d0f8159f0af983f454b8b87626671c305cb2c5e823906916f21e82bfbb9b65ce
d14e287ddae470b06c4639e73260ca21a4c9b7cfdf56e02965a8f50fb5333b42
d31c8324cb19809562244b53cc52b67032e5cb663b758de4cdc5a28169743d99
d641c13a78017e11f15b152b78082bcd0cf474766f13ba649bfa6378d956c492
dca9b6afcb6c37d6a32456973fe5f2986a348a70d11774e102de6fc420992a19
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
dd8c7f7aae00c226824b8caad79b25703a1b017f6034e11ac53a4fa3dd564b1d
dee770f9587ee7473c64234480725ea4cb67f90458a87e8ccb876dfac8310839
df4cfb00c128eca08c272608e8782760abaca3d46f32f69cb9f9bcd9384a8cd6
dfac8944df586764444a3ea1a93226eb86e111d0994656478d5ae89f7ae613a4
e056bba7897b73bea51340aadecc3ef98722ac58c0538bace432c30787754fd5
e06e9fa0c40a8cc645b697a45747eb06cb230ca0a48862a26847435d314ab228
e1cd92144ff9e7af94bc45cac521e92d5534c7447b4de28afc365dbbf8828658
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba
e68e4d995a6756eae9c598330a2301656196eb26a47ae26d40cb359bfe721a4c
e76500eb2a449d3bf9ccee7a8ef85c5d8b9c2564df9a9223dd8df354dcab2abf
e87a8ee30b7f3e1fd90688380586a85641bc7a432e83be99cce7526e5f702136
ea6028aa03c2eda8725a67ffaff79e8498b464975d8a1744f983d9809c6810e5
eafc7d8ba1973825498b57acebb0bbe55a12f1dd45260b7986e5704ac232239c
ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff
ec547a2f9fde5ce8e398da2810828ba3c30c641ce2761f5bf915225efb35f919
ecb4cf1400337bb3e1f8d6e9c312534a7e4a786832b909799c1d26373371861e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f3342c52eee43a2ea931cae2ee2d6d9a2939432ffcb03bb4f2983ac7e49b26cc
f38bfa814ad4096dccf3892ea2c80c4d8b79e5e8ba7043c7c730b2061a2d2102
f46108976666130f89c43a82ee045f7a3afb264494060ef6b3d9eb6589e49d16
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
f595a7eeaf2e9ef60746074e0ff87a1b6bf60355ece3559d666b9b59041dc976
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
f92333a45b532bdb5248178674b041b1c35edfd33a55df48192256f0bfe49e4e
fcb446df87e25088aa01ac7eaf382f723b59d22c9caad056db88be943aa8e50a
fcecb97c12786d7a9387a81e74e4179790fd84425c9c75be1aec3aed645bf6e2
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
ff34521a617922ef17afe7660d744964af7b8d3e815b9e70ca3cb5dfdae9c073
fffcc021124d70080ddd0c52562645c46e03ff39c924ced85c1bfd62cb8b8767