redcanary.com Open in urlscan Pro
104.198.136.223  Public Scan

11 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 51

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1639603273109&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1639603273109%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fthreat-detection-report%252Fthreats%252Fta551%252F%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1639603273109&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1639603273109&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F&liSync=true&e_ipv6=AQKjU5qeRPWsBQAAAX2_-H_o43TO_6ZmNMrDUc0Nm0g-S8P_Rx_QcNr0kq1VvFY0Yy8U5v8N

Request Chain 91

• https://c.clarity.ms/c.gif HTTP 302
• https://c.bing.com/c.gif?CtsSyncId=BCEEB3DB0688448899F1E3D570090C68&RedC=c.clarity.ms&MXFR=066DA29CF0A368E73277B392F4A366F5 HTTP 302
• https://c.clarity.ms/c.gif?CtsSyncId=BCEEB3DB0688448899F1E3D570090C68&MUID=193EC021E6196FC51BCAD12FE7726E28

189 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response redcanary.com/threat-detection-report/threats/ta551/	380 KB 64 KB	684ms 213ms	Document text/html	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / WP Engine Resource Hash 854a4ed15c7b75cb8dca091dfc17542ddfad5c54994aae8bc745f9717cf2dd34 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests upgrade-insecure-requests Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers server nginx date Wed, 15 Dec 2021 21:21:11 GMT content-type text/html; charset=UTF-8 vary Accept-Encoding Accept-Encoding Accept-Encoding content-security-policy upgrade-insecure-requests upgrade-insecure-requests link <https://redcanary.com/wp-json/>; rel="https://api.w.org/" <https://redcanary.com/?p=26739>; rel=shortlink x-powered-by WP Engine x-cacheable SHORT cache-control max-age=600, must-revalidate x-cache HIT: 2 x-cache-group normal x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin x-content-type-options nosniff x-frame-options deny feature-policy microphone 'none'; geolocation 'none' x-permitted-cross-domain-policies master-only strict-transport-security max-age=63072000 content-encoding br
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.4.1/	86 KB 31 KB	255ms 86ms	Script text/javascript	2a00:1450:4001:809::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 18:05:02 GMT content-encoding gzip x-content-type-options nosniff age 184570 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30774 x-xss-protection 0 last-modified Mon, 13 May 2019 14:37:17 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Tue, 13 Dec 2022 18:05:02 GMT
GET H2	200	highlight.min.js Show response cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/	130 KB 33 KB	168ms 67ms	Script application/javascript	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/highlight.min.js Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d2f545bb226e5bcc1d50af37b345d245dce63bc07aaeba2243e0f1ea87b2dcb9 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:12 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 20586703 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 33250 cf-request-id 0996816b7100004dee2636a000000001 timing-allow-origin * last-modified Mon, 08 Feb 2021 15:10:43 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "60215473-20801" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=27rO38p0ckqpYC7U%2Fcg4TuSgZiBbYBSlii5sxoRwvGL8fUwlx597xi6daMPob5IAHrfEyWKXF5rDVSlIOT3sUSlT7XOikmKVEDMHHIqSOX6o0F7iANHuLSjBU08KNv62jmysIe7GLi9zEbzPN2zokxFs"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6be2b8622ae643b8-FRA expires Mon, 05 Dec 2022 21:21:12 GMT
GET H2	200	bizible.js Show response cdn.bizible.com/scripts/	83 KB 32 KB	253ms 52ms	Script application/x-javascript	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67D4) / Resource Hash 47d11b41f78f9e37dcb3a72ee46bf1d485026a70062133b13c05ff38ec76a5ec Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:12 GMT content-encoding gzip last-modified Fri, 10 Dec 2021 22:16:44 GMT server ECS (frb/67D4) age 72312 etag "51fd799d13eed71:0" vary Accept-Encoding x-cache HIT content-type application/x-javascript cache-control max-age=86400 accept-ranges bytes content-length 32302
GET H2	200	forms2.min.js Show response resource.redcanary.com/js/forms2/js/	205 KB 68 KB	460ms 73ms	Script application/x-javascript	104.17.73.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/js/forms2.min.js Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2689a0237a95cfd8135f8da3ac79c430e903f3c542f8b862f68141c84c348c43 Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:12 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT last-modified Tue, 12 Oct 2021 18:01:53 GMT server cloudflare age 1710 etag "3260414-33210-5ce2ba3f1c640" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=14400 cf-ray 6be2b863ea0c433f-FRA expires Thu, 16 Dec 2021 01:21:12 GMT
GET H2	200	9416.js Show response script.crazyegg.com/pages/scripts/0096/	5 KB 2 KB	311ms 77ms	Script text/javascript	2606:4700::6813:9408 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/scripts/0096/9416.js Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 674bab6c631dea45bd1466ad80c583765354708cdfea64776ceab0717cd3f43a Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:12 GMT content-encoding gzip cf-cache-status HIT age 5481 cf-polished origSize=4899 cf-ray 6be2b86578e96907-FRA ce-version 11.1.376 last-modified Wed, 15 Dec 2021 19:49:51 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * access-control-expose-headers CE-Version cache-control public, max-age=300, s-maxage=1209600 timing-allow-origin * cf-bgj minify
GET H2	200	js Show response www.googletagmanager.com/gtag/	164 KB 61 KB	280ms 108ms	Script application/javascript	2a00:1450:4001:80e::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 0e9aa1d0bc52b88db3a077a3211dd41f1797259c4b232e9ed310037cc17dc4ac Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:12 GMT content-encoding br server Google Tag Manager access-control-allow-headers Cache-Control vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 61884 x-xss-protection 0 expires Wed, 15 Dec 2021 21:21:12 GMT
GET H2	200	wp-embed.min.js Show response redcanary.com/wp-includes/js/	1 KB 1016 B	155ms 154ms	Script application/javascript	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-includes/js/wp-embed.min.js Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/threat-detection-report/threats/ta551/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:12 GMT content-encoding br last-modified Tue, 26 Jan 2021 15:18:33 GMT server nginx etag W/"601032c9-592" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000
GET H/1.1	200 OK	teknkl-formsplus-1.0.5.js Show response s3-us-west-2.amazonaws.com/s.cdpn.io/250687/	41 KB 41 KB	958ms 234ms	Script application/x-js	52.92.161.56 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3-us-west-2.amazonaws.com/s.cdpn.io/250687/teknkl-formsplus-1.0.5.js Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.92.161.56 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 731fcb30d45f2e35aaa139a7a964410a7c2bcdbfbb48a837c9d56dec7cc3732f Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 21:21:13 GMT Last-Modified Thu, 26 Apr 2018 08:20:46 GMT Server AmazonS3 x-amz-request-id W0D1GXNCYK54E1RD ETag "bab0c2b3523f8244564b675fe34db610" x-amz-version-id OjXdZ5iYdmgpgEuq0ftytCBc_PO35ThO Cache-Control public Accept-Ranges bytes Content-Type application/x-js Content-Length 41617 x-amz-id-2 hYWKKERv9DX3G5uXeyfoFmig9u992gKGDZ4njuP+NvQ0SsKmmBN4NDn5GLY9tKn3RI0KS7YVbaY=
GET H2	200	autoptimize_34bbdd66d12e67bac588486e1759b802.js Show response redcanary.com/wp-content/cache/autoptimize/js/	280 KB 81 KB	183ms 181ms	Script application/javascript	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/cache/autoptimize/js/autoptimize_34bbdd66d12e67bac588486e1759b802.js Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash ad0581c5da90b795230777e42c7ee35367b186cbec8bb159759c7357e530be87 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/threat-detection-report/threats/ta551/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:12 GMT content-encoding br last-modified Tue, 14 Dec 2021 15:09:37 GMT server nginx etag W/"61b8b3b1-45e78" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000
GET H2	200	default.min.css cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/	763 B 629 B	58ms 57ms	Stylesheet text/css	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/default.min.css Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3cc36c64ef86bed21592653daac82fd7e4c364c32c8344336aa13f7dbf52c90 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:12 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 20445461 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 271 cf-request-id 099eec99e6000005b307332000000001 timing-allow-origin * last-modified Mon, 08 Feb 2021 15:10:43 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "60215473-2fb" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oL8nL3n3QWKKJo0HAv34cjpHHeChO6MrsF6XqTmbWpS2EUZVHHLlSSGU7zFiMpQOoZxwXZyx0nqbJtX0IJP14PuMZmFiPeDcgE1x%2BNtf8vWiSj1VrmfahIsiCNd%2B7tYHWQA7bW96s3tzaXDzwMn5wh8Z"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6be2b8640f8043b8-FRA expires Mon, 05 Dec 2022 21:21:12 GMT
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/	1 KB 1 KB	341ms 57ms	Script application/x-javascript	104.121.173.167 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin.js Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.121.173.167 Munich, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-121-173-167.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 21:21:12 GMT Content-Encoding gzip Last-Modified Fri, 29 Oct 2021 01:24:07 GMT Server AkamaiNetStorage ETag "461ce1cffaadfebf2e7659745618ba8e:1635470647.434977" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 753
GET H2	200	gtm.js Show response www.googletagmanager.com/	218 KB 72 KB	420ms 248ms	Script application/javascript	2a00:1450:4001:80e::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash f68f77340d7947d6ac5e2c74f3f61d546578145133c2da4524402d0ea3212f2e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:12 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 73304 x-xss-protection 0 last-modified Wed, 15 Dec 2021 21:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 15 Dec 2021 21:21:12 GMT
GET H/1.1	200 OK	6si.min.js Show response j.6sc.co/	27 KB 9 KB	289ms 65ms	Script application/javascript	104.111.233.140 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-140.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 2707e48726a3f7ec48a1d1aec9738f20b36bac1535cfa9de2e4d92310c4e7e7a Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 21:21:12 GMT Content-Encoding gzip X-Content-Type-Options nosniff Connection keep-alive Vary Accept-Encoding Content-Length 8575 Pragma no-cache Last-Modified Thu, 07 Oct 2021 17:17:43 GMT Server nginx/1.14.0 (Ubuntu) ETag "615f2bb7-6a5f" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type application/javascript Access-Control-Allow-Origin Cache-Control private, no-cache, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 15 Dec 2021 21:21:12 GMT
GET H2	200	css fonts.googleapis.com/	7 KB 1 KB	259ms 91ms	Stylesheet text/css	2a00:1450:4001:82f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash d2ef4524559f65d7bc130ca778005347674cc76ca82b1023a8ea40580b219084 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 15 Dec 2021 20:36:13 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Wed, 15 Dec 2021 21:21:12 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 15 Dec 2021 21:21:12 GMT
GET H2	200	65zait4t5ws7.js Show response js.driftt.com/include/1639603500000/	218 KB 62 KB	605ms 382ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/include/1639603500000/65zait4t5ws7.js Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash aa82097c9e8bddaf6321732c1cb749fe50fe87d246d967619fd78e7ffc738466 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:12 GMT content-encoding gzip x-amz-cf-pop FRA50-C1 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Tue, 14 Dec 2021 14:21:34 GMT server nginx etag W/"b07c2cc0c072e7303b614224af6d4205" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id rei7PN32G8Xi.TUkUUNOUz8pBMXFCEj9 via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control no-cache access-control-allow-credentials true content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id THewkO4chvkBHbHZ49hAu2qFjYdSESwxOX3Gt-CzqIHb0wQWDtxoNg==
GET H2	200	css2 fonts.googleapis.com/	9 KB 829 B	265ms 96ms	Stylesheet text/css	2a00:1450:4001:82f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Source+Sans+Pro:wght@300;400;600;700&display=swap Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash ad62b2ddfd883c45c9d3196c22d83b0277ff28529832cae7f9784d740a81abb4 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 15 Dec 2021 20:35:21 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Wed, 15 Dec 2021 21:21:12 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 15 Dec 2021 21:21:12 GMT
GET H2	200	autoptimize_6128cb19e221c63c096daa16344aa339.css redcanary.com/wp-content/cache/autoptimize/css/	3 MB 178 KB	183ms 182ms	Stylesheet text/css	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_6128cb19e221c63c096daa16344aa339.css Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 2e6113964948c48cfa96d797610f3da81bd743322ffdc78303395f0ca14fdf6a Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/threat-detection-report/threats/ta551/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:12 GMT content-encoding br last-modified Tue, 14 Dec 2021 15:09:37 GMT server nginx etag W/"61b8b3b1-33dccb" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000
GET H2	200	SmartForms.js Show response sfc.leadspace.com/	3 KB 3 KB	259ms 60ms	Script application/javascript	35.190.114.154 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://sfc.leadspace.com/SmartForms.js Requested by Host: ajax.googleapis.com URL: https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.190.114.154 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 154.114.190.35.bc.googleusercontent.com Software UploadServer / Resource Hash 0645386b306fc6a2e7a59f44e38fb44e53c519a4ba0f0701e0caa07e9ab601d6 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 20:28:49 GMT age 3143 x-guploader-uploadid ADPycduRa7_aPZ7OvZ6AyaArKRqg1SfiN9HkU946i0ypkO0K50PPBnfO784jFPo0wzLIi2864mFZY933898lTsIL-uY x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity alt-svc clear content-length 2718 last-modified Sun, 30 May 2021 06:36:45 GMT server UploadServer etag "557a04d61944100c7badd3f08c3e0fd3" strict-transport-security max-age=31536000 x-goog-hash crc32c=6Pcn1A==, md5=VXoE1hlEEAx7rdPwjD4P0w== x-goog-generation 1622356605704395 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=3600 x-goog-stored-content-length 2718 accept-ranges bytes content-type application/javascript expires Wed, 15 Dec 2021 21:28:49 GMT
GET DATA	200 OK	truncated /	65 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 9edb5c5ef600768db6e8ee027853f2c6f8ab34f615b495faaf114579f8de2e22 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5fa664cddf6ef6764e07859944c80ab66457722abc8017db9c8485b4614bbd4e Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 724c0d0e6282b032737e230296cbd7039ed51e0e15a8a07406850a6a7cc6bab6 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 47c14140ee4608b3ded304344120b13754bff6ff3885aa9b83fa3b486164d59c Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a621ca6fbd7d8a3abbe4212edef3177582d7e9287981165f2484aa93695a59e5 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	bullet-square.svg redcanary.com/wp-content/themes/redcanary/assets/img/	443 B 574 B	296ms 295ms	Image image/svg+xml	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/bullet-square.svg Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 6217f642930c0d2411329fb00cf9a7e2e138a98f56eece6e82b3a7359f20cb11 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/threat-detection-report/threats/ta551/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:12 GMT content-encoding br last-modified Mon, 23 Aug 2021 16:46:07 GMT server nginx etag W/"6123d0cf-1bb" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000
GET H2	200	6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vAlQ.woff2 fonts.gstatic.com/s/sourcesanspro/v18/	56 KB 56 KB	438ms 270ms	Font font/woff2	2a00:1450:4001:82b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcesanspro/v18/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vAlQ.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5938f0f80b151d182a475bd81dd3c6bb18e6bcf14fc9c78404be2d8208a1ffcd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://redcanary.com/ Origin https://redcanary.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 03:16:26 GMT x-content-type-options nosniff age 65086 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 57336 x-xss-protection 0 last-modified Wed, 10 Nov 2021 18:11:05 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Thu, 15 Dec 2022 03:16:26 GMT
GET H2	200	6xK3dSBYKcSV-LCoeQqfX1RYOo3aOg.woff2 fonts.gstatic.com/s/sourcesanspro/v18/	57 KB 57 KB	250ms 82ms	Font font/woff2	2a00:1450:4001:82b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcesanspro/v18/6xK3dSBYKcSV-LCoeQqfX1RYOo3aOg.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a4d834bdca3fb256c40f82e65735907dbabd455688294b3aba0e11a14fd718a7 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://redcanary.com/ Origin https://redcanary.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 07:57:58 GMT x-content-type-options nosniff age 134594 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 57924 x-xss-protection 0 last-modified Wed, 10 Nov 2021 18:10:59 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Wed, 14 Dec 2022 07:57:58 GMT
GET H2	200	6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zAlQ.woff2 fonts.gstatic.com/s/sourcesanspro/v18/	56 KB 56 KB	398ms 231ms	Font font/woff2	2a00:1450:4001:82b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcesanspro/v18/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zAlQ.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c9c41c03603662bd177b23747796d7ae176fab6dc8151dc11e71a09f0727ca8c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://redcanary.com/ Origin https://redcanary.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Sat, 11 Dec 2021 21:59:40 GMT x-content-type-options nosniff age 343292 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 57240 x-xss-protection 0 last-modified Wed, 10 Nov 2021 18:10:44 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Sun, 11 Dec 2022 21:59:40 GMT
GET H2	200	3M8FzayQWtkvOhqMn2V4T2 Show response open.spotify.com/embed/track/ Frame B9D7	13 KB 3 KB	342ms 140ms	Document text/html	2600:1901:1:c36:: GOOGLE
General Check archive.org Show headers Download Go to Full URL https://open.spotify.com/embed/track/3M8FzayQWtkvOhqMn2V4T2?si=UvSr69afRG6R5wTzLR_Yiw Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:1:c36:: , United States, ASN15169 (GOOGLE, US), Reverse DNS Software envoy / Resource Hash 0408bba7ffda9b39a6f2fc32dd06bb6a6074b626238bbd41206fa580019da08f Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ Response headers date Wed, 15 Dec 2021 21:21:12 GMT content-type text/html; charset=utf-8 vary Accept-Encoding spotify-request-id 6bf34b0b-35bd-4431-bd9b-8001e14272f5 content-encoding br x-join-the-band https://www.spotify.com/jobs/ sp-trace-id 2d011a2666272208 strict-transport-security max-age=31536000 x-content-type-options nosniff server envoy via HTTP/2 edgeproxy, 1.1 google alt-svc clear
GET H2	200	getForm Show response resource.redcanary.com/index.php/form/	30 KB 6 KB	481ms 481ms	Script application/javascript	104.17.73.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/index.php/form/getForm?munchkinId=003-YRU-314&form=1664&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F&callback=jQuery112408225224730037186_1639603272400&_=1639603272401 Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a2d125e0fb1bedd6877978226306a84e53f6d2c7f2d46d6081d0de6a548aa36d Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:12 GMT content-encoding gzip server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript; charset=utf-8 cf-ray 6be2b864dbe6433f-FRA cached true
GET H2	404	x.svg redcanary.com/threat-detection-report/threats/img/	548 B 548 B	247ms 247ms	Image text/html	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/threat-detection-report/threats/img/x.svg Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/threat-detection-report/threats/ta551/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:12 GMT content-encoding br server nginx vary Accept-Encoding, Accept-Encoding content-type text/html
GET H2	200	6xKydSBYKcSV-LCoeQqfX1RYOo3i54rAlQ.woff2 fonts.gstatic.com/s/sourcesanspro/v18/	56 KB 57 KB	234ms 181ms	Font font/woff2	2a00:1450:4001:82b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcesanspro/v18/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rAlQ.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash afc36bd5be6d8bd36065e5573a6dad471cb1d96ca92a0e7b78ed5434266f16f9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://redcanary.com/ Origin https://redcanary.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 08:00:05 GMT x-content-type-options nosniff age 134467 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 57720 x-xss-protection 0 last-modified Wed, 10 Nov 2021 18:10:38 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Wed, 14 Dec 2022 08:00:05 GMT
GET H2	200	360de60f-3edb-4ca3-a55f-a3762adf8653.js Show response sfc.leadspace.com/	14 KB 14 KB	59ms 57ms	Script text/javascript	35.190.114.154 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://sfc.leadspace.com/360de60f-3edb-4ca3-a55f-a3762adf8653.js Requested by Host: sfc.leadspace.com URL: https://sfc.leadspace.com/SmartForms.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.190.114.154 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 154.114.190.35.bc.googleusercontent.com Software UploadServer / Resource Hash 51dd4b0f7d9e586d92bc38614e9c97601a184b9062b3cc43da00bf69e8ab39a2 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 20:37:54 GMT age 2598 x-guploader-uploadid ADPycdsEt9m4L739fAKwXrB-fCo-MMUXE0SFq1nsfr8Jw_kP9F6YYc8c7EfjBlSTaJhfM8YaXDolswIuV_AeXXz9LFo x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity alt-svc clear content-length 14348 last-modified Wed, 25 Aug 2021 20:41:42 GMT server UploadServer etag "cf568eaa22b6e0a7bc7eef8807c003d6" strict-transport-security max-age=31536000 x-goog-hash crc32c=cJsKSw==, md5=z1aOqiK24Ke8fu+IB8AD1g== x-goog-generation 1629924102366899 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=3600 x-goog-stored-content-length 14348 accept-ranges bytes content-type text/javascript expires Wed, 15 Dec 2021 21:37:54 GMT
GET H2	200	9416.json Show response script.crazyegg.com/pages/data-scripts/0096/	5 KB 2 KB	191ms 83ms	XHR application/json	2606:4700::6813:9408 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/data-scripts/0096/9416.json?t=1 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0096/9416.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 15f17111259031f76e017686e5f802e52f23edda9212ac9bb3474ccd73debc59 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:12 GMT content-encoding gzip cf-cache-status HIT age 5480 ce-version 11.1.376 content-length 1468 timing-allow-origin * last-modified Wed, 15 Dec 2021 19:49:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/json access-control-allow-origin * access-control-expose-headers CE-Version cache-control public, max-age=300, s-maxage=1209600 accept-ranges bytes cf-ray 6be2b866abcbc29f-FRA
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/161/	11 KB 5 KB	62ms 62ms	Script application/x-javascript	104.121.173.167 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/161/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/munchkin.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.121.173.167 Munich, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-121-173-167.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 21:21:12 GMT Content-Encoding gzip Last-Modified Wed, 08 Sep 2021 00:38:21 GMT Server AkamaiNetStorage ETag "0e0eefac8daf874e8b1aa34aeb160c52:1631061501.737429" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Cache-Control max-age=8640000 Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 4681 Expires Fri, 25 Mar 2022 21:21:12 GMT
POST H/1.1	200 OK	visitWebPage 003-yru-314.mktoresp.com/webevents/	2 B 311 B	1195ms 204ms	Ping text/plain	192.28.147.68 OMNITURE
General Check archive.org Show headers Download Go to Full URL https://003-yru-314.mktoresp.com/webevents/visitWebPage?_mchNc=1639603272689&_mchCn=&_mchId=003-YRU-314&_mchTk=_mch-redcanary.com-1639603272688-17224&_mchHo=redcanary.com&_mchPo=&_mchRu=%2Fthreat-detection-report%2Fthreats%2Fta551%2F&_mchPc=https%3A&_mchVr=161&_mchEcid=&_mchHa=&_mchRe=&_mchQp= Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/161/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.28.147.68 , United States, ASN15224 (OMNITURE, US), Reverse DNS Software nginx / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers Referer https://redcanary.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Date Wed, 15 Dec 2021 21:21:13 GMT Content-Encoding gzip Server nginx Transfer-Encoding chunked Content-Type text/plain; charset=UTF-8 Access-Control-Allow-Origin * Connection keep-alive X-Request-Id 1db615e8-3d17-4271-b690-0fa4b63fa468
GET H/1.1	200 OK	embed.d3e2038d.js Show response open.scdn.co/cdn/build/embed/ Frame B9D7	475 KB 110 KB	250ms 66ms	Script application/javascript	2a04:4e42:f::760 FASTLY
General Check archive.org Show headers Download Go to Full URL https://open.scdn.co/cdn/build/embed/embed.d3e2038d.js Requested by Host: open.spotify.com URL: https://open.spotify.com/embed/track/3M8FzayQWtkvOhqMn2V4T2?si=UvSr69afRG6R5wTzLR_Yiw Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:f::760 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash e4dbafd09f66969409c890932f747675614081929141f24f149c4753d06861b0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://open.spotify.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 21:21:12 GMT Content-Encoding gzip Last-Modified Wed, 15 Dec 2021 20:05:52 GMT Age 4327 ETag "d6efa841a3668afe48611aaaf3009f11" X-Served-By cache-ord1739-ORD, cache-lhr7342-LHR X-Cache HIT, HIT Content-Type application/javascript Access-Control-Allow-Origin * Cache-Control public, max-age=31536000 Connection keep-alive Accept-Ranges bytes Timing-Allow-Origin * Content-Length 112221 X-Cache-Hits 1, 539
GET H/1.1	200 OK	vendor~embed.6f1259a6.js Show response open.scdn.co/cdn/build/embed/ Frame B9D7	658 KB 193 KB	249ms 65ms	Script application/javascript	2a04:4e42:f::760 FASTLY
General Check archive.org Show headers Download Go to Full URL https://open.scdn.co/cdn/build/embed/vendor~embed.6f1259a6.js Requested by Host: open.spotify.com URL: https://open.spotify.com/embed/track/3M8FzayQWtkvOhqMn2V4T2?si=UvSr69afRG6R5wTzLR_Yiw Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:f::760 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 4ab6fb17bd2e87df25a169cddff8702659391c9fde4efa5e836a32e1bdda7cd5 Request headers Accept-Language de-DE,de;q=0.9 Referer https://open.spotify.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 21:21:12 GMT Content-Encoding gzip Last-Modified Tue, 07 Dec 2021 09:33:22 GMT Age 505475 ETag "63405b074dff76c95b50557d98788265" X-Served-By cache-ord1723-ORD, cache-lhr7322-LHR X-Cache HIT, HIT Content-Type application/javascript Access-Control-Allow-Origin * Cache-Control public, max-age=31536000 Connection keep-alive Accept-Ranges bytes Timing-Allow-Origin * Content-Length 197510 X-Cache-Hits 1, 143
POST H2	204	collect www.google-analytics.com/g/	0 345 B	258ms 90ms	Ping text/plain	2a00:1450:4001:80f::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/g/collect?v=2&tid=G-T3K4MTNQJN&gtm=2oec10&_p=573675066&sr=1600x1200&ul=en-us&cid=1216066355.1639603273&_s=1&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F&dt=TA551%20-%202021%20Threat%20Detection%20Report%20-%20Red%20Canary&sid=1639603272&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://redcanary.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers pragma no-cache date Wed, 15 Dec 2021 21:21:12 GMT server Golfe2 content-type text/plain access-control-allow-origin https://redcanary.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	11.1.376.js Show response script.crazyegg.com/pages/versioned/common-scripts/	71 KB 23 KB	61ms 61ms	Script text/javascript	2606:4700::6813:9408 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/versioned/common-scripts/11.1.376.js Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0096/9416.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b401d1e804e0a5079603c8f74249ae0e2ec2c797703490f3a0c38079cd989027 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Wed, 15 Dec 2021 21:21:12 GMT content-encoding gzip cf-cache-status HIT last-modified Wed, 01 Dec 2021 14:25:17 GMT server cloudflare age 462847 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000, s-maxage=31536000 accept-ranges bytes cf-ray 6be2b8672d316907-FRA content-length 23366
GET H2	200	uwt.js Show response static.ads-twitter.com/	14 KB 6 KB	152ms 50ms	Script application/javascript	151.101.12.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:12 GMT content-encoding gzip last-modified Mon, 20 Sep 2021 23:58:10 GMT etag "8dc11b7ca1d5ed9ec3b1ab1beb621c75+gzip+gzip" vary Accept-Encoding,Host x-tw-cdn FT p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" cache-control no-cache x-cache HIT, HIT accept-ranges bytes content-type application/javascript; charset=utf-8 content-length 5410 x-served-by cache-iad-kjyo7100112-IAD, cache-fra19178-FRA
GET H/1.1	200 OK	insight.min.js Show response snap.licdn.com/li.lms-analytics/	5 KB 2 KB	232ms 59ms	Script application/x-javascript	2a02:26f0:12d::6879:4c59 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:12d::6879:4c59 Berlin, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 21:21:13 GMT Content-Encoding gzip Last-Modified Wed, 29 Sep 2021 19:17:49 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=33653 Connection keep-alive Accept-Ranges bytes Content-Length 2036
GET H2	200	pixel.js Show response www.redditstatic.com/ads/	23 KB 8 KB	318ms 57ms	Script application/javascript	2a04:4e42:200::396 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.redditstatic.com/ads/pixel.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::396 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 04686da390f8eec3ccd75869fa71e22cad452cfcff6ffa31c979f599d64831d8 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:13 GMT via 1.1 varnish, 1.1 varnish, 1.1 varnish last-modified Wed, 03 Nov 2021 15:08:58 GMT server snooserv etag "3fbf36d562f1d2a543a89683060265ed" vary Accept-Encoding,Origin content-type application/javascript cache-control public, max-age=60 accept-ranges bytes content-encoding gzip content-length 7632
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/	37 KB 14 KB	314ms 142ms	Script text/javascript	142.250.186.162 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.162 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f2.1e100.net Software cafe / Resource Hash 9f4922667f15ec47709504b75c4433e7145f96078261bc9a11e386ca52fa18bb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:13 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14328 x-xss-protection 0 server cafe etag 12503521247758841375 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Wed, 15 Dec 2021 21:21:13 GMT
GET H2	200	bat.js Show response bat.bing.com/	36 KB 11 KB	182ms 74ms	Script application/javascript	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash dfed159907574337d5a3198b898e17e6f0d6c5c325d8ee2fd2343b7cddb34994 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:12 GMT content-encoding gzip last-modified Fri, 03 Dec 2021 01:53:50 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: C58D5DC5DADF462080B7C0313A52D69A Ref B: FRAEDGE1415 Ref C: 2021-12-15T21:21:12Z etag "0cb09ee8e7d71:0" vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript access-control-allow-origin * cache-control private,max-age=1800 accept-ranges bytes content-length 10468
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	98 KB 26 KB	155ms 51ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash b23807a4c5d90afca0dc47d688c0a05302779429dab75f5e6182562dcc2970f6 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=3600,h3-29=":443"; ma=3600 content-length 25965 x-xss-protection 0 pragma public x-fb-debug khuBAPsQsWncLyFhLeOiW6yAgHcJoIPTOjqqcOhkxojxszrKOzBhcMM9uGsJJAAVfe1N5ulYjQfdum0KQhGKUg== x-fb-trip-id 686109401 x-frame-options DENY date Wed, 15 Dec 2021 21:21:12 GMT strict-transport-security max-age=31536000; preload; includeSubDomains content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-fb-rlafr 0 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	topic-hero.jpg redcanary.com/wp-content/themes/redcanary/assets/img/	244 KB 245 KB	162ms 162ms	Image image/jpeg	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/topic-hero.jpg Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_6128cb19e221c63c096daa16344aa339.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 36975a27509bf92a53016181456a48ff34220ab524329a013bd2fa486ab19048 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_6128cb19e221c63c096daa16344aa339.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:13 GMT last-modified Wed, 27 Feb 2019 15:51:15 GMT server nginx etag "5c76b1f3-3d141" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000 accept-ranges bytes content-length 250177
GET H2	200	globe-white-right.png redcanary.com/wp-content/themes/redcanary/assets/img/	259 KB 260 KB	317ms 316ms	Image image/png	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/globe-white-right.png Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_6128cb19e221c63c096daa16344aa339.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash d3d589e680bc49f54cb5721723fc2ec1a68d5e8ce3946db7192fb0d207e9b6cf Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_6128cb19e221c63c096daa16344aa339.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:13 GMT last-modified Wed, 27 Feb 2019 15:51:11 GMT server nginx etag "5c76b1ef-40da2" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000 accept-ranges bytes content-length 265634
GET H2	200	search-btn.svg redcanary.com/wp-content/themes/redcanary/assets/img/	161 B 411 B	317ms 316ms	Image image/svg+xml	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/search-btn.svg Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_6128cb19e221c63c096daa16344aa339.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 0f57969cdf0d61b86fc25ded8a8c5058a5edd346d1845b232610a54f08d0fcb8 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_6128cb19e221c63c096daa16344aa339.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:13 GMT content-encoding br last-modified Wed, 08 Sep 2021 23:08:04 GMT server nginx etag W/"61394254-a1" vary Accept-Encoding, Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000
GET H2	200	forms2.css resource.redcanary.com/js/forms2/css/	13 KB 3 KB	65ms 64ms	Stylesheet text/css	104.17.73.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/css/forms2.css Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:13 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT age 1711 content-length 2623 last-modified Tue, 12 Oct 2021 18:01:53 GMT server cloudflare etag "3260417-3437-5ce2ba3f1c640" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css cache-control public, max-age=14400 accept-ranges bytes cf-ray 6be2b868edde433f-FRA expires Thu, 16 Dec 2021 01:21:13 GMT
GET H2	200	forms2-theme-plain.css resource.redcanary.com/js/forms2/css/	828 B 332 B	97ms 96ms	Stylesheet text/css	104.17.73.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/css/forms2-theme-plain.css Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:13 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT age 1711 content-length 246 last-modified Tue, 12 Oct 2021 18:01:53 GMT server cloudflare etag "326041e-33c-5ce2ba3f1c640" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css cache-control public, max-age=14400 accept-ranges bytes cf-ray 6be2b868ede0433f-FRA expires Thu, 16 Dec 2021 01:21:13 GMT
GET H3	200	1042590016249604 Show response connect.facebook.net/signals/config/	305 KB 87 KB	151ms 96ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/1042590016249604?v=2.9.48&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e7aaf3b76148c4b3bdbc597485416dfa02e8cca8097bec2f7d7c35a8e5fc9f5e Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=3600,h3-29=":443"; ma=3600 x-xss-protection 0 pragma public x-fb-debug drfeaMN94Ex1Vmkey6Vmb6uvg0mIe7t4vgZdEDqWqI5MzYgCLzsAIsaa6jsj0OS8sEMF7sZTwEUa9tioxeL1pw== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Wed, 15 Dec 2021 21:21:13 GMT strict-transport-security max-age=31536000; preload; includeSubDomains report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-fb-rlafr 0 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1639603273109&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1639603273109%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fthre... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1639603273109&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F&liSync=true https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1639603273109&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F&liSync=true&e_ipv6=AQKjU5qeRPWsBQAAAX2_...	0 155 B	440ms 162ms	Image application/javascript	108.174.10.14 LINKEDIN
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1639603273109&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F&liSync=true&e_ipv6=AQKjU5qeRPWsBQAAAX2_-H_o43TO_6ZmNMrDUc0Nm0g-S8P_Rx_QcNr0kq1VvFY0Yy8U5v8N Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Server 108.174.10.14 , United States, ASN14413 (LINKEDIN, US), Reverse DNS 108-174-10-14.fwd.linkedin.com Software Play / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:14 GMT server Play linkedin-action 1 x-li-fabric prod-lva1 x-li-proto http/2 x-li-pop prod-lva1 content-type application/javascript content-length 0 x-li-uuid L9U9pn0KwRZQWRu6oysAAA== Redirect headers date Wed, 15 Dec 2021 21:21:13 GMT x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: CFF069FC05484FBCBD7B0E68C56D2FA9 Ref B: FRAEDGE0919 Ref C: 2021-12-15T21:21:13Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-lva1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1639603273109&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F&liSync=true&e_ipv6=AQKjU5qeRPWsBQAAAX2_-H_o43TO_6ZmNMrDUc0Nm0g-S8P_Rx_QcNr0kq1VvFY0Yy8U5v8N x-li-proto http/2 content-length 0 x-li-uuid AAXTNeKzc2AlQHXPC2ThLw==
GET H2	200	adsct t.co/i/	43 B 470 B	270ms 166ms	Image image/gif	104.244.42.197 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o015g&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=1d98ae5a-3079-4f0b-aca3-1d1cda4a1bbd&tw_document_href=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.197 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:13 GMT content-encoding gzip x-content-type-options nosniff status 200 OK x-twitter-response-tags BouncerCompliant content-length 65 x-xss-protection 0 x-response-time 116 pragma no-cache last-modified Wed, 15 Dec 2021 21:21:13 GMT server tsa_o x-frame-options SAMEORIGIN strict-transport-security max-age=0 content-type image/gif;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash 9c2f9214f7e0f66da7d4000085607711f0d11b87acb2c20b52ced337103f704e x-transaction 2b3afb42869d7d5e expires Tue, 31 Mar 1981 05:00:00 GMT
GET H2	200	56383426.js Show response bat.bing.com/p/action/	685 B 740 B	402ms 402ms	Script application/javascript	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/56383426.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e03e8e99c05862bed451656bed1b9869db391ff01879cfae6455e67a54ed590f Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 21:21:12 GMT content-encoding gzip accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 276A4FFECC814E93889E2FC07FED49C7 Ref B: FRAEDGE1415 Ref C: 2021-12-15T21:21:13Z vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control no-store,no-cache content-length 589
POST H/1.1	200 OK	/ Show response sentry.io/api/265628/envelope/ Frame B9D7	2 B 406 B	625ms 152ms	Fetch application/json	35.188.42.15 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://sentry.io/api/265628/envelope/?sentry_key=db1eaaeafb9044828c39cd41f9805164&sentry_version=7 Requested by Host: open.scdn.co URL: https://open.scdn.co/cdn/build/embed/vendor~embed.6f1259a6.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.188.42.15 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 15.42.188.35.bc.googleusercontent.com Software nginx / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://open.spotify.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Date Wed, 15 Dec 2021 21:21:13 GMT vary Origin Server nginx Strict-Transport-Security max-age=31536000; includeSubDomains; preload Content-Type application/json access-control-allow-origin https://open.spotify.com access-control-expose-headers x-sentry-error, retry-after, x-sentry-rate-limits x-envoy-upstream-service-time 0 Connection keep-alive Content-Length 2
GET H2	200	/ Show response apresolve.spotify.com/ Frame B9D7	273 B 234 B	222ms 67ms	Fetch application/json	2600:1901:0:524d:: GOOGLE
General Check archive.org Show headers Download Go to Full URL https://apresolve.spotify.com/?type=dealer&type=spclient Requested by Host: open.scdn.co URL: https://open.scdn.co/cdn/build/embed/vendor~embed.6f1259a6.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:0:524d:: Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash af94dee172bdc97fa00b80907d2c0448ee4c3ad7403036aed9b7abed68d6cbc7 Request headers Accept-Language de-DE,de;q=0.9 Referer https://open.spotify.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:13 GMT content-encoding gzip content-type application/json; charset=utf-8 access-control-allow-origin * cache-control private, max-age=0 alt-svc clear content-length 106 via 1.1 google
GET H/1.1	200 OK	ab67616d0000b27398e08f603553915a041b6937 i.scdn.co/image/ Frame B9D7	121 KB 121 KB	279ms 65ms	Image image/jpeg	2a04:4e42:f::760 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.scdn.co/image/ab67616d0000b27398e08f603553915a041b6937 Requested by Host: open.spotify.com URL: https://open.spotify.com/embed/track/3M8FzayQWtkvOhqMn2V4T2?si=UvSr69afRG6R5wTzLR_Yiw Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:f::760 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 4f55b3bf19d92d8abcd99a30ead4713df28d6b27082298ed14cd4a555b5af70f Request headers Accept-Language de-DE,de;q=0.9 Referer https://open.spotify.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 21:21:13 GMT Last-Modified Wed, 04 Sep 2019 11:14:42 GMT Age 481285 ETag "e2a496934d84f9a24265f6ac7db4d8d4" X-Served-By cache-ord1745-ORD, cache-lhr7338-LHR X-Cache HIT, HIT Content-Type image/jpeg Access-Control-Allow-Origin * Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Timing-Allow-Origin * Content-Length 123587 X-Cache-Hits 2, 10
GET H/1.1	200 OK	CircularSpUIv3T-Bold.8d0a45cc.woff2 open.scdn.co/cdn/fonts/ Frame B9D7	71 KB 72 KB	204ms 69ms	Font application/octet-stream	2a04:4e42:f::760 FASTLY
General Check archive.org Show headers Download Go to Full URL https://open.scdn.co/cdn/fonts/CircularSpUIv3T-Bold.8d0a45cc.woff2 Requested by Host: open.spotify.com URL: https://open.spotify.com/embed/track/3M8FzayQWtkvOhqMn2V4T2?si=UvSr69afRG6R5wTzLR_Yiw Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:f::760 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 897cda707d438f8d6b6b92cfcb2c1fd2035ff59f5f0c5b9943d2f04d411f7fda Request headers Referer https://open.spotify.com/ Origin https://open.spotify.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 21:21:13 GMT Last-Modified Thu, 28 Oct 2021 13:16:22 GMT Age 4175968 ETag "c147cc237b8b07e0a8875dfbbe857b29" X-Served-By cache-ord1721-ORD, cache-lhr7321-LHR X-Cache HIT, HIT Content-Type application/octet-stream Access-Control-Allow-Origin * Cache-Control public, max-age=31536000 Connection keep-alive Accept-Ranges bytes Timing-Allow-Origin * Content-Length 72840 X-Cache-Hits 1, 59458
GET H/1.1	200 OK	CircularSpUIv3T-Light.afd9ab26.woff2 open.scdn.co/cdn/fonts/ Frame B9D7	64 KB 64 KB	206ms 70ms	Font application/octet-stream	2a04:4e42:f::760 FASTLY
General Check archive.org Show headers Download Go to Full URL https://open.scdn.co/cdn/fonts/CircularSpUIv3T-Light.afd9ab26.woff2 Requested by Host: open.spotify.com URL: https://open.spotify.com/embed/track/3M8FzayQWtkvOhqMn2V4T2?si=UvSr69afRG6R5wTzLR_Yiw Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:f::760 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash db22b70f8948a77fbd54101dd8f3abcc4edc218effb29dabbbcc0e32c97aa1f9 Request headers Referer https://open.spotify.com/ Origin https://open.spotify.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 21:21:13 GMT Last-Modified Tue, 08 Jun 2021 09:36:33 GMT Age 16453867 ETag "fa8473268d2eac34c88a9a6ccf214f43" X-Served-By cache-ord1740-ORD, cache-lhr7374-LHR X-Cache HIT, HIT Content-Type application/octet-stream Access-Control-Allow-Origin * Cache-Control public, max-age=31536000 Connection keep-alive Accept-Ranges bytes Timing-Allow-Origin * Content-Length 65408 X-Cache-Hits 2, 87451
GET H2	200	9416.json Show response script.crazyegg.com/pages/sampling-data-scripts/0096/	160 B 259 B	62ms 61ms	XHR application/json	2606:4700::6813:9408 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/sampling-data-scripts/0096/9416.json?t=455445 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/11.1.376.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 09fa7e4d56db9fd482f3647f5bd4c0896820f2c7a7c6b348aff58d01364c4a1b Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:13 GMT content-encoding gzip cf-cache-status HIT age 5480 ce-version 11.1.376 content-length 147 timing-allow-origin * last-modified Wed, 15 Dec 2021 19:49:53 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/json access-control-allow-origin * access-control-expose-headers CE-Version cache-control public, max-age=300, s-maxage=1209600 accept-ranges bytes cf-ray 6be2b86a88fdc29f-FRA
GET H2	200	ipv cdn.bizible.com/m/	43 B 327 B	51ms 51ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=721f930b3b62401caee7fbf5641ef162&_biz_s=298d4b&_biz_l=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F&_biz_t=1639603272545&_biz_i=TA551%20-%202021%20Threat%20Detection%20Report%20-%20Red%20Canary&_biz_n=0&a=redcanary.com&rnd=16912&cdn_o=a&_biz_z=1639603273322 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6739) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 21:21:13 GMT last-modified Thu, 09 Dec 2021 01:06:59 GMT server ECS (frb/6739) age 591254 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" cache-control no-cache, no-store accept-ranges bytes content-type Image/GIF content-length 43 expires -1
GET H2	200	u cdn.bizibly.com/	43 B 203 B	91ms 51ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizibly.com/u?_biz_u=721f930b3b62401caee7fbf5641ef162&_biz_s=298d4b&_biz_l=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F&_biz_t=1639603273324&_biz_i=TA551%20-%202021%20Threat%20Detection%20Report%20-%20Red%20Canary&a=redcanary.com&rnd=34876&cdn_o=a&_biz_z=1639603273324 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67C2) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 21:21:13 GMT last-modified Thu, 09 Dec 2021 23:57:22 GMT server ECS (frb/67C2) age 509031 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" cache-control no-cache, no-store accept-ranges bytes content-type Image/GIF content-length 43 expires -1
GET H2	200	adsct Show response analytics.twitter.com/i/	31 B 675 B	269ms 167ms	Script application/javascript	104.244.42.67 TWITTER
General Check archive.org Show headers Download Go to Full URL https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o015g&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=1d98ae5a-3079-4f0b-aca3-1d1cda4a1bbd&tw_document_href=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F&tpx_cb=twttr.conversion.loadPixels Requested by Host: static.ads-twitter.com URL: https://static.ads-twitter.com/uwt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.67 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf Security Headers Name Value Strict-Transport-Security max-age=631138519 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:13 GMT content-encoding gzip x-content-type-options nosniff p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" status 200 OK x-twitter-response-tags BouncerCompliant content-length 57 x-xss-protection 0 x-response-time 117 pragma no-cache last-modified Wed, 15 Dec 2021 21:21:13 GMT server tsa_o x-frame-options SAMEORIGIN strict-transport-security max-age=631138519 content-type application/javascript;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash a23eb5b879599446b04b9f9c18a784924066bf01068f68f2397f4b32e9e4e540 x-transaction 6e5a57097cd0d295 expires Tue, 31 Mar 1981 05:00:00 GMT
GET H2	200	select-arrow-dark.svg redcanary.com/wp-content/themes/redcanary/assets/img/	513 B 625 B	194ms 193ms	Image image/svg+xml	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/select-arrow-dark.svg Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_6128cb19e221c63c096daa16344aa339.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 3f91c89509ab3616612e079305566ea04991f4c63e5899192df1820407aaf0a7 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_6128cb19e221c63c096daa16344aa339.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:13 GMT content-encoding br last-modified Mon, 15 Mar 2021 14:30:44 GMT server nginx etag W/"604f6f94-201" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000
GET H2	200	form_checkbox_normal.svg redcanary.com/wp-content/themes/redcanary/assets/img/	477 B 591 B	189ms 189ms	Image image/svg+xml	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/form_checkbox_normal.svg Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_6128cb19e221c63c096daa16344aa339.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 814134e04a63caad8feeaeb95b36ba945aa3c200fa309efc4076e476ff267b98 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_6128cb19e221c63c096daa16344aa339.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:13 GMT content-encoding br last-modified Mon, 19 Apr 2021 23:05:04 GMT server nginx etag W/"607e0ca0-1dd" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000
GET H2	200	button-right-arrow-white.svg redcanary.com/wp-content/themes/redcanary/assets/img/	350 B 539 B	197ms 197ms	Image image/svg+xml	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/button-right-arrow-white.svg Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_6128cb19e221c63c096daa16344aa339.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 8edbf02936f4bbda931a228bd84f7b668522af07f3dfc33b5caee429e7febb85 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_6128cb19e221c63c096daa16344aa339.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:13 GMT content-encoding br last-modified Wed, 27 Feb 2019 15:51:05 GMT server nginx etag W/"5c76b1e9-15e" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000
GET H2	204	0 bat.bing.com/action/	0 150 B	78ms 78ms	Image text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=56383426&tm=gtm002&Ver=2&mid=5ed4a7be-07bc-4185-88a0-b27056cb4046&sid=ee537b005dec11ecb7dd39dbc720a4c2&vid=ee5367c05dec11ec9ec84f2af2ad13a7&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=TA551%20-%202021%20Threat%20Detection%20Report%20-%20Red%20Canary&p=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F&r=&lt=2152&evt=pageLoad&msclkid=N&sv=1&rn=326408 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 21:21:12 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 5D35BEB105A54DAAB944519BF8EFDA0A Ref B: FRAEDGE1415 Ref C: 2021-12-15T21:21:13Z x-cache CONFIG_NOCACHE access-control-allow-origin * cache-control no-cache, must-revalidate expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	rp.gif alb.reddit.com/	42 B 125 B	414ms 159ms	Image image/gif	151.101.193.140 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://alb.reddit.com/rp.gif?ts=1639603273379&id=t2_5kac730w&event=PageVisit&m.itemCount=&m.value=&m.currency=&m.transactionId=&m.customEventName=&uuid=f9c46262-4b50-4c6b-9608-49b402f03741&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_5b7866e3 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.193.140 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:13 GMT via 1.1 varnish server Varnish accept-ranges bytes content-length 42 retry-after 0 content-type image/gif
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/	2 KB 2 KB	266ms 94ms	Script text/javascript	2a00:1450:4001:829::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/?random=1639603273382&cv=9&fst=1639603273382&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgc10&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F&tiba=TA551%20-%202021%20Threat%20Detection%20Report%20-%20Red%20Canary&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash eebb9fb42dc82a4d977920a521281e6ac7c38572a1ea1f1ee96a3dd2a61faa01 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 21:21:13 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1038 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	x.svg redcanary.com/wp-content/themes/redcanary/assets/img/	548 B 646 B	193ms 193ms	Image image/svg+xml	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/x.svg Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_6128cb19e221c63c096daa16344aa339.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash fa88de55ea55bea66f8f19898817e50b08ed956d9c288f9b52f90df76ab655d3 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_6128cb19e221c63c096daa16344aa339.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:13 GMT content-encoding br last-modified Mon, 23 Aug 2021 16:46:07 GMT server nginx etag W/"6123d0cf-224" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000
GET H2	200	XDFrame Show response resource.redcanary.com/index.php/form/ Frame 3295	2 KB 865 B	222ms 221ms	Document text/html	104.17.73.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/index.php/form/XDFrame Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1b12ee272c79786bc266207f27c98ed219d2090d0d605e9c7a9e71f2add176fa Security Headers Name Value X-Content-Type-Options nosniff Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ Response headers date Wed, 15 Dec 2021 21:21:13 GMT content-type text/html; charset=utf-8 cache-control max-age=3600 x-content-type-options nosniff vary Accept-Encoding cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 6be2b86b1ad4433f-FRA content-encoding gzip
GET H2	200	healthcheck Show response pagestates-tracking.crazyegg.com/ Frame 110E	19 B 420 B	195ms 52ms	XHR binary/octet-stream	143.204.98.81 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://pagestates-tracking.crazyegg.com/healthcheck Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/11.1.376.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.81 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-81.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 12 Oct 2021 06:41:36 GMT via 1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront) last-modified Tue, 05 Oct 2021 13:53:30 GMT server AmazonS3 age 5582378 etag "d06f04fccf68d0b228a5923187ce1afd" access-control-max-age 31536000 access-control-allow-methods GET, HEAD content-type binary/octet-stream access-control-allow-origin * x-cache Hit from cloudfront x-amz-cf-pop FRA50-C1 accept-ranges bytes content-length 19 x-amz-cf-id u-8tmQUm4xoebpFXWiFzcTZpSlAa5VwZ_jorAIoudU3Qa9BJCqwBcA==
GET H2	200	healthcheck Show response assets-tracking.crazyegg.com/ Frame 110E	19 B 419 B	233ms 48ms	XHR binary/octet-stream	143.204.98.57 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://assets-tracking.crazyegg.com/healthcheck Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/11.1.376.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.57 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-57.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 12 Oct 2021 06:41:36 GMT via 1.1 58bcd6f2e1bc29fb83f080f1743cfeca.cloudfront.net (CloudFront) last-modified Tue, 05 Oct 2021 13:53:30 GMT server AmazonS3 age 5582378 etag "d06f04fccf68d0b228a5923187ce1afd" access-control-max-age 31536000 access-control-allow-methods GET, HEAD content-type binary/octet-stream access-control-allow-origin * x-cache Hit from cloudfront x-amz-cf-pop FRA50-C1 accept-ranges bytes content-length 19 x-amz-cf-id IwHLpWWbotMUDo2jb-2hU7sSc5GxQp9F9MgoKn92o3KHm1pdwYZIAQ==
GET H/1.1	200 OK	getuidj Show response secure.adnxs.com/	11 B 691 B	424ms 281ms	XHR application/json	37.252.173.22 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.173.22 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.17.9 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Pragma no-cache Date Wed, 15 Dec 2021 21:21:13 GMT X-Proxy-Origin 185.213.155.164; 185.213.155.164; 536.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com AN-X-Request-Uuid ef1ee952-0cfe-4419-aa03-fb7f9c89ca88 Server nginx/1.17.9 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://redcanary.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 11 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H/1.1	200 OK	/ Show response c.6sc.co/	47 B 369 B	169ms 50ms	XHR text/plain	104.111.233.140 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-140.deploy.static.akamaitechnologies.com Software / Resource Hash 48215acae852563453b332989d957a97563342a3fde94aa84cc68fe9a2f9fabd Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 21:21:13 GMT Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type text/plain Access-Control-Allow-Origin https://redcanary.com Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Content-Length 47
GET H/1.1	200 OK	getuidj Show response secure.adnxs.com/	11 B 691 B	191ms 50ms	XHR application/json	37.252.173.22 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.173.22 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.17.9 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Pragma no-cache Date Wed, 15 Dec 2021 21:21:13 GMT X-Proxy-Origin 185.213.155.164; 185.213.155.164; 536.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com AN-X-Request-Uuid 2d499b69-d9b6-4478-a7b4-2bfb83688e23 Server nginx/1.17.9 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://redcanary.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 11 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H/1.1	200 OK	/ Show response c.6sc.co/	47 B 369 B	168ms 51ms	XHR text/plain	104.111.233.140 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-140.deploy.static.akamaitechnologies.com Software / Resource Hash 48215acae852563453b332989d957a97563342a3fde94aa84cc68fe9a2f9fabd Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 21:21:13 GMT Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type text/plain Access-Control-Allow-Origin https://redcanary.com Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Content-Length 47
GET H2	200	/ www.facebook.com/tr/	44 B 295 B	151ms 49ms	Image image/gif	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=1042590016249604&ev=PageView&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F&rl=&if=false&ts=1639603273461&sw=1600&sh=1200&v=2.9.48&r=stable&ec=0&o=30&fbp=fb.1.1639603273460.711745203&it=1639603273105&coo=false&exp=p1&rqm=GET Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:13 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 44 expires Wed, 15 Dec 2021 21:21:13 GMT
GET H2	200	xdc.js Show response cdn.bizible.com/	116 B 524 B	162ms 161ms	Script text/javascript	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/xdc.js?_biz_u=721f930b3b62401caee7fbf5641ef162&_biz_h=-1906410348&cdn_o=a&jsVer=4.21.11.30&a=redcanary.com Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6711) / Resource Hash 518b5ca7b451363e2b3b46d9521db96afff3c153ad9294b7fe99e80c64225b87 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:13 GMT content-encoding gzip server ECS (frb/6711) etag 7FC17E74 vary Accept-Encoding p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" cache-control private, must-revalidate, max-age=21600 content-type text/javascript; charset=utf-8 content-length 218
GET BLOB	200 OK	b7319316-6c44-4d09-b4ba-45093bea58f8 https://redcanary.com/	53 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://redcanary.com/b7319316-6c44-4d09-b4ba-45093bea58f8 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 8ff09cd0ee012fe06ed1b67dc914858cde819f21bb479f629994d9e49f3c0049 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Length 53 Content-Type text/javascript
GET H2	200	u cdn.bizible.com/m/	43 B 121 B	49ms 49ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/m/u?mapType=mkto&mapValue=id%3A003-YRU-314%26token%3A_mch-redcanary.com-1639603272688-17224&_biz_u=721f930b3b62401caee7fbf5641ef162&_biz_s=298d4b&_biz_l=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F&_biz_t=1639603273325&_biz_i=TA551%20-%202021%20Threat%20Detection%20Report%20-%20Red%20Canary&_biz_n=1&a=redcanary.com&rnd=328675&cdn_o=a&_biz_z=1639603273466 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6776) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 21:21:13 GMT last-modified Thu, 09 Dec 2021 23:59:02 GMT server ECS (frb/6776) age 508931 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" cache-control no-cache, no-store accept-ranges bytes content-type Image/GIF content-length 43 expires -1
POST H2	200	admin-ajax.php Show response redcanary.com/wp-admin/	0 638 B	622ms 621ms	XHR text/html	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-admin/admin-ajax.php Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / WP Engine Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests, upgrade-insecure-requests Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff, nosniff X-Frame-Options SAMEORIGIN, deny X-Xss-Protection 1; mode=block Request headers Accept */* Referer https://redcanary.com/threat-detection-report/threats/ta551/ X-Requested-With XMLHttpRequest Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers content-security-policy upgrade-insecure-requests, upgrade-insecure-requests x-content-type-options nosniff, nosniff x-permitted-cross-domain-policies master-only x-powered-by WP Engine vary X-NR-SAMPLE-PERCENT,User-Agent content-length 0 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin, strict-origin-when-cross-origin server nginx x-frame-options SAMEORIGIN, deny date Wed, 15 Dec 2021 21:21:14 GMT strict-transport-security max-age=63072000 content-type text/html; charset=UTF-8 access-control-allow-origin https://redcanary.com cache-control no-cache, must-revalidate, max-age=0, no-store feature-policy microphone 'none'; geolocation 'none' access-control-allow-credentials true x-robots-tag noindex expires Wed, 11 Jan 1984 05:00:00 GMT
GET H2	200	cta-background.jpg redcanary.com/wp-content/uploads/2018/12/	7 KB 7 KB	159ms 158ms	Image image/jpeg	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2018/12/cta-background.jpg Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash ecf6782eee74878f85da64d073a0707c4965f712d7eec6926ea4c9151228e100 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/threat-detection-report/threats/ta551/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:13 GMT last-modified Mon, 09 Nov 2020 21:51:33 GMT server nginx etag "5fa9b9e5-1a18" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000 accept-ranges bytes content-length 6680
GET H2	200	Forrester-Wave-Featured-Nav-13.jpg redcanary.com/wp-content/uploads/2021/04/	72 KB 72 KB	165ms 164ms	Image image/jpeg	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2021/04/Forrester-Wave-Featured-Nav-13.jpg Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash a91510843d20a6601374a6ccf9285f945f081c40b32326a46e0e42aaac29cc4f Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/threat-detection-report/threats/ta551/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:13 GMT last-modified Wed, 14 Apr 2021 01:25:14 GMT server nginx etag "6076447a-11ffd" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000 accept-ranges bytes content-length 73725
GET H2	200	white-globe-hero-975x975.jpg redcanary.com/wp-content/uploads/2019/11/	70 KB 70 KB	165ms 164ms	Image image/jpeg	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2019/11/white-globe-hero-975x975.jpg Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash bc88f24a44df1a5564513838b882c1028a90f2bb480d1101011900f85c0c33f5 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/threat-detection-report/threats/ta551/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:13 GMT last-modified Mon, 09 Nov 2020 21:30:52 GMT server nginx etag "5fa9b50c-117ab" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000 accept-ranges bytes content-length 71595
GET H2	200	header_tdr21_6.jpg redcanary.com/wp-content/uploads/2020/01/	265 KB 265 KB	194ms 194ms	Image image/jpeg	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2020/01/header_tdr21_6.jpg Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 1181dab85ce1a136c17242d64bc815e8e9d122ae21df42ed0efb164eba893f37 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/threat-detection-report/threats/ta551/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:13 GMT last-modified Fri, 19 Mar 2021 15:30:32 GMT server nginx etag "6054c398-42365" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000 accept-ranges bytes content-length 271205
GET H2	200	spotify-logo-black-8-01.svg redcanary.com/wp-content/uploads/2021/03/	898 B 777 B	195ms 194ms	Image image/svg+xml	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2021/03/spotify-logo-black-8-01.svg Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 24a9979fff20ad59cba9b4a38af6fba8903c482fa2c390e2f0e82c97a649da98 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/threat-detection-report/threats/ta551/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:13 GMT content-encoding br last-modified Mon, 29 Mar 2021 15:22:29 GMT server nginx etag W/"6061f0b5-382" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000
OPTIONS H2	200	events gew1-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame	0 0	285ms 62ms	Preflight	2600:1901:1:5ca:: GOOGLE
General Check archive.org Show headers Download Go to Full URL https://gew1-spclient.spotify.com/gabo-receiver-service/public/v3/events Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:1:5ca:: , United States, ASN15169 (GOOGLE, US), Reverse DNS Software envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers content-type Origin https://open.spotify.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers access-control-allow-origin * access-control-allow-headers Accept, Authorization, Origin, Content-Type, Spotify-App-Version, App-Platform, X-Spotify-Connection-Id, X-Client-Id, X-Spotify-Quicksilver-Uri, client-token, content-access-token, x-cloud-trace-context access-control-allow-methods GET, POST, OPTIONS, PUT, DELETE, PATCH access-control-allow-credentials true access-control-max-age 604800 content-length 0 strict-transport-security max-age=31536000 x-content-type-options nosniff date Wed, 15 Dec 2021 21:21:13 GMT server envoy via HTTP/2 edgeproxy, 1.1 google alt-svc clear
GET H2	200	get_access_token Show response open.spotify.com/ Frame B9D7	188 B 441 B	86ms 85ms	Fetch application/json	2600:1901:1:c36:: GOOGLE
General Check archive.org Show headers Download Go to Full URL https://open.spotify.com/get_access_token?reason=transport&productType=embed Requested by Host: open.scdn.co URL: https://open.scdn.co/cdn/build/embed/vendor~embed.6f1259a6.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:1:c36:: , United States, ASN15169 (GOOGLE, US), Reverse DNS Software envoy / Resource Hash e4269aaeeb1778135ac2f00317a43a037f406980f7f030d9c01ea41f025a90cf Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers accept application/json Referer https://open.spotify.com/embed/track/3M8FzayQWtkvOhqMn2V4T2?si=UvSr69afRG6R5wTzLR_Yiw Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers sp-trace-id ad4ea68d8c7972fd date Wed, 15 Dec 2021 21:21:13 GMT content-encoding gzip x-content-type-options nosniff spotify-request-id 715b3bfb-1b81-46da-9a9d-9b514fd78ce5 vary Accept-Encoding,Accept-Encoding content-type application/json; charset=utf-8 via HTTP/2 edgeproxy, 1.1 google strict-transport-security max-age=31536000 alt-svc clear server envoy x-join-the-band https://www.spotify.com/jobs/
POST H2	200	events Show response gew1-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame B9D7	13 B 139 B	82ms 82ms	Fetch application/json	2600:1901:1:5ca:: GOOGLE
General Check archive.org Show headers Download Go to Full URL https://gew1-spclient.spotify.com/gabo-receiver-service/public/v3/events Requested by Host: open.scdn.co URL: https://open.scdn.co/cdn/build/embed/vendor~embed.6f1259a6.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:1:5ca:: , United States, ASN15169 (GOOGLE, US), Reverse DNS Software envoy / Resource Hash debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://open.spotify.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 content-type application/json Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff server envoy access-control-allow-headers Accept, Authorization, Origin, Content-Type, Spotify-App-Version, App-Platform, X-Spotify-Connection-Id, X-Client-Id, X-Spotify-Quicksilver-Uri, client-token, content-access-token, x-cloud-trace-context date Wed, 15 Dec 2021 21:21:13 GMT access-control-max-age 604800 access-control-allow-methods GET, POST, OPTIONS, PUT, DELETE, PATCH content-type application/json access-control-allow-origin * cache-control private, max-age=0 access-control-allow-credentials true alt-svc clear content-length 39 via HTTP/2 edgeproxy, 1.1 google
GET H2	200	clarity.js Show response e.clarity.ms/s/0.6.30/	52 KB 22 KB	425ms 138ms	Script application/javascript	20.62.48.180 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://e.clarity.ms/s/0.6.30/clarity.js Requested by Host: bat.bing.com URL: https://bat.bing.com/p/action/56383426.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 20.62.48.180 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash c763a7b86f4b8e21741d95bf307b2932555a20d4ad383adc764c99fdbb8e88d8 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:13 GMT content-encoding br etag "1d7ed4598a2cbb1" last-modified Thu, 09 Dec 2021 21:42:00 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET vary Accept-Encoding content-type application/javascript;charset=utf-8 cache-control public,max-age=86400 accept-ranges bytes request-context appId=cid-v1:bdfb7149-d2ee-45f0-9a22-f0b1c5035608
GET H2	200	c.gif c.clarity.ms/ Redirect Chain https://c.clarity.ms/c.gif https://c.bing.com/c.gif?CtsSyncId=BCEEB3DB0688448899F1E3D570090C68&RedC=c.clarity.ms&MXFR=066DA29CF0A368E73277B392F4A366F5 https://c.clarity.ms/c.gif?CtsSyncId=BCEEB3DB0688448899F1E3D570090C68&MUID=193EC021E6196FC51BCAD12FE7726E28	42 B 368 B	65ms 65ms	Image image/gif	52.142.114.2 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://c.clarity.ms/c.gif?CtsSyncId=BCEEB3DB0688448899F1E3D570090C68&MUID=193EC021E6196FC51BCAD12FE7726E28 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Server 52.142.114.2 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 21:21:13 GMT last-modified Fri, 05 Nov 2021 17:19:23 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET etag "f95a3e4769d2d71:0" p3p CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" cache-control private, no-cache, proxy-revalidate, no-store accept-ranges bytes content-type image/gif content-length 42 Redirect headers pragma no-cache date Wed, 15 Dec 2021 21:21:13 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 6ADE9F9A153342EA900EBE676899223A Ref B: FRAEDGE1415 Ref C: 2021-12-15T21:21:13Z x-powered-by ASP.NET x-cache CONFIG_NOCACHE p3p CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" location https://c.clarity.ms/c.gif?CtsSyncId=BCEEB3DB0688448899F1E3D570090C68&MUID=193EC021E6196FC51BCAD12FE7726E28 cache-control private, no-cache, proxy-revalidate, no-store content-length 0
POST H2	200	events Show response gew1-spclient.spotify.com/gabo-receiver-service/v3/ Frame B9D7	13 B 106 B	118ms 117ms	Fetch application/json	2600:1901:1:5ca:: GOOGLE
General Check archive.org Show headers Download Go to Full URL https://gew1-spclient.spotify.com/gabo-receiver-service/v3/events Requested by Host: open.scdn.co URL: https://open.scdn.co/cdn/build/embed/vendor~embed.6f1259a6.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:1:5ca:: , United States, ASN15169 (GOOGLE, US), Reverse DNS Software envoy / Resource Hash debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Referer https://open.spotify.com/ Accept-Language de-DE,de;q=0.9 authorization Bearer BQBc-sSCwG7h8hzeTpiR1w1roqfZDwAFasnUg65c2C4lwHn2CeRgGaLssUQVyJgtYuLIHWUoODVqpCZ2980 content-type application/json Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff server envoy access-control-allow-headers Accept, Authorization, Origin, Content-Type, Spotify-App-Version, App-Platform, X-Spotify-Connection-Id, X-Client-Id, X-Spotify-Quicksilver-Uri, client-token, content-access-token, x-cloud-trace-context date Wed, 15 Dec 2021 21:21:13 GMT access-control-max-age 604800 access-control-allow-methods GET, POST, OPTIONS, PUT, DELETE, PATCH content-type application/json access-control-allow-origin * cache-control private, max-age=0 access-control-allow-credentials true alt-svc clear content-length 39 via HTTP/2 edgeproxy, 1.1 google
OPTIONS H2	200	events gew1-spclient.spotify.com/gabo-receiver-service/v3/ Frame	0 0	192ms 61ms	Preflight	2600:1901:1:5ca:: GOOGLE
General Check archive.org Show headers Download Go to Full URL https://gew1-spclient.spotify.com/gabo-receiver-service/v3/events Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:1:5ca:: , United States, ASN15169 (GOOGLE, US), Reverse DNS Software envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://open.spotify.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers access-control-allow-origin * access-control-allow-headers Accept, Authorization, Origin, Content-Type, Spotify-App-Version, App-Platform, X-Spotify-Connection-Id, X-Client-Id, X-Spotify-Quicksilver-Uri, client-token, content-access-token, x-cloud-trace-context access-control-allow-methods GET, POST, OPTIONS, PUT, DELETE, PATCH access-control-allow-credentials true access-control-max-age 604800 content-length 0 strict-transport-security max-age=31536000 x-content-type-options nosniff date Wed, 15 Dec 2021 21:21:13 GMT server envoy via HTTP/2 edgeproxy, 1.1 google alt-svc clear
GET H2	200	forms2.min.js Show response resource.redcanary.com/js/forms2/js/ Frame 3295	205 KB 68 KB	59ms 58ms	Script application/x-javascript	104.17.73.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/js/forms2.min.js Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/index.php/form/XDFrame Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2689a0237a95cfd8135f8da3ac79c430e903f3c542f8b862f68141c84c348c43 Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://resource.redcanary.com/index.php/form/XDFrame User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:13 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT last-modified Tue, 12 Oct 2021 18:01:53 GMT server cloudflare age 1711 etag "3260414-33210-5ce2ba3f1c640" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=14400 cf-ray 6be2b86c8dbf433f-FRA expires Thu, 16 Dec 2021 01:21:13 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/759876114/	42 B 548 B	251ms 87ms	Image image/gif	2a00:1450:4001:80e::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/759876114/?random=1639603273382&cv=9&fst=1639602000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgc10&sendb=1&frm=0&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F&tiba=TA551%20-%202021%20Threat%20Detection%20Report%20-%20Red%20Canary&async=1&fmt=3&is_vtc=1&random=3824674779&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 21:21:13 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/759876114/	42 B 548 B	254ms 90ms	Image image/gif	2a00:1450:4001:813::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/759876114/?random=1639603273382&cv=9&fst=1639602000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgc10&sendb=1&frm=0&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F&tiba=TA551%20-%202021%20Threat%20Detection%20Report%20-%20Red%20Canary&async=1&fmt=3&is_vtc=1&random=3824674779&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 21:21:13 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	clock Show response tracking.crazyegg.com/ Frame 110E	29 B 136 B	256ms 77ms	XHR text/plain	34.255.166.68 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tracking.crazyegg.com/clock?t=1639603273680 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/11.1.376.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.255.166.68 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-255-166-68.eu-west-1.compute.amazonaws.com Software awselb/2.0 / Resource Hash 60cf8b0f32518f70d8d8c0d5c7e7b4dd564ab87f0ebb91502df28ee26b624d7c Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers access-control-allow-origin * date Wed, 15 Dec 2021 21:21:13 GMT cache-control no-store server awselb/2.0 content-length 29 content-type text/plain
GET H2	200	sf5.js Show response sfc.leadspace.com/	193 KB 194 KB	54ms 54ms	Script application/javascript	35.190.114.154 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://sfc.leadspace.com/sf5.js Requested by Host: sfc.leadspace.com URL: https://sfc.leadspace.com/SmartForms.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.190.114.154 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 154.114.190.35.bc.googleusercontent.com Software UploadServer / Resource Hash cc94e55155661db6998eab90f7aff21dbfdc5ea25a4e0b397f31ce9ad48dceda Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 20:53:35 GMT age 1658 x-guploader-uploadid ADPycdv8ZE11jemgff6Kgrq9T_Br_CJRdRSC3b3WV1gSgkeIFFlw-R_-StdsMzg5NJPbiZzyj7T-WKReVq7ChFTkkWQ x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity alt-svc clear content-length 198138 last-modified Sun, 30 May 2021 06:36:45 GMT server UploadServer etag "5fdbd3e7c66bb82260a9333ec336418b" strict-transport-security max-age=31536000 x-goog-hash crc32c=US8pvA==, md5=X9vT58ZruCJgqTM+wzZBiw== x-goog-generation 1622356605283226 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=3600 x-goog-stored-content-length 198138 accept-ranges bytes content-type application/javascript expires Wed, 15 Dec 2021 21:53:35 GMT
GET BLOB	200 OK	bca8973c-75af-4535-9a64-b40b0219472c https://redcanary.com/	218 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://redcanary.com/bca8973c-75af-4535-9a64-b40b0219472c Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash d5df5360850650e6dbe5d1a12372e9bb12bd075bd314a9bcd53a8974a13c4b97 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Length 218 Content-Type text/javascript
POST H3	200	/ Show response www.facebook.com/tr/ Frame 1F5F	0 18 B	87ms 42ms	Document text/plain	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Upgrade-Insecure-Requests 1 Origin https://redcanary.com Content-Type application/x-www-form-urlencoded User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ Response headers content-type text/plain access-control-allow-origin https://redcanary.com access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin content-length 0 server proxygen-bolt alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 priority u=3,i date Wed, 15 Dec 2021 21:21:14 GMT
GET H2	200	TDR-2021-Threats-TA551-2-scaled.jpg redcanary.com/wp-content/uploads/2021/03/	80 KB 80 KB	150ms 149ms	Image image/jpeg	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2021/03/TDR-2021-Threats-TA551-2-scaled.jpg Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 96a45cae60f30ddf33021905105d178dce1b496cf1b6462012a8da781b7f507c Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/threat-detection-report/threats/ta551/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:14 GMT last-modified Fri, 05 Mar 2021 21:19:22 GMT server nginx etag "6042a05a-13f32" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000 accept-ranges bytes content-length 81714
GET H3	200	css fonts.googleapis.com/	2 KB 519 B	166ms 86ms	Stylesheet text/css	2a00:1450:4001:82f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Raleway Requested by Host: client URL: about:client Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash f2961ef025e9598bbc17229d642d373a9eb7feaa927ac1149a1bfc546d31caed Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 15 Dec 2021 20:16:08 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Wed, 15 Dec 2021 21:21:14 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 15 Dec 2021 21:21:14 GMT
POST H/1.1	200 OK	match Show response sfgw.leadspace.com/ip/	144 B 1 KB	201ms 201ms	XHR application/json	35.185.62.129 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://sfgw.leadspace.com/ip/match Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 35.185.62.129 North Charleston, United States, ASN15169 (GOOGLE, US), Reverse DNS 129.62.185.35.bc.googleusercontent.com Software Prod / Resource Hash 2e108723860b28798c05c393120faf70a669bb58fe3e506f6f86e0098f6a0b4c Security Headers Name Value Content-Security-Policy default-src 'self'; script-src 'unsafe-inline' https://*.leadspace.com https://www.gstatic.com https://www.googletagmanager.com https://www.google-analytics.com https://*.aptrinsic.com; img-src www.google-analytics.com https://*.leadspace.com https://*.aptrinsic.com; connect-src https://*.leadspace.com wss://*.leadspace.com https://*.aptrinsic.com https://*.google-analytics.com; frame-src https://*.leadspace.com; style-src 'unsafe-inline' https://*.leadspace.com https://fonts.googleapis.com https://web-sdk.aptrinsic.com; style-src-elem 'unsafe-inline' https://*.leadspace.com https://*.aptrinsic.com; frame-ancestors https://*.leadspace.com Strict-Transport-Security max-age=31536000; includeSubdomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept application/json Referer https://redcanary.com/ Authorization 360de60f-3edb-4ca3-a55f-a3762adf8653 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/json Response headers date Wed, 15 Dec 2021 21:21:15 GMT referrer-policy no-referrer server Prod vary Origin,Access-Control-Request-Method,Access-Control-Request-Headers,Origin content-type application/json access-control-allow-origin https://redcanary.com x-xss-protection 1; mode=block access-control-allow-credentials true content-security-policy default-src 'self'; script-src 'unsafe-inline' https://*.leadspace.com https://www.gstatic.com https://www.googletagmanager.com https://www.google-analytics.com https://*.aptrinsic.com; img-src www.google-analytics.com https://*.leadspace.com https://*.aptrinsic.com; connect-src https://*.leadspace.com wss://*.leadspace.com https://*.aptrinsic.com https://*.google-analytics.com; frame-src https://*.leadspace.com; style-src 'unsafe-inline' https://*.leadspace.com https://fonts.googleapis.com https://web-sdk.aptrinsic.com; style-src-elem 'unsafe-inline' https://*.leadspace.com https://*.aptrinsic.com; frame-ancestors https://*.leadspace.com strict-transport-security max-age=31536000; includeSubdomains content-length 144 x-content-type-options nosniff
OPTIONS H/1.1	200 OK	match sfgw.leadspace.com/ip/ Frame	0 0	937ms 249ms	Preflight	35.185.62.129 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://sfgw.leadspace.com/ip/match Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 35.185.62.129 North Charleston, United States, ASN15169 (GOOGLE, US), Reverse DNS 129.62.185.35.bc.googleusercontent.com Software Prod / Resource Hash Security Headers Name Value Content-Security-Policy default-src 'self'; script-src 'unsafe-inline' https://*.leadspace.com https://www.gstatic.com https://www.googletagmanager.com https://www.google-analytics.com https://*.aptrinsic.com; img-src www.google-analytics.com https://*.leadspace.com https://*.aptrinsic.com; connect-src https://*.leadspace.com wss://*.leadspace.com https://*.aptrinsic.com https://*.google-analytics.com; frame-src https://*.leadspace.com; style-src 'unsafe-inline' https://*.leadspace.com https://fonts.googleapis.com https://web-sdk.aptrinsic.com; style-src-elem 'unsafe-inline' https://*.leadspace.com https://*.aptrinsic.com; frame-ancestors https://*.leadspace.com Strict-Transport-Security max-age=31536000; includeSubdomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://redcanary.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers vary Origin,Access-Control-Request-Method,Access-Control-Request-Headers access-control-allow-origin https://redcanary.com access-control-allow-methods POST access-control-allow-headers authorization, content-type access-control-allow-credentials true access-control-max-age 1800 allow GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH content-length 0 date Wed, 15 Dec 2021 21:21:14 GMT server Prod content-security-policy default-src 'self'; script-src 'unsafe-inline' https://*.leadspace.com https://www.gstatic.com https://www.googletagmanager.com https://www.google-analytics.com https://*.aptrinsic.com; img-src www.google-analytics.com https://*.leadspace.com https://*.aptrinsic.com; connect-src https://*.leadspace.com wss://*.leadspace.com https://*.aptrinsic.com https://*.google-analytics.com; frame-src https://*.leadspace.com; style-src 'unsafe-inline' https://*.leadspace.com https://fonts.googleapis.com https://web-sdk.aptrinsic.com; style-src-elem 'unsafe-inline' https://*.leadspace.com https://*.aptrinsic.com; frame-ancestors https://*.leadspace.com x-xss-protection 1; mode=block x-content-type-options nosniff referrer-policy no-referrer strict-transport-security max-age=31536000; includeSubdomains
POST H2	204	collect Show response e.clarity.ms/	0 91 B	416ms 415ms	XHR text/plain	20.62.48.180 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://e.clarity.ms/collect Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 20.62.48.180 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept application/x-clarity-gzip Referer https://redcanary.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers access-control-allow-origin https://redcanary.com date Wed, 15 Dec 2021 21:21:14 GMT access-control-allow-credentials true server Microsoft-IIS/10.0 x-powered-by ASP.NET request-context appId=cid-v1:bdfb7149-d2ee-45f0-9a22-f0b1c5035608
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	354ms 223ms	Image image/gif	104.111.233.140 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=36bb1002af0b0000485cba613202000042512000&session=cdf35a5c-50f0-4e71-82d6-2e342298b845&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2015%20Dec%202021%2021%3A21%3A12%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22TA551%2C%20also%20known%20as%20Shathak%2C%20is%20a%20threat%20group%20that%20uses%20large-scale%20phishing%20campaigns%20to%20deliver%20additional%20malware%20payloads.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22TA551%20-%202021%20Threat%20Detection%20Report%20-%20Red%20Canary%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F&pageViewId=4b6d702e-86cf-4783-826c-b31a1e771d54&an_uid=0 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/threats/ta551/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-140.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 21:21:14 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Tue, 05 Oct 2021 22:17:52 GMT Server nginx/1.14.0 (Ubuntu) ETag "615ccf10-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	core Show response js.driftt.com/ Frame C1CA	2 KB 1 KB	175ms 175ms	Document text/html	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false Requested by Host: js.driftt.com URL: https://js.driftt.com/include/1639603500000/65zait4t5ws7.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 9866e1a6b0931899aed27def0df2f66496529a063697495c69e91a0b4c604888 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ Response headers content-type text/html; charset=utf-8 server nginx last-modified Tue, 14 Dec 2021 14:21:26 GMT x-amz-server-side-encryption AES256 x-amz-version-id ReCoSeP0ofcesPYN5RalkRrImRRXqHh8 access-control-allow-origin * access-control-allow-credentials true access-control-allow-methods GET, POST, OPTIONS access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip date Wed, 15 Dec 2021 21:21:14 GMT cache-control no-cache etag W/"1681096b18f37a28fcd4dd03770c3c92" vary Accept-Encoding x-cache RefreshHit from cloudfront via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-amz-cf-id xs-o-F8WPLxN6rio854pMEvx8Ls6Yj23qJcZDYVgo62TAdYqGMyIKg==
GET H2	200	chat Show response js.driftt.com/core/ Frame 4952	2 KB 1 KB	182ms 182ms	Document text/html	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 Requested by Host: js.driftt.com URL: https://js.driftt.com/include/1639603500000/65zait4t5ws7.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 9866e1a6b0931899aed27def0df2f66496529a063697495c69e91a0b4c604888 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ Response headers content-type text/html; charset=utf-8 server nginx last-modified Tue, 14 Dec 2021 14:21:26 GMT x-amz-server-side-encryption AES256 x-amz-version-id ReCoSeP0ofcesPYN5RalkRrImRRXqHh8 access-control-allow-origin * access-control-allow-credentials true access-control-allow-methods GET, POST, OPTIONS access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip date Wed, 15 Dec 2021 21:21:14 GMT cache-control no-cache etag W/"1681096b18f37a28fcd4dd03770c3c92" vary Accept-Encoding x-cache RefreshHit from cloudfront via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-amz-cf-id eE_RMgn0UdGQ5fbfrPJXpEyaLqdaW_Ju1D1CE7I74BlCiCy2gTzl7Q==
GET H3	200	analytics.js Show response www.google-analytics.com/	49 KB 20 KB	161ms 77ms	Script text/javascript	2a00:1450:4001:80f::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Tue, 02 Nov 2021 17:39:06 GMT server Golfe2 age 6380 date Wed, 15 Dec 2021 19:34:54 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20006 expires Wed, 15 Dec 2021 21:34:54 GMT
GET H2	200	details Show response epsilon.6sense.com/v3/company/	833 B 667 B	166ms 61ms	XHR application/json	52.57.193.241 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.57.193.241 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-57-193-241.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 9fca2b6d4ccf2c83c42292907a93acfd52aab1146e17be95ee331521b8ac5862 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Referer https://redcanary.com/ Accept-Language de-DE,de;q=0.9 Authorization Token 5056c3929c3198270386ced81b434006bcef81be EpsilonCookie 36bb1002af0b0000485cba613202000042512000 Response headers date Wed, 15 Dec 2021 21:21:14 GMT content-encoding gzip server nginx vary Accept-Encoding content-type application/json access-control-allow-origin https://redcanary.com access-control-allow-credentials true content-length 484
OPTIONS H2	200	details epsilon.6sense.com/v3/company/ Frame	0 0	235ms 50ms	Preflight	52.57.193.241 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.57.193.241 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-57-193-241.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Method GET Access-Control-Request-Headers authorization,epsiloncookie Origin https://redcanary.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers date Wed, 15 Dec 2021 21:21:14 GMT server nginx access-control-allow-origin https://redcanary.com access-control-allow-credentials true access-control-max-age 1800 access-control-allow-methods OPTIONS,GET access-control-allow-headers authorization,epsiloncookie
GET H2	200	runtime~main.b5231fdb.js Show response js.driftt.com/core/assets/js/ Frame C1CA	6 KB 3 KB	48ms 47ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 4497e8022e1a35c31ceb2f26213d77fef26de39398dfca2d5f6fda971149b1ce Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false Origin https://js.driftt.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 14:21:25 GMT content-encoding gzip age 111589 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 13 Dec 2021 22:15:55 GMT server nginx etag W/"014bd97619cc8582278700d0a77d6d98" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id GeeuvCj73tfrNARWJpRIp1y79WlKyrds via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id Sc9CF42khXL1RQxUFLOOdhBMCglB0ttq5HS1OAeK7p6mgYGDoTLlCA==
GET H2	200	4.a93e53d9.chunk.js Show response js.driftt.com/core/assets/js/ Frame C1CA	58 KB 20 KB	54ms 53ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/4.a93e53d9.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 58332a4cc75a697eafeb1b4d9cb66326d6a29acb2f98afc1de3f1ef2401be056 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false Origin https://js.driftt.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Fri, 06 Aug 2021 19:32:17 GMT content-encoding gzip age 11324937 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 06 Aug 2021 18:47:25 GMT server nginx etag W/"fce0b3daf28dfa888be2818f43b06ef0" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id imvxQz4ZQnCekVetyHrX84xCYV8ndGWZ via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id PmLbgFHv4PNQ1YkSruRHqeuzc5_oAO4uGJunWcWTJd6Kj4gFea0v-Q==
GET H2	200	main~493df0b3.580db5ef.chunk.js Show response js.driftt.com/core/assets/js/ Frame C1CA	6 KB 3 KB	56ms 56ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/main~493df0b3.580db5ef.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 52997a640c38c5915b6105ad464bf2bf8121f3fe40c72d70791f54c4be95971a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false Origin https://js.driftt.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 25 Oct 2021 06:03:57 GMT content-encoding gzip age 4461437 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 22 Oct 2021 17:07:00 GMT server nginx etag W/"9b4aab2d855603fa59a09f8160eb7cb4" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id SHbjo2Z875cq.BpS9ven0n3hNF1FVxPh via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id G6AFxoaEtxxrdEKECSBKvkO2b0qk8voUhRBV8OoQd3BTJlyWmqpmsw==
GET H2	200	runtime~main.b5231fdb.js Show response js.driftt.com/core/assets/js/ Frame 4952	6 KB 3 KB	56ms 56ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 4497e8022e1a35c31ceb2f26213d77fef26de39398dfca2d5f6fda971149b1ce Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 Origin https://js.driftt.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 14:21:25 GMT content-encoding gzip age 111589 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 13 Dec 2021 22:15:55 GMT server nginx etag W/"014bd97619cc8582278700d0a77d6d98" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id GeeuvCj73tfrNARWJpRIp1y79WlKyrds via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 1o2Eff5ekdezImMz_xTXIVkwB89yXORjsyXjGQ0cpqhiTaiViE2xNg==
GET H2	200	4.a93e53d9.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4952	58 KB 20 KB	62ms 62ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/4.a93e53d9.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 58332a4cc75a697eafeb1b4d9cb66326d6a29acb2f98afc1de3f1ef2401be056 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 Origin https://js.driftt.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Fri, 06 Aug 2021 19:32:17 GMT content-encoding gzip age 11324937 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 06 Aug 2021 18:47:25 GMT server nginx etag W/"fce0b3daf28dfa888be2818f43b06ef0" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id imvxQz4ZQnCekVetyHrX84xCYV8ndGWZ via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id AP4Skl6jjs4Qjnf3EqEyJk2VcoI29vZli-rb-6CjAe-Y-lgJ0d8IUQ==
GET H2	200	main~493df0b3.580db5ef.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4952	6 KB 3 KB	65ms 65ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/main~493df0b3.580db5ef.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 52997a640c38c5915b6105ad464bf2bf8121f3fe40c72d70791f54c4be95971a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 Origin https://js.driftt.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 25 Oct 2021 06:03:57 GMT content-encoding gzip age 4461437 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 22 Oct 2021 17:07:00 GMT server nginx etag W/"9b4aab2d855603fa59a09f8160eb7cb4" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id SHbjo2Z875cq.BpS9ven0n3hNF1FVxPh via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id vt5UdU23lQ0xY63wl9hb03dGi4PZy5fSne3SSXpTEINQZxtrBVZbDQ==
GET H3	200	js Show response www.google-analytics.com/gtm/	89 KB 35 KB	105ms 105ms	Script application/javascript	2a00:1450:4001:80f::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/gtm/js?id=GTM-KJTKFT3&t=gtm10&cid=1216066355.1639603273 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash bdbb9af19a116e87165330e10ef2fcdf83d3e132b30e507e78cb30db9ad7b5f7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:14 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 36046 x-xss-protection 0 last-modified Wed, 15 Dec 2021 21:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 15 Dec 2021 21:21:14 GMT
GET H2	200	42.3b1c2441.chunk.js Show response js.driftt.com/core/assets/js/ Frame C1CA	47 KB 14 KB	54ms 54ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 7727399fe5d8441829176e6a661b540efaac1680120a1d7fb1235e258d70770b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 01 Nov 2021 02:54:58 GMT content-encoding gzip age 3867976 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 29 Oct 2021 20:21:08 GMT server nginx etag W/"62fe06940598a98760a9eae46800ff59" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id ZvrGZ__CENehO4yWRJghqJAjDXfkpDfG via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id mnRs_oI7FQjFSqdnuo6fJBFoPWuU3TvYUYNauApKhR-gXsgJdbmCnQ==
GET H2	200	17.cce21c2a.chunk.js Show response js.driftt.com/core/assets/js/ Frame C1CA	44 KB 13 KB	59ms 59ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/17.cce21c2a.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash cda9b31d709444e003d3adbfbdec43f093e405b36841fde5c1d187e439585219 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 01 Nov 2021 02:54:58 GMT content-encoding gzip age 3867976 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 29 Oct 2021 20:21:07 GMT server nginx etag W/"565bf690dc82ce7e1f45c9647d892490" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id V1tQBeNhHuSP3Kq4PFVzDyqDvIlj_GeG via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id ugsHiVNo_2_f-J_OJSwkhchrmNgG3O88sMbhRXI5vX_gp7_ecQQjMQ==
GET H2	200	35.3e4eba7e.chunk.js Show response js.driftt.com/core/assets/js/ Frame C1CA	25 KB 8 KB	62ms 62ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/35.3e4eba7e.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 41f7afd6088c39cdc0d6f910f7f4b6afbf6a2133533847e960a8ca906fabc1c6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 01 Nov 2021 18:08:30 GMT content-encoding gzip age 3813164 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 01 Nov 2021 17:24:57 GMT server nginx etag W/"b1a0f364c9ad5137b5ab8e5237a825b8" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id KfofLwvG14tKBpk6tXvFAfICf2R3Oaes via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id QooGRDvEAzjxASzaLX16XrH25CtI-OgDd6QcZxkrXC0lwBxYn26DFQ==
GET H2	200	15.8065fdbf.chunk.js Show response js.driftt.com/core/assets/js/ Frame C1CA	16 KB 5 KB	64ms 64ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/15.8065fdbf.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash f978da291f493e64d4420d2cfab5c2bdc736c53f11c8d61c6da1efdb7df1155d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 06 Sep 2021 06:18:05 GMT content-encoding gzip age 8694189 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 03 Sep 2021 14:38:32 GMT server nginx etag W/"db60664de2c8d54d23e359c94e68f6ce" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id vLMtFICr__AmVbpyC1134yZVvjJr6q0Q via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id gN3XBvxANr03TDOEB1O_7YiU7YP5jepffXs9QJB0bWK3YmPnmBX7Rg==
GET H2	200	19.5937a5b2.chunk.js Show response js.driftt.com/core/assets/js/ Frame C1CA	72 KB 22 KB	70ms 70ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/19.5937a5b2.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 2b4d9e531f3302ad49380ce5e5e160925956edb55179c63ee2bac32ab040d1a5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 01 Nov 2021 02:55:04 GMT content-encoding gzip age 3867970 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 29 Oct 2021 20:21:07 GMT server nginx etag W/"08aceb94bd26b0e431ca437d628e3c13" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id a9V2sG0hWPWT.cLrpxmLmJQEJHJ3pTch via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id fswXaplARwcDHnjvof7YgnaMq9lEgTTDJBCn1kc0HQ_kqm8N4d7Ovw==
GET H2	200	32.04864e7d.chunk.js Show response js.driftt.com/core/assets/js/ Frame C1CA	16 KB 6 KB	78ms 77ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/32.04864e7d.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash af0ad47815cfcb0fc8402cf431dd782af68f2ba05752c66d9bb11a4354f65754 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 25 Oct 2021 09:53:21 GMT content-encoding gzip age 4447673 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 22 Oct 2021 17:06:58 GMT server nginx etag W/"3b6707d602c1f7d03c4c8b0bdecb8e4e" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id juigjv2.842khaDjrzqiMoucoadLCjYk via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id kKPM-UoZl8mJbboIHpFH8a6EYh35cnH00_OlstPSKcTz6G7Qhi8fkg==
GET H2	200	23.a53d721f.chunk.js Show response js.driftt.com/core/assets/js/ Frame C1CA	59 KB 19 KB	88ms 88ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/23.a53d721f.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash f48829864ffd155da0360e19be956282b6875173f8990394e93bc7c30c97a3ed Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 30 Nov 2021 01:41:23 GMT content-encoding gzip age 1366790 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 29 Nov 2021 22:20:10 GMT server nginx etag W/"fe96cb8c4c390342c29d3c8cb0a4ca14" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id Bes4ojoExyGtogevsaG2vPPgIGz3MINt via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id pJ6lI1soj9ZbdjHZ4Y2Op0qxoCTFdDqtBrk3sU6TOQ2hnU622ZLQfA==
GET H2	200	10.704ab67c.chunk.js Show response js.driftt.com/core/assets/js/ Frame C1CA	91 KB 28 KB	92ms 92ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/10.704ab67c.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 1612e3d01a9389defe81c28b91ee18b7b1f97b54f39dd8aa651667c25bce28e2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Fri, 01 Oct 2021 20:47:44 GMT content-encoding gzip age 6482009 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 01 Oct 2021 18:06:47 GMT server nginx etag W/"50dcb170ca1ae1f4a09fe8f23065f2a8" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 8SLWCghXfnMEQiqJuVzEB4mWFfFgTeMA via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id VPBW9q6GMMWqQd7vw4Ggq6Hxt8kf8_NoFILdwpii2g_hidyvkIniiw==
GET H2	200	9.cea5327f.chunk.js Show response js.driftt.com/core/assets/js/ Frame C1CA	24 KB 7 KB	97ms 97ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/9.cea5327f.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash fb372bf086a350fc14b803de31af04857aaf0b0e18bf7de76737715efa2ce57f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 30 Nov 2021 15:01:38 GMT content-encoding gzip age 1318776 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 29 Nov 2021 22:20:12 GMT server nginx etag W/"2db4f74e4d7ffda350b50dde6a07ed5e" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id XO6Gj_y9Dw4LqhxSapA287FNAF2AYGBn via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id qTGsW-HOkBeMpMGftfqnYNn6WkF19Jwr9ZGPMupZhnkCAikgO6W-vw==
GET H2	200	13.c2156fc2.chunk.js Show response js.driftt.com/core/assets/js/ Frame C1CA	62 KB 20 KB	102ms 101ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/13.c2156fc2.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash f94ce8666bf003756c16b56edad5a0121b3516222d4f093bdb771afabfb2cc5f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 25 Oct 2021 09:53:21 GMT content-encoding gzip age 4447673 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 22 Oct 2021 17:06:58 GMT server nginx etag W/"b94404e76324bd4454531b2e0a54f7bb" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id UBqTGR_Kpp2cPp4uQTy5DkPbiTlHyHAU via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id kdDz6_P3n8N_XTQnGXX4ferlxvzgW_A1P66ziOop1dYdlX5ofag6UA==
GET H2	200	40.01f4f7b3.chunk.js Show response js.driftt.com/core/assets/js/ Frame C1CA	105 KB 34 KB	109ms 108ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/40.01f4f7b3.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 71f918c131027703d4692c7e7cc9d46fc09554fc2b211e60f12e8fea8360deb7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 25 Oct 2021 09:53:21 GMT content-encoding gzip age 4447673 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 22 Oct 2021 17:06:59 GMT server nginx etag W/"7dd9b27f83583b6d43567ed4b21eff8c" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 2QdQNwJ4SDmpUoZVr7HrkjjZUMt.Wzuw via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id dRHMLN5lj-1rv1MnSOa5auCoiNipXjmMg2UR3G1vIfT0D2HDHEy6Fw==
GET H2	200	33.c1910d43.chunk.js Show response js.driftt.com/core/assets/js/ Frame C1CA	12 KB 4 KB	122ms 121ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/33.c1910d43.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash c2d8b5ed5baf711d51629607797e32e5ff638637a0091598427eac4908dbae47 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 24 Nov 2021 03:18:04 GMT content-encoding gzip age 1879390 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 22 Nov 2021 19:33:19 GMT server nginx etag W/"0e451f1cf9656229ccd33dfa3ad0638d" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id bXdSjY9CDnekLor1Q.RFbiIDqi7ulpJa via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id LqnpvoFT5HzIMzhYW2MKGRQw5JlgwdcQID5JCkNCDEP1H2PbCw1TWg==
GET H2	200	25.b7a0bf53.chunk.js Show response js.driftt.com/core/assets/js/ Frame C1CA	12 KB 5 KB	122ms 121ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/25.b7a0bf53.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash c87e0e31334c6998b90c83d48eff6252a248120d32b376414965e1421203c901 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 24 Nov 2021 03:18:04 GMT content-encoding gzip age 1879390 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 22 Nov 2021 19:33:19 GMT server nginx etag W/"808f7c7829001881a39cef6846a36ce0" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id Q2g0zIRf_FIeqHbwx92fc3AdT0lCB1K6 via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 1BpO7MV1tp4zKsg8lmNQ3hZ-pUGL1lDHDonfgNRBaKGlaVE7IrMIxA==
GET H2	200	16.fab21cf4.chunk.js Show response js.driftt.com/core/assets/js/ Frame C1CA	17 KB 7 KB	123ms 123ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/16.fab21cf4.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash fa110ac06915e913fea0ad440e557cd75b95101504acc6a865efb5d7f0f34d95 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 04 Nov 2021 16:58:47 GMT content-encoding gzip age 3558147 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Wed, 03 Nov 2021 13:47:23 GMT server nginx etag W/"b451093ecfaa012f364641010ed13346" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id wCl6QNbYqV3zaB4E280GBYT.UNDnPeJC via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 2U_CahRKbM8p8XYlGSQnAPl4y3SL0jfoYgvIeSPExigTNiX6Be9kAw==
GET H2	200	7.30af169a.chunk.css js.driftt.com/core/assets/css/ Frame C1CA	11 KB 3 KB	124ms 123ms	Stylesheet text/css	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/7.30af169a.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 4a9b0b449b77fd3cf250284f9c232b20dd193d8c538f059350594bc865847da9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 01 Nov 2021 18:28:20 GMT content-encoding gzip age 3811974 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 01 Nov 2021 17:24:54 GMT server nginx etag W/"bd798c00af88b7523deb5a8065993250" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id i5VGTHkGJ3W10pB8.FdBO9KWoGwOWrOx via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id e1djuK4vs07o5YFmuBUw0RrdUwWlZm5psiBl41wsmjXP15Ubut1gbQ==
GET H2	200	7.892db701.chunk.js Show response js.driftt.com/core/assets/js/ Frame C1CA	69 KB 22 KB	134ms 134ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/7.892db701.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash a85e6cc00b6521151a066190dfa2f0983135171fbc1845b0acfe09fddb245a68 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 06 Dec 2021 16:07:51 GMT content-encoding gzip age 796403 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 06 Dec 2021 15:09:53 GMT server nginx etag W/"59ff575cde5cbc57af07ef742efe8a77" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 6L5P_vHWmZADGUWpRUkNwqrHbIkXu6n5 via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id GLpkg7yYxpJhWCJd48ZO8WTuCgELvnDVolzMvPvbNaA7rzvOa1OCEg==
GET H2	200	14.22abfce0.chunk.css js.driftt.com/core/assets/css/ Frame C1CA	24 B 667 B	136ms 136ms	Stylesheet text/css	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/14.22abfce0.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Fri, 06 Aug 2021 19:32:17 GMT via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) age 11324936 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront content-length 24 last-modified Fri, 06 Aug 2021 18:47:22 GMT server nginx etag "0c5dad92482d9a7c7c253510f5082465" strict-transport-security max-age=31536000; includeSubDomains access-control-allow-methods GET, POST, OPTIONS x-amz-version-id TvxaskXeU1vX5QWjGFtspdoYt.ZZ_9cE access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 accept-ranges bytes content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id aOJ38SiFTGTS_C9zYEYZ3RsU8hW3L12GUoF8AE1_rqZ_TdmkEinfDA==
GET H2	200	14.c25177a9.chunk.js Show response js.driftt.com/core/assets/js/ Frame C1CA	74 KB 19 KB	141ms 140ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/14.c25177a9.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash d3cf67b9a5c82810aad30bbe1e7213ebf0e45879501938a34acbd5a1b39b3773 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 09 Dec 2021 14:50:48 GMT content-encoding gzip age 541826 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Thu, 09 Dec 2021 14:08:21 GMT server nginx etag W/"18403c312bd271177d0f9589bf9f8e63" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id lOPAv9SDW_4LP.6rK6h_XISnbYxX1zW_ via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id VJLbQxbYIaY43IjJuTsQykI6mVG6ZfVmL3LVEGK6ezx7uAyEkGjuJA==
GET H2	200	20.ead2182b.chunk.js Show response js.driftt.com/core/assets/js/ Frame C1CA	47 KB 13 KB	145ms 145ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/20.ead2182b.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash acadd76a335e98061ef67610e2cc701027232396e26b593a2af78a6f027cef75 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 06 Dec 2021 16:07:51 GMT content-encoding gzip age 796403 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 06 Dec 2021 15:09:51 GMT server nginx etag W/"61892b29d94d646e4fe4c955206e953e" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id R.TDOsQ8XUx2f30jYVAP1aJfV9HUfplp via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id V8iA8fuV9aMSbdNmGwJywcyuhqQSakC_vuml3rkgYB100ePc5IC2Pw==
GET H2	200	12.5fc8721e.chunk.js Show response js.driftt.com/core/assets/js/ Frame C1CA	41 KB 13 KB	147ms 147ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/12.5fc8721e.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash d38c2d64e57da1a0cb467ef0cd7d85d2e841799ab839a579231300101ffa3840 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 14:21:25 GMT content-encoding gzip age 111589 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 13 Dec 2021 22:15:52 GMT server nginx etag W/"77b6063aad824ddaa4af9a2de2afca3d" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id YYKVfxhFGccZ5ywGIrKDAtKa86md0_CT via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id X4ie3mYZYhzM6NucHVGCf9_ytj31-HzUK8_uXsJQ2tgBo5OkWiqYjQ==
GET H2	200	42.3b1c2441.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4952	47 KB 14 KB	141ms 140ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 7727399fe5d8441829176e6a661b540efaac1680120a1d7fb1235e258d70770b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 01 Nov 2021 02:54:58 GMT content-encoding gzip age 3867976 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 29 Oct 2021 20:21:08 GMT server nginx etag W/"62fe06940598a98760a9eae46800ff59" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id ZvrGZ__CENehO4yWRJghqJAjDXfkpDfG via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id RmwUiMEZiZ_D0TiFwEIeHijW5NmotS-18atql7qE7YQTnXN4dHe9yA==
GET H2	200	17.cce21c2a.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4952	44 KB 13 KB	143ms 142ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/17.cce21c2a.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash cda9b31d709444e003d3adbfbdec43f093e405b36841fde5c1d187e439585219 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 01 Nov 2021 02:54:58 GMT content-encoding gzip age 3867976 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 29 Oct 2021 20:21:07 GMT server nginx etag W/"565bf690dc82ce7e1f45c9647d892490" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id V1tQBeNhHuSP3Kq4PFVzDyqDvIlj_GeG via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id PZnxJp8zi6qccv2TebG13NAzqGAMGgJSbGv9-J-gsQ4t6x-Hw6Kzig==
GET H2	200	35.3e4eba7e.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4952	25 KB 8 KB	143ms 142ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/35.3e4eba7e.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 41f7afd6088c39cdc0d6f910f7f4b6afbf6a2133533847e960a8ca906fabc1c6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 01 Nov 2021 18:08:30 GMT content-encoding gzip age 3813164 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 01 Nov 2021 17:24:57 GMT server nginx etag W/"b1a0f364c9ad5137b5ab8e5237a825b8" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id KfofLwvG14tKBpk6tXvFAfICf2R3Oaes via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id Nm1JSJ0_UoQVhH0te6YJec8dsSBO5O7K9K-1pbEXplRRT6N4fDLtKg==
GET H2	200	15.8065fdbf.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4952	16 KB 5 KB	144ms 143ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/15.8065fdbf.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash f978da291f493e64d4420d2cfab5c2bdc736c53f11c8d61c6da1efdb7df1155d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 06 Sep 2021 06:18:05 GMT content-encoding gzip age 8694189 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 03 Sep 2021 14:38:32 GMT server nginx etag W/"db60664de2c8d54d23e359c94e68f6ce" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id vLMtFICr__AmVbpyC1134yZVvjJr6q0Q via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 3mqGMEPYoMg7XreFHtWOYtkNaMRfxpx6cL9txhzCFZEH7y_R6eaEPA==
GET H2	200	19.5937a5b2.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4952	72 KB 22 KB	146ms 145ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/19.5937a5b2.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 2b4d9e531f3302ad49380ce5e5e160925956edb55179c63ee2bac32ab040d1a5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 01 Nov 2021 02:55:04 GMT content-encoding gzip age 3867970 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 29 Oct 2021 20:21:07 GMT server nginx etag W/"08aceb94bd26b0e431ca437d628e3c13" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id a9V2sG0hWPWT.cLrpxmLmJQEJHJ3pTch via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id W_nWAmhu1EgAq6Vselk5v5rdpz7YfpMlDNf1AHvMXF2A-AzSc7Jdng==
GET H2	200	32.04864e7d.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4952	16 KB 6 KB	147ms 146ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/32.04864e7d.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash af0ad47815cfcb0fc8402cf431dd782af68f2ba05752c66d9bb11a4354f65754 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 25 Oct 2021 09:53:21 GMT content-encoding gzip age 4447673 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 22 Oct 2021 17:06:58 GMT server nginx etag W/"3b6707d602c1f7d03c4c8b0bdecb8e4e" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id juigjv2.842khaDjrzqiMoucoadLCjYk via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id XT2Lj0oO7MeYsw4RbZuOjffL9CGz0EXjyFl2zAx8n76j0eEZ4B_bKQ==
GET H2	200	23.a53d721f.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4952	59 KB 19 KB	150ms 149ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/23.a53d721f.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash f48829864ffd155da0360e19be956282b6875173f8990394e93bc7c30c97a3ed Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 30 Nov 2021 01:41:23 GMT content-encoding gzip age 1366790 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 29 Nov 2021 22:20:10 GMT server nginx etag W/"fe96cb8c4c390342c29d3c8cb0a4ca14" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id Bes4ojoExyGtogevsaG2vPPgIGz3MINt via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 4CwZfZMYvMz-23ofmioUFCSuP3DRZVTA_L06V2y3zI_MNIFzIj5JhQ==
GET H2	200	10.704ab67c.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4952	91 KB 28 KB	154ms 152ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/10.704ab67c.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 1612e3d01a9389defe81c28b91ee18b7b1f97b54f39dd8aa651667c25bce28e2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Fri, 01 Oct 2021 20:47:44 GMT content-encoding gzip age 6482009 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 01 Oct 2021 18:06:47 GMT server nginx etag W/"50dcb170ca1ae1f4a09fe8f23065f2a8" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 8SLWCghXfnMEQiqJuVzEB4mWFfFgTeMA via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id daNsZ4DmPp6BLQTzXsRbheDSUN51RPuYvfNj4RJzVTzVU6lL--oPvw==
GET H2	200	9.cea5327f.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4952	24 KB 7 KB	160ms 159ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/9.cea5327f.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash fb372bf086a350fc14b803de31af04857aaf0b0e18bf7de76737715efa2ce57f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 30 Nov 2021 15:01:38 GMT content-encoding gzip age 1318776 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 29 Nov 2021 22:20:12 GMT server nginx etag W/"2db4f74e4d7ffda350b50dde6a07ed5e" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id XO6Gj_y9Dw4LqhxSapA287FNAF2AYGBn via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 8m_Ge5_ZTP4EX_Eiwp4cFDbqWCkrGPAlYsL97q60WGJlSyZpG3hubA==
GET H2	200	13.c2156fc2.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4952	62 KB 20 KB	161ms 160ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/13.c2156fc2.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash f94ce8666bf003756c16b56edad5a0121b3516222d4f093bdb771afabfb2cc5f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 25 Oct 2021 09:53:21 GMT content-encoding gzip age 4447673 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 22 Oct 2021 17:06:58 GMT server nginx etag W/"b94404e76324bd4454531b2e0a54f7bb" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id UBqTGR_Kpp2cPp4uQTy5DkPbiTlHyHAU via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id FWFctAXBpwft7N8S1_DcU89n-u6uGgtQrk4SoyuvX3fHMh98MC5EyA==
GET H2	200	40.01f4f7b3.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4952	105 KB 34 KB	163ms 162ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/40.01f4f7b3.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 71f918c131027703d4692c7e7cc9d46fc09554fc2b211e60f12e8fea8360deb7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 25 Oct 2021 09:53:21 GMT content-encoding gzip age 4447673 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 22 Oct 2021 17:06:59 GMT server nginx etag W/"7dd9b27f83583b6d43567ed4b21eff8c" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 2QdQNwJ4SDmpUoZVr7HrkjjZUMt.Wzuw via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id CcgEmJo7DSOyVm2OITPPhKfDshFWzc-MQsAP0Ywj2puCQRuInkV6Cw==
GET H2	200	33.c1910d43.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4952	12 KB 4 KB	167ms 165ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/33.c1910d43.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash c2d8b5ed5baf711d51629607797e32e5ff638637a0091598427eac4908dbae47 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 24 Nov 2021 03:18:04 GMT content-encoding gzip age 1879390 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 22 Nov 2021 19:33:19 GMT server nginx etag W/"0e451f1cf9656229ccd33dfa3ad0638d" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id bXdSjY9CDnekLor1Q.RFbiIDqi7ulpJa via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id sHOvYkxer5nC7-QmmaY6iBjdiYg5z6HQTrV4eITAPcHnftXLDDM4oA==
GET H2	200	25.b7a0bf53.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4952	12 KB 5 KB	167ms 166ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/25.b7a0bf53.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash c87e0e31334c6998b90c83d48eff6252a248120d32b376414965e1421203c901 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 24 Nov 2021 03:18:04 GMT content-encoding gzip age 1879390 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 22 Nov 2021 19:33:19 GMT server nginx etag W/"808f7c7829001881a39cef6846a36ce0" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id Q2g0zIRf_FIeqHbwx92fc3AdT0lCB1K6 via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id gxxCRjJGs0YLH1RzjESuiJx9ADLcuettq4PaBbIzZLhjAYO_vE8_fw==
GET H2	200	16.fab21cf4.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4952	17 KB 7 KB	170ms 169ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/16.fab21cf4.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash fa110ac06915e913fea0ad440e557cd75b95101504acc6a865efb5d7f0f34d95 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 04 Nov 2021 16:58:47 GMT content-encoding gzip age 3558147 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Wed, 03 Nov 2021 13:47:23 GMT server nginx etag W/"b451093ecfaa012f364641010ed13346" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id wCl6QNbYqV3zaB4E280GBYT.UNDnPeJC via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id mMZBKV2Cg6nerqamhfwsJYirDt6fUZwM032eCUSJvgJr7VztrzETBg==
GET H2	200	7.30af169a.chunk.css js.driftt.com/core/assets/css/ Frame 4952	11 KB 3 KB	168ms 167ms	Stylesheet text/css	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/7.30af169a.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 4a9b0b449b77fd3cf250284f9c232b20dd193d8c538f059350594bc865847da9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 01 Nov 2021 18:28:20 GMT content-encoding gzip age 3811974 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 01 Nov 2021 17:24:54 GMT server nginx etag W/"bd798c00af88b7523deb5a8065993250" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id i5VGTHkGJ3W10pB8.FdBO9KWoGwOWrOx via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 6xJYAq7xy4eneE48TGKQPbE3SMulnBvv-M2MxdLe2l4ZoUmACpKohg==
GET H2	200	7.892db701.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4952	69 KB 22 KB	174ms 173ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/7.892db701.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash a85e6cc00b6521151a066190dfa2f0983135171fbc1845b0acfe09fddb245a68 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 06 Dec 2021 16:07:51 GMT content-encoding gzip age 796403 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 06 Dec 2021 15:09:53 GMT server nginx etag W/"59ff575cde5cbc57af07ef742efe8a77" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 6L5P_vHWmZADGUWpRUkNwqrHbIkXu6n5 via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id hlQD57CajOj3nZZPCqCnrdeZStopMCfEmnEeSDncN9LO1OmkzWSNLw==
GET H2	200	14.22abfce0.chunk.css js.driftt.com/core/assets/css/ Frame 4952	24 B 667 B	175ms 174ms	Stylesheet text/css	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/14.22abfce0.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Fri, 06 Aug 2021 19:32:17 GMT via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) age 11324936 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront content-length 24 last-modified Fri, 06 Aug 2021 18:47:22 GMT server nginx etag "0c5dad92482d9a7c7c253510f5082465" strict-transport-security max-age=31536000; includeSubDomains access-control-allow-methods GET, POST, OPTIONS x-amz-version-id TvxaskXeU1vX5QWjGFtspdoYt.ZZ_9cE access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 accept-ranges bytes content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id u4Zv1A5_9Dspp4Ap4qB9UNHMDtM4g07z59MfZ73HjR8ys0S7kxREfw==
GET H2	200	14.c25177a9.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4952	74 KB 19 KB	178ms 178ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/14.c25177a9.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash d3cf67b9a5c82810aad30bbe1e7213ebf0e45879501938a34acbd5a1b39b3773 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 09 Dec 2021 14:50:48 GMT content-encoding gzip age 541826 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Thu, 09 Dec 2021 14:08:21 GMT server nginx etag W/"18403c312bd271177d0f9589bf9f8e63" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id lOPAv9SDW_4LP.6rK6h_XISnbYxX1zW_ via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 7Y5BRAj8vQNsm9FUJ9YrXKEwjqLYqPI3FaINOc7ij9cDrNWSUUihsQ==
GET H2	200	20.ead2182b.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4952	47 KB 13 KB	180ms 180ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/20.ead2182b.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash acadd76a335e98061ef67610e2cc701027232396e26b593a2af78a6f027cef75 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 06 Dec 2021 16:07:51 GMT content-encoding gzip age 796403 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 06 Dec 2021 15:09:51 GMT server nginx etag W/"61892b29d94d646e4fe4c955206e953e" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id R.TDOsQ8XUx2f30jYVAP1aJfV9HUfplp via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id tVFF2Z9aI_NCty7RxO08Gae8x9fyJJK-dMg5cMOSoOCiFJkveW8aYw==
GET H2	200	12.5fc8721e.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4952	41 KB 13 KB	182ms 182ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/12.5fc8721e.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash d38c2d64e57da1a0cb467ef0cd7d85d2e841799ab839a579231300101ffa3840 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 14:21:25 GMT content-encoding gzip age 111589 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 13 Dec 2021 22:15:52 GMT server nginx etag W/"77b6063aad824ddaa4af9a2de2afca3d" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id YYKVfxhFGccZ5ywGIrKDAtKa86md0_CT via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 7Fa4uOZvzsgLPgOZFUmuefhzkFcULu97jE-DF6S0B1eesgttrW1Tyw==
POST H3	200	collect Show response www.google-analytics.com/j/	2 B 22 B	90ms 89ms	XHR text/plain	2a00:1450:4001:80f::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j96&a=573675066&t=pageview&_s=1&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F&ul=en-us&de=UTF-8&dt=TA551%20-%202021%20Threat%20Detection%20Report%20-%20Red%20Canary&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aCDAAEADQAAAAC~&jid=1935532887&gjid=843209520&cid=1216066355.1639603273&tid=UA-52702906-1&_gid=1438966587.1639603275&_r=1&gtm=2wgc10PXWC8JW&cd18=null&z=1101249715 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://redcanary.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 15 Dec 2021 21:21:14 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://redcanary.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	analytics.js Show response www.google-analytics.com/	49 KB 20 KB	82ms 82ms	Script text/javascript	2a00:1450:4001:80f::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Tue, 02 Nov 2021 17:39:06 GMT server Golfe2 age 6380 date Wed, 15 Dec 2021 19:34:54 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20006 expires Wed, 15 Dec 2021 21:34:54 GMT
GET H2	200	22.e10510b6.chunk.js Show response js.driftt.com/core/assets/js/ Frame C1CA	42 KB 12 KB	77ms 77ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/22.e10510b6.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash b0257060098cdc51166f35b62e7dd8f0c5f8d6cfa319901c0c51a629537e02fd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Sun, 05 Dec 2021 03:00:11 GMT content-encoding gzip age 930063 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Thu, 02 Dec 2021 19:39:10 GMT server nginx etag W/"a99459752bee496e4af7c45277fd9c26" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id .p1WPnsH8XGSlb.mHBXCMu26rOKTD1WF via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id cMJ8MA4wARus7o_61GzrTmePIvkeycKfeyVpysLVyur-1ipU8hTjYQ==
GET H2	200	24.49c6961c.chunk.css js.driftt.com/core/assets/css/ Frame C1CA	8 KB 2 KB	78ms 77ms	Stylesheet text/css	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/24.49c6961c.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 578cda2391db4e4d761ae5c4f05c03614d0ea8fec0b260edc036cc0bbdfcdd93 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 18 Oct 2021 07:58:46 GMT content-encoding gzip age 5059348 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 15 Oct 2021 18:19:47 GMT server nginx etag W/"f80cd64e339375567091159cb077b941" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id t3wd1L70.jr_F45fRiZ9jDIt4M2lflSx via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id PetP65xahXk5_fX13NGBQAJzlrqXzywYwrldtE24M0RhVP6zgJsqDg==
GET H2	200	24.abe2922c.chunk.js Show response js.driftt.com/core/assets/js/ Frame C1CA	12 KB 5 KB	78ms 78ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/24.abe2922c.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 4d85222516f652c200ef03b89b4b755c6a54210c75ca599fb53e0a05d677e197 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 06 Dec 2021 16:07:51 GMT content-encoding gzip age 796403 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 06 Dec 2021 15:09:52 GMT server nginx etag W/"04cf8ee37950ab9133d56182ac42f2d5" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id AKRAE85zxgA0Hp9dPNB1SHfTVkCdBA_K via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id NJ0ZsICz-fC5AOi2ah3wcvpSllHmNVHXSZMmAd7guGSCogR0gsHEOA==
GET H2	200	18.c695453b.chunk.css js.driftt.com/core/assets/css/ Frame C1CA	365 B 1008 B	77ms 77ms	Stylesheet text/css	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/18.c695453b.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 27 Sep 2021 18:05:58 GMT via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) age 6837316 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront content-length 365 last-modified Mon, 27 Sep 2021 17:53:27 GMT server nginx etag "06b2963b029c0824382815165bfea73e" strict-transport-security max-age=31536000; includeSubDomains access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 2nl84_Ynkb7J4eflOi4MBL9RG1iL8udX access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 accept-ranges bytes content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id d1jAj-KQDRgy8rAck35kr4JWWntLEWRveNh_8hkWQfw2UHkm-ns1Zg==
GET H2	200	18.d26db4f6.chunk.js Show response js.driftt.com/core/assets/js/ Frame C1CA	84 KB 24 KB	78ms 78ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/18.d26db4f6.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 9d7afdf8d1c1a87187c0ac284ec079f86acdbc289484bc8d4066dd4035b51d8a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=5aa6ba05-3692-4978-aca9-018cd7e50bc4&sessionStarted=1639603274.418&campaignRefreshToken=862bad42-7525-45b6-9dbe-baee72e8ffe3&hideController=false&pageLoadStartTime=1639603272122&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 06 Dec 2021 16:07:51 GMT content-encoding gzip age 796403 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 06 Dec 2021 15:09:51 GMT server nginx etag W/"676cfbeadf3745138265730781f5f098" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id QXlXpncoHQvFxp5turnNkFrpF0Tp7Na2 via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id zBpS4zIszwboJm0ysbhFlkf70h4H7KFJ-TLWvWUIGoqdbojoOPZF0w==
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 440 B	191ms 61ms	XHR text/plain	2a00:1450:400c:c06::9d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-52702906-1&cid=1216066355.1639603273&jid=1935532887&gjid=843209520&_gid=1438966587.1639603275&_u=aCDAAEACQAAAAC~&z=454631348 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c06::9d Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://redcanary.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Wed, 15 Dec 2021 21:21:15 GMT content-type text/plain access-control-allow-origin https://redcanary.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	30.11d2b6a7.chunk.css js.driftt.com/core/assets/css/ Frame 4952	3 KB 1 KB	54ms 53ms	Stylesheet text/css	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/30.11d2b6a7.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 01 Nov 2021 18:28:20 GMT content-encoding gzip age 3811975 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 01 Nov 2021 17:24:54 GMT server nginx etag W/"87532c4db85f1429fa6d759bc3332f36" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id GBOBYZXPfE_Um1Sf_mqL4fDHmw8hrH5J via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 1eMQpLSlgNosvgaTWq85WB64AnYv6HH8OWshhhV1gOeLA3QHt3X2Tg==
GET H2	200	30.0383f092.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4952	3 KB 2 KB	55ms 54ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/30.0383f092.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash a5e4d82414a2ca26ea7d94c8586c3c32363073ecb1214c884d302439f420913c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 06 Dec 2021 16:07:51 GMT content-encoding gzip age 796404 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 06 Dec 2021 15:09:52 GMT server nginx etag W/"62187322b72b1fa76d14e19526c132b8" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id z3aE86SV2XLkllCr6fKLzNFXHsnbcDpg via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id QHEFQ8WiRWGeW8TKwWBdJPdXVq_7IofJyGNF0hTMC_EU1obp_HCblQ==
GET H2	200	1.07aa08a5.chunk.css js.driftt.com/core/assets/css/ Frame 4952	7 KB 2 KB	54ms 53ms	Stylesheet text/css	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/1.07aa08a5.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 01 Nov 2021 02:55:04 GMT content-encoding gzip age 3867971 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 29 Oct 2021 20:21:04 GMT server nginx etag W/"189aeffd571884559dababa22c66d75a" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id K9l0WdnhS0.sb1iJQdTJni3xfVGcn633 via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id k0T9vZ3UkHlBK9VCd2zEJkiIXaKA-5WHj_4Vy96G_liN3hxBcaSThw==
GET H2	200	1.187c50a5.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4952	54 KB 16 KB	55ms 55ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/1.187c50a5.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash a3075e2c162e41c4962a4221ae035dd607d895bd424e87aa4065a044c43763e4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 25 Oct 2021 09:53:22 GMT content-encoding gzip age 4447673 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 22 Oct 2021 17:06:57 GMT server nginx etag W/"eeccccb655ee3b6bcb8b1a9b1da4fd30" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id T4NYA9GFrw0AOH7iks5Owut4YT_Q7yUg via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id B4qAoMqErCxsRLl0Y-JtPtqTCdSFhVxaDV1RuLBJl88Cnhe42DnD4w==
GET H2	200	0.ee2abab8.chunk.css js.driftt.com/core/assets/css/ Frame 4952	44 KB 7 KB	56ms 56ms	Stylesheet text/css	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/0.ee2abab8.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 5dbbdc87055e3735446865635b4678301f3e2a1a8796c5c8f9e6708aee679592 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 14:21:26 GMT content-encoding gzip age 111589 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 13 Dec 2021 22:15:51 GMT server nginx etag W/"c00b54e499f71a56923e5c2db3c1ebfc" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 68ABimk3FXgiFdH1qEDL3xdLWSNdRuPT via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id wmht70x8GmvmeEmkt2eyskuVWPLzahx8X99eRv2Guzm9csauN7Eewg==
GET H2	200	0.0d5304f8.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4952	70 KB 24 KB	57ms 57ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/0.0d5304f8.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash 7072e71c4451255d76dd060fa22d2372b336662caa03dad732c3e8c495e3722b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 14:21:26 GMT content-encoding gzip age 111589 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 13 Dec 2021 22:15:52 GMT server nginx etag W/"2d1fa187641adb5aa5b2cb4ccf569a19" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id gDqGMN2zeYnveagEipdU6C7OXCRNYw0e via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id O8HzJ1pPIqClN9eQh7SEgNI_X6Q42l6DcXAEDds2Jp_SADpUU8kJMw==
GET H2	200	29.a4eacd1c.chunk.css js.driftt.com/core/assets/css/ Frame 4952	11 KB 2 KB	58ms 58ms	Stylesheet text/css	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/29.a4eacd1c.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash e2fc570495ce9f73780336d692d1caf5d299d81a0208243f97dacb7f345cdf15 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 17 Nov 2021 20:12:40 GMT content-encoding gzip age 2423315 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Wed, 17 Nov 2021 19:25:04 GMT server nginx etag W/"5fcabdf983fd5bbf7cb199063137d146" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id k82F8FaNpkIB_WK109g86MbRHlA8U_6q via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id n4H46mq05qiJS3wpxdGCRuz3jWcZomBX0FeBHhMd-i2ooC7sn-5TGw==
GET H2	200	29.dc469063.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4952	11 KB 5 KB	58ms 58ms	Script application/javascript	143.204.98.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/29.dc469063.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b5231fdb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-111.fra50.r.cloudfront.net Software nginx / Resource Hash b3e92729562bf7aa805f612b4f909f640cdcfe2ccdc9ee6cf78f710491208e78 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639603272122 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 06 Dec 2021 16:07:51 GMT content-encoding gzip age 796404 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 06 Dec 2021 15:09:52 GMT server nginx etag W/"72171f9c0b9a4cd90bdf2440c1e572de" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id tOIlB4_T5WHhtdhh95vBpNvdrmWg4TVO via 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id FT0xBLxmnZXKB2XoRw3cJSXw3ECbjY3jc4xZGmuv4oGLuepW_TqG0w==
POST H2	200	v2 Show response metrics.api.drift.com/monitoring/metrics/widget/init/ Frame C1CA	25 B 123 B	164ms 164ms	XHR application/json	50.16.7.188 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://metrics.api.drift.com/monitoring/metrics/widget/init/v2 Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-50-16-7-188.compute-1.amazonaws.com Software istio-envoy / Resource Hash f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ Authorization Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/json Response headers date Wed, 15 Dec 2021 21:21:15 GMT server istio-envoy requestid f6af4f32c53f088f vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type application/json;charset=utf-8 access-control-allow-origin * access-control-max-age 1209600 access-control-allow-credentials true x-envoy-upstream-service-time 16 strict-transport-security max-age=31536000; includeSubDomains access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version content-length 25 access-control-expose-headers X-Results-Total-Count,X-Page-Info
OPTIONS H2	200	v2 metrics.api.drift.com/monitoring/metrics/widget/init/ Frame	0 0	614ms 161ms	Preflight text/plain	50.16.7.188 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://metrics.api.drift.com/monitoring/metrics/widget/init/v2 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-50-16-7-188.compute-1.amazonaws.com Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://js.driftt.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers date Wed, 15 Dec 2021 21:21:15 GMT access-control-allow-origin * access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version access-control-allow-credentials true access-control-expose-headers X-Results-Total-Count,X-Page-Info access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH access-control-max-age 1209600 strict-transport-security max-age=31536000; includeSubDomains content-type text/plain allow POST,OPTIONS requestid drift445866f4a72a0b51bbe5d79dd32 content-length 13 x-envoy-upstream-service-time 1 server istio-envoy
POST H2	200	ping Show response bootstrap.api.drift.com/widget_bootstrap/ Frame C1CA	126 B 223 B	151ms 150ms	XHR application/json	34.193.113.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://bootstrap.api.drift.com/widget_bootstrap/ping Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-193-113-164.compute-1.amazonaws.com Software istio-envoy / Resource Hash 0d84ab9cdfcd3d35e5d18202ce8ee45571758e56f4bcc4b45878922379b9789a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/json Response headers date Wed, 15 Dec 2021 21:21:15 GMT server istio-envoy requestid 6ba7d3444829b502 vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type application/json;charset=utf-8 access-control-allow-origin * access-control-max-age 1209600 access-control-allow-credentials true x-envoy-upstream-service-time 2 strict-transport-security max-age=31536000; includeSubDomains access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version content-length 126 access-control-expose-headers X-Results-Total-Count,X-Page-Info
OPTIONS H2	200	ping bootstrap.api.drift.com/widget_bootstrap/ Frame	0 0	604ms 160ms	Preflight text/plain	34.193.113.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://bootstrap.api.drift.com/widget_bootstrap/ping Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-193-113-164.compute-1.amazonaws.com Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers content-type Origin https://js.driftt.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers date Wed, 15 Dec 2021 21:21:15 GMT access-control-allow-origin * access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version access-control-allow-credentials true access-control-expose-headers X-Results-Total-Count,X-Page-Info access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH access-control-max-age 1209600 strict-transport-security max-age=31536000; includeSubDomains content-type text/plain allow POST,OPTIONS requestid driftcdcdf1a49839e4534d47c282bdf content-length 13 x-envoy-upstream-service-time 0 server istio-envoy
GET H3	200	ga-audiences www.google.com/ads/	42 B 63 B	198ms 107ms	Image image/gif	2a00:1450:4001:80e::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-52702906-1&cid=1216066355.1639603273&jid=1935532887&_u=aCDAAEACQAAAAC~&z=612351002 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 21:21:15 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ga-audiences www.google.de/ads/	42 B 63 B	204ms 109ms	Image image/gif	2a00:1450:4001:813::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-52702906-1&cid=1216066355.1639603273&jid=1935532887&_u=aCDAAEACQAAAAC~&z=612351002 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 21:21:15 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect Show response e.clarity.ms/	0 25 B	140ms 139ms	XHR text/plain	20.62.48.180 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://e.clarity.ms/collect Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 20.62.48.180 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept application/x-clarity-gzip Referer https://redcanary.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers access-control-allow-origin https://redcanary.com date Wed, 15 Dec 2021 21:21:14 GMT access-control-allow-credentials true server Microsoft-IIS/10.0 x-powered-by ASP.NET request-context appId=cid-v1:bdfb7149-d2ee-45f0-9a22-f0b1c5035608
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	266ms 266ms	Image image/gif	104.111.233.140 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=36bb1002af0b0000485cba613202000042512000&session=cdf35a5c-50f0-4e71-82d6-2e342298b845&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2015%20Dec%202021%2021%3A21%3A15%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2015%20Dec%202021%2021%3A21%3A12%20GMT%22%2C%22timeSpent%22%3A%222845%22%2C%22totalTimeSpent%22%3A%222845%22%7D&isIframe=false&m=%7B%22description%22%3A%22TA551%2C%20also%20known%20as%20Shathak%2C%20is%20a%20threat%20group%20that%20uses%20large-scale%20phishing%20campaigns%20to%20deliver%20additional%20malware%20payloads.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22TA551%20-%202021%20Threat%20Detection%20Report%20-%20Red%20Canary%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F&pageViewId=4b6d702e-86cf-4783-826c-b31a1e771d54&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-140.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 21:21:15 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Tue, 05 Oct 2021 22:17:52 GMT Server nginx/1.14.0 (Ubuntu) ETag "615ccf10-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	65zait4t5ws7.json Show response embeds.driftcdn.com/embeds/ Frame C1CA	31 KB 8 KB	381ms 178ms	XHR application/json	143.204.98.58 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://embeds.driftcdn.com/embeds/65zait4t5ws7.json Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.58 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-58.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash 142dd056fed7d73645aeef2cfe4c0eea7b0f6a62166d5f53931c074e3d8f341b Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 21:21:17 GMT content-encoding gzip x-amz-cf-pop FRA50-C1 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront access-control-max-age 3000 access-control-allow-origin * last-modified Wed, 15 Dec 2021 17:09:27 GMT server AmazonS3 etag W/"d0a4aac1b79df6dda16fc8add1134bc3" vary Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-methods GET content-type application/json; charset=UTF-8 via 1.1 bee9d99ac2913ec4167e166e6bdb691e.cloudfront.net (CloudFront) cache-control public, max-age=30 x-amz-cf-id aNLyCVl8xlcwuxRdo2HreXnLeGIJSW2QgvkS1ydSldNSIGcRDCK_AA==
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	233ms 232ms	Image image/gif	104.111.233.140 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=36bb1002af0b0000485cba613202000042512000&session=cdf35a5c-50f0-4e71-82d6-2e342298b845&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2015%20Dec%202021%2021%3A21%3A16%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2015%20Dec%202021%2021%3A21%3A15%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223846%22%7D&isIframe=false&m=%7B%22description%22%3A%22TA551%2C%20also%20known%20as%20Shathak%2C%20is%20a%20threat%20group%20that%20uses%20large-scale%20phishing%20campaigns%20to%20deliver%20additional%20malware%20payloads.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22TA551%20-%202021%20Threat%20Detection%20Report%20-%20Red%20Canary%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F&pageViewId=4b6d702e-86cf-4783-826c-b31a1e771d54&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-140.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 21:21:16 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Tue, 05 Oct 2021 22:17:52 GMT Server nginx/1.14.0 (Ubuntu) ETag "615ccf10-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
POST H2	200	bulk Show response metrics.api.drift.com/monitoring/metrics/event2/ Frame C1CA	25 B 88 B	155ms 155ms	XHR application/json	50.16.7.188 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://metrics.api.drift.com/monitoring/metrics/event2/bulk Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-50-16-7-188.compute-1.amazonaws.com Software istio-envoy / Resource Hash f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ Authorization Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/json Response headers date Wed, 15 Dec 2021 21:21:17 GMT server istio-envoy requestid c95db3988491f6da vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type application/json;charset=utf-8 access-control-allow-origin * access-control-max-age 1209600 access-control-allow-credentials true x-envoy-upstream-service-time 11 strict-transport-security max-age=31536000; includeSubDomains access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version content-length 25 access-control-expose-headers X-Results-Total-Count,X-Page-Info
OPTIONS H2	200	bulk metrics.api.drift.com/monitoring/metrics/event2/ Frame	0 0	145ms 145ms	Preflight text/plain	50.16.7.188 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://metrics.api.drift.com/monitoring/metrics/event2/bulk Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-50-16-7-188.compute-1.amazonaws.com Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://js.driftt.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers date Wed, 15 Dec 2021 21:21:17 GMT access-control-allow-origin * access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version access-control-allow-credentials true access-control-expose-headers X-Results-Total-Count,X-Page-Info access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH access-control-max-age 1209600 strict-transport-security max-age=31536000; includeSubDomains content-type text/plain allow POST,OPTIONS requestid driftc40ba3240519d5c0cde0a8033d7 content-length 13 x-envoy-upstream-service-time 1 server istio-envoy
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	228ms 227ms	Image image/gif	104.111.233.140 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=36bb1002af0b0000485cba613202000042512000&session=cdf35a5c-50f0-4e71-82d6-2e342298b845&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2015%20Dec%202021%2021%3A21%3A17%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2015%20Dec%202021%2021%3A21%3A16%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224847%22%7D&isIframe=false&m=%7B%22description%22%3A%22TA551%2C%20also%20known%20as%20Shathak%2C%20is%20a%20threat%20group%20that%20uses%20large-scale%20phishing%20campaigns%20to%20deliver%20additional%20malware%20payloads.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22TA551%20-%202021%20Threat%20Detection%20Report%20-%20Red%20Canary%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F&pageViewId=4b6d702e-86cf-4783-826c-b31a1e771d54&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-140.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 21:21:17 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Tue, 05 Oct 2021 22:17:52 GMT Server nginx/1.14.0 (Ubuntu) ETag "615ccf10-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	224ms 224ms	Image image/gif	104.111.233.140 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=36bb1002af0b0000485cba613202000042512000&session=cdf35a5c-50f0-4e71-82d6-2e342298b845&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2015%20Dec%202021%2021%3A21%3A18%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2015%20Dec%202021%2021%3A21%3A17%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%225849%22%7D&isIframe=false&m=%7B%22description%22%3A%22TA551%2C%20also%20known%20as%20Shathak%2C%20is%20a%20threat%20group%20that%20uses%20large-scale%20phishing%20campaigns%20to%20deliver%20additional%20malware%20payloads.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22TA551%20-%202021%20Threat%20Detection%20Report%20-%20Red%20Canary%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F&pageViewId=4b6d702e-86cf-4783-826c-b31a1e771d54&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-140.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 21:21:18 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	227ms 227ms	Image image/gif	104.111.233.140 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=36bb1002af0b0000485cba613202000042512000&session=cdf35a5c-50f0-4e71-82d6-2e342298b845&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2015%20Dec%202021%2021%3A21%3A19%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2015%20Dec%202021%2021%3A21%3A18%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226850%22%7D&isIframe=false&m=%7B%22description%22%3A%22TA551%2C%20also%20known%20as%20Shathak%2C%20is%20a%20threat%20group%20that%20uses%20large-scale%20phishing%20campaigns%20to%20deliver%20additional%20malware%20payloads.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22TA551%20-%202021%20Threat%20Detection%20Report%20-%20Red%20Canary%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F&pageViewId=4b6d702e-86cf-4783-826c-b31a1e771d54&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-140.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 21:21:19 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
POST H2	200	bulk Show response metrics.api.drift.com/monitoring/metrics/add/ Frame C1CA	25 B 85 B	145ms 145ms	XHR application/json	50.16.7.188 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://metrics.api.drift.com/monitoring/metrics/add/bulk Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-50-16-7-188.compute-1.amazonaws.com Software istio-envoy / Resource Hash f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ Authorization Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/json Response headers date Wed, 15 Dec 2021 21:21:20 GMT server istio-envoy requestid 8ddcb4041d991e34 vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type application/json;charset=utf-8 access-control-allow-origin * access-control-max-age 1209600 access-control-allow-credentials true x-envoy-upstream-service-time 1 strict-transport-security max-age=31536000; includeSubDomains access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version content-length 25 access-control-expose-headers X-Results-Total-Count,X-Page-Info
OPTIONS H2	200	bulk metrics.api.drift.com/monitoring/metrics/add/ Frame	0 0	145ms 144ms	Preflight text/plain	50.16.7.188 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://metrics.api.drift.com/monitoring/metrics/add/bulk Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-50-16-7-188.compute-1.amazonaws.com Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://js.driftt.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers date Wed, 15 Dec 2021 21:21:20 GMT access-control-allow-origin * access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version access-control-allow-credentials true access-control-expose-headers X-Results-Total-Count,X-Page-Info access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH access-control-max-age 1209600 strict-transport-security max-age=31536000; includeSubDomains content-type text/plain allow POST,OPTIONS requestid drift6257fd04fd882c4cd3494a42799 content-length 13 x-envoy-upstream-service-time 0 server istio-envoy
GET		img.gif b.6sc.co/v1/beacon/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

b.6sc.co

URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=36bb1002af0b0000485cba613202000042512000&session=cdf35a5c-50f0-4e71-82d6-2e342298b845&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2015%20Dec%202021%2021%3A21%3A20%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2015%20Dec%202021%2021%3A21%3A19%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%227851%22%7D&isIframe=false&m=%7B%22description%22%3A%22TA551%2C%20also%20known%20as%20Shathak%2C%20is%20a%20threat%20group%20that%20uses%20large-scale%20phishing%20campaigns%20to%20deliver%20additional%20malware%20payloads.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22TA551%20-%202021%20Threat%20Detection%20Report%20-%20Red%20Canary%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Fthreats%2Fta551%2F&pageViewId=4b6d702e-86cf-4783-826c-b31a1e771d54&an_uid=0