www.menlosecurity.com Open in urlscan Pro
34.249.200.254 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Submission: On March 08 via api (March 8th 2024, 2:13:06 am UTC) from TR — Scanned from DE

Summary HTTP 203 Redirects Links 32 Behaviour Indicators

Summary

This website contacted 46 IPs in 6 countries across 36 domains to perform 203 HTTP transactions. The main IP is 34.249.200.254, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is www.menlosecurity.com.
TLS certificate: Issued by R3 on February 20th 2024. Valid for: 3 months.

This is the only time www.menlosecurity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	34.249.200.254 34.249.200.254	16509 (AMAZON-02) (AMAZON-02)
25	2600:9000:21f... 2600:9000:21f3:3000:12:9e5f:cac0:93a1	16509 (AMAZON-02) (AMAZON-02)
12	2606:4700::68... 2606:4700::6812:83ec	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	104.17.70.206 104.17.70.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.222.232.99 52.222.232.99	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:812::2008	15169 (GOOGLE) (GOOGLE)
1	2600:9000:26e... 2600:9000:26e8:1e00:13:a3bc:6800:93a1	16509 (AMAZON-02) (AMAZON-02)
6	2600:9000:235... 2600:9000:235a:d600:11:3b84:d200:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:440... 2606:4700:4400::ac40:9b77	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	95.101.133.17 95.101.133.17	1299 (TWELVE99 ...) (TWELVE99 Arelion)
1	146.75.120.157 146.75.120.157	54113 (FASTLY) (FASTLY)
1	18.66.97.10 18.66.97.10	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:480... 2a02:26f0:480:f::213:7ec6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a03:2880:f08... 2a03:2880:f083:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	23.192.243.198 23.192.243.198	16625 (AKAMAI-AS) (AKAMAI-AS)
6	44.240.168.231 44.240.168.231	16509 (AMAZON-02) (AMAZON-02)
71	18.245.86.77 18.245.86.77	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:275... 2600:9000:275b:8a00:9:14eb:6280:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:440... 2606:4700:4400::6812:24c4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:4341	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	146.75.118.109 146.75.118.109	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:829::200a	15169 (GOOGLE) (GOOGLE)
1	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
4 5	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.32.27.107 13.32.27.107	16509 (AMAZON-02) (AMAZON-02)
2	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c06::9d	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
1	192.28.147.68 192.28.147.68	15224 (OMNITURE) (OMNITURE)
2	34.111.208.231 34.111.208.231	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	52.22.229.227 52.22.229.227	14618 (AMAZON-AES) (AMAZON-AES)
1	2a03:2880:f17... 2a03:2880:f176:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	52.51.205.226 52.51.205.226	16509 (AMAZON-02) (AMAZON-02)
4	13.224.189.129 13.224.189.129	16509 (AMAZON-02) (AMAZON-02)
1	37.252.172.123 37.252.172.123	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2a02:26f0:310... 2a02:26f0:3100::1735:2baa	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	3.68.168.239 3.68.168.239	16509 (AMAZON-02) (AMAZON-02)
3	104.18.37.212 104.18.37.212	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:827::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:806::2004	15169 (GOOGLE) (GOOGLE)
2	18.172.112.55 18.172.112.55	16509 (AMAZON-02) (AMAZON-02)
8	3.94.218.138 3.94.218.138	14618 (AMAZON-AES) (AMAZON-AES)
2	2606:4700::68... 2606:4700::6810:890f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:200... 2a04:4e42:200::720	54113 (FASTLY) (FASTLY)
203	46

1 34.249.200.254 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-200-254.eu-west-1.compute.amazonaws.com

www.menlosecurity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 2600:9000:21f3:3000:12:9e5f:cac0:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets-global.website-files.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:4700::6812:83ec (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.17.70.206 (None, )

ASN13335 (CLOUDFLARENET, US)

info.menlosecurity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.232.99 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-232-99.fra56.r.cloudfront.net

d3e54v103j8qbb.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:812::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:26e8:1e00:13:a3bc:6800:93a1 (United States)

ASN16509 (AMAZON-02, US)

hubfront.hushly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2600:9000:235a:d600:11:3b84:d200:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets.website-files.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9b77 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 95.101.133.17 (Liljeholmen, Sweden)

ASN1299 (TWELVE99 Arelion, fka Telia Carrier, SE)
PTR: a95-101-133-17.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.120.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.97.10 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-97-10.fra56.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:f::213:7ec6 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f083:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.192.243.198 (Düsseldorf, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-192-243-198.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 44.240.168.231 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-240-168-231.us-west-2.compute.amazonaws.com

app.hushly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

71 18.245.86.77 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-86-77.fra60.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:275b:8a00:9:14eb:6280:93a1 (United States)

ASN16509 (AMAZON-02, US)

d2i34c80a0ftze.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:24c4 (United States)

ASN13335 (CLOUDFLARENET, US)

trk.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:4341 (United States)

ASN13335 (CLOUDFLARENET, US)

scout-cdn.salesloft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.118.109 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

extend.vimeocdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.107 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-107.fra56.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c06::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.147.68 (United States)

ASN15224 (OMNITURE, US)

281-owv-899.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.208.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.208.111.34.bc.googleusercontent.com

ibc-flow.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.22.229.227 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-22-229-227.compute-1.amazonaws.com

scout.salesloft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f176:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.51.205.226 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-51-205-226.eu-west-1.compute.amazonaws.com

content.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.224.189.129 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-129.fra2.r.cloudfront.net

st.fullcircleinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.252.172.123 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3100::1735:2baa (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.68.168.239 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-68-168-239.eu-central-1.compute.amazonaws.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.18.37.212 (None, )

ASN13335 (CLOUDFLARENET, US)

js.zi-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.172.112.55 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-172-112-55.fra60.r.cloudfront.net

bootstrap.driftapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 3.94.218.138 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-94-218-138.compute-1.amazonaws.com

metrics.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
event.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
targeting.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:890f (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::720 (United States)

ASN54113 (FASTLY, US)

driftt.imgix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
71	driftt.com js.driftt.com — Cisco Umbrella Rank: 6183	858 KB
31	website-files.com assets-global.website-files.com — Cisco Umbrella Rank: 5826 assets.website-files.com — Cisco Umbrella Rank: 11197	2 MB
12	6sc.co j.6sc.co — Cisco Umbrella Rank: 5542 c.6sc.co — Cisco Umbrella Rank: 8489 ipv6.6sc.co — Cisco Umbrella Rank: 5730 b.6sc.co — Cisco Umbrella Rank: 3713	24 KB
12	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 334	176 KB
8	drift.com metrics.api.drift.com — Cisco Umbrella Rank: 6826 event.api.drift.com — Cisco Umbrella Rank: 7453 targeting.api.drift.com — Cisco Umbrella Rank: 7144	2 KB
7	hushly.com hubfront.hushly.com — Cisco Umbrella Rank: 263692 app.hushly.com — Cisco Umbrella Rank: 71891	221 KB
7	menlosecurity.com www.menlosecurity.com info.menlosecurity.com	162 KB
6	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 353 www.linkedin.com — Cisco Umbrella Rank: 629 px4.ads.linkedin.com — Cisco Umbrella Rank: 6596	3 KB
4	fullcircleinsights.com st.fullcircleinsights.com — Cisco Umbrella Rank: 102802	4 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 40	340 KB
3	zi-scripts.com js.zi-scripts.com — Cisco Umbrella Rank: 8158	3 KB
3	google.com region1.analytics.google.com — Cisco Umbrella Rank: 2656 www.google.com — Cisco Umbrella Rank: 2	720 B
3	salesloft.com scout-cdn.salesloft.com — Cisco Umbrella Rank: 10356 scout.salesloft.com — Cisco Umbrella Rank: 13192	4 KB
3	techtarget.com trk.techtarget.com — Cisco Umbrella Rank: 24770 ibc-flow.techtarget.com — Cisco Umbrella Rank: 22702	2 KB
2	zoominfo.com ws.zoominfo.com — Cisco Umbrella Rank: 4571	2 KB
2	driftapi.com bootstrap.driftapi.com	9 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 29	21 KB
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 8862	721 B
2	google.de www.google.de — Cisco Umbrella Rank: 6744	515 B
2	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 84	400 B
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3643	6 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 180	71 KB
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 703 script.hotjar.com — Cisco Umbrella Rank: 882	59 KB
2	cloudfront.net d3e54v103j8qbb.cloudfront.net d2i34c80a0ftze.cloudfront.net	41 KB
1	imgix.net driftt.imgix.net — Cisco Umbrella Rank: 16529	917 B
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 500	707 B
1	hotjar.io content.hotjar.io — Cisco Umbrella Rank: 6493	161 B
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 100	185 B
1	mktoresp.com 281-owv-899.mktoresp.com	318 B
1	t.co t.co — Cisco Umbrella Rank: 674	377 B
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 30	964 B
1	vimeocdn.com extend.vimeocdn.com — Cisco Umbrella Rank: 9921	6 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 781	17 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 775	15 KB
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 541	303 B
0	twitter.com Failed analytics.twitter.com Failed
203	36

	Domain	Requested by
71	js.driftt.com	www.menlosecurity.com js.driftt.com
25	assets-global.website-files.com	www.menlosecurity.com assets-global.website-files.com
12	cdn.cookielaw.org	www.menlosecurity.com cdn.cookielaw.org
8	b.6sc.co	www.menlosecurity.com
6	app.hushly.com	www.menlosecurity.com app.hushly.com
6	assets.website-files.com	assets-global.website-files.com
6	info.menlosecurity.com	www.menlosecurity.com info.menlosecurity.com
4	targeting.api.drift.com	js.driftt.com
4	st.fullcircleinsights.com	d2i34c80a0ftze.cloudfront.net
4	px.ads.linkedin.com	3 redirects snap.licdn.com
4	www.googletagmanager.com	www.menlosecurity.com www.googletagmanager.com
3	js.zi-scripts.com	www.menlosecurity.com js.zi-scripts.com
2	event.api.drift.com	js.driftt.com
2	ws.zoominfo.com	js.zi-scripts.com
2	metrics.api.drift.com	js.driftt.com
2	bootstrap.driftapi.com	js.driftt.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	epsilon.6sense.com	j.6sc.co
2	scout.salesloft.com	scout-cdn.salesloft.com
2	ibc-flow.techtarget.com	trk.techtarget.com
2	www.google.de	www.menlosecurity.com
2	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com
2	region1.analytics.google.com	www.googletagmanager.com
2	munchkin.marketo.net	www.menlosecurity.com munchkin.marketo.net
2	connect.facebook.net	www.menlosecurity.com connect.facebook.net
2	j.6sc.co	www.googletagmanager.com j.6sc.co
1	driftt.imgix.net
1	www.google.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	secure.adnxs.com	j.6sc.co
1	content.hotjar.io	script.hotjar.com
1	www.facebook.com	www.menlosecurity.com
1	281-owv-899.mktoresp.com	munchkin.marketo.net
1	script.hotjar.com	static.hotjar.com
1	px4.ads.linkedin.com	www.menlosecurity.com
1	www.linkedin.com	1 redirects
1	t.co	www.menlosecurity.com
1	fonts.googleapis.com	info.menlosecurity.com
1	extend.vimeocdn.com	www.googletagmanager.com
1	scout-cdn.salesloft.com	www.menlosecurity.com
1	trk.techtarget.com	www.menlosecurity.com
1	d2i34c80a0ftze.cloudfront.net	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	static.hotjar.com	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	hubfront.hushly.com	www.menlosecurity.com
1	d3e54v103j8qbb.cloudfront.net	www.menlosecurity.com
1	www.menlosecurity.com
0	analytics.twitter.com Failed	www.menlosecurity.com
203	51

This site contains links to these domains. Also see Links.

Domain
event.on24.com
try.menlosecurity.com
resources.menlosecurity.com
jobs.ashbyhq.com
www.linkedin.com
twitter.com
www.facebook.com
www.wired.com
www.bleepingcomputer.com
www.axios.com
www.youtube.com
csportal.menlosecurity.com
www.onetrust.com

Subject Issuer	Validity	Valid
www.menlosecurity.com R3	`2024-02-20` - `2024-05-20`	3 months	crt.sh
*.website-files.com Amazon RSA 2048 M03	`2023-09-11` - `2024-10-08`	a year	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2024-03-01` - `2024-12-31`	10 months	crt.sh
info.menlosecurity.com Cloudflare Inc ECC CA-3	`2024-02-29` - `2024-12-31`	10 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2023-10-10` - `2024-09-19`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
*.hushly.com Amazon RSA 2048 M02	`2023-10-18` - `2024-11-14`	a year	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2023-11-13` - `2024-11-12`	a year	crt.sh
6sc.co R3	`2024-01-29` - `2024-04-28`	3 months	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-21` - `2024-07-19`	a year	crt.sh
*.hotjar.com Amazon ECDSA 256 M03	`2024-02-07` - `2025-03-08`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-12-16` - `2024-03-15`	3 months	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2023-12-08` - `2024-12-11`	a year	crt.sh
drift.com Amazon RSA 2048 M02	`2023-08-15` - `2024-09-11`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-06-25` - `2024-06-24`	a year	crt.sh
salesloft.com Sectigo RSA Domain Validation Secure Server CA	`2023-03-20` - `2024-04-18`	a year	crt.sh
*.vimeocdn.com GlobalSign Atlas R3 DV TLS CA 2023 Q4	`2023-11-22` - `2024-12-23`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-07` - `2025-01-06`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
www.google.de GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
*.mktoresp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-07` - `2024-10-07`	a year	crt.sh
ibc-flow.techtarget.com GTS CA 1D4	`2024-01-13` - `2024-04-12`	3 months	crt.sh
*.hotjar.io Amazon ECDSA 256 M02	`2024-01-31` - `2025-03-01`	a year	crt.sh
aws-st.fullcircleinsights.com Amazon RSA 2048 M01	`2023-05-30` - `2024-06-26`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2023-02-13` - `2024-03-15`	a year	crt.sh
*.6sense.com Amazon RSA 2048 M01	`2023-05-01` - `2024-05-29`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-01-30` - `2024-07-30`	6 months	crt.sh
zi-scripts.com GTS CA 1P5	`2024-01-30` - `2024-04-29`	3 months	crt.sh
www.google.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
driftapi.com Amazon RSA 2048 M02	`2023-12-25` - `2025-01-21`	a year	crt.sh
zoominfo.com E1	`2024-02-20` - `2024-05-20`	3 months	crt.sh
*.imgix.com GlobalSign Atlas R3 DV TLS CA 2023 Q4	`2023-12-07` - `2025-01-07`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Frame ID: 583962FDDA0BECF7393AC0B4C6CD3E3F
Requests: 116 HTTP requests in this frame

Frame: https://info.menlosecurity.com/index.php/form/XDFrame
Frame ID: 92A001377EFB1C1A529D253AE8319C77
Requests: 2 HTTP requests in this frame

Frame: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Frame ID: 529EE94561CA9B9768E5F0AB4D2EDE67
Requests: 40 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
Frame ID: 43B629F66E7955334FA3B8C87B005F3D
Requests: 36 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Swindled Blackcat affiliate wants money from Change Healthcare ransom - Blog | Menlo SecurityBack ButtonFilter Button

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

203
Requests

99 %
HTTPS

49 %
IPv6

36
Domains

51
Subdomains

46
IPs

6
Countries

3886 kB
Transfer

9889 kB
Size

42
Cookies

32 Outgoing links

These are links going to different origins than the main page.

URL: https://event.on24.com/wcc/r/4493067/BFDDFD85858F2CD4D4BEE462A722B088?partnerref=MenloSecurity
Title: Learn more

Search URL Search Domain Scan URL

URL: https://try.menlosecurity.com/
Title: Try Menlo Now

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/white-papers/where-next-in-the-evolution-of-enterprise-browsers
Title: WHITE PAPERWhere next in the evolution of enterprise browsers?Read white paper

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/white-papers/cisos-guide-to-enterprise-browsers
Title: WHITE PAPERThe CISOs Guide to Enterprise BrowsersRead the white paper

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/data-sheets/menlo-security-browser-posture-manager
Title: data sheetMenlo Security Browser Posture ManagerExplore details

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/executive-briefs/secure-cloud-browser-executive-brief
Title: Executive BriefMenlo Secure Cloud BrowserStart protecting

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/solution-briefs/modernize-virtual-desktop-infrastructure-vdi-with-secure-enterprise-browser-solution
Title: Solution BriefModernize VDI with Secure Enterprise Browser SolutionExplore solution

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/solution-briefs/make-zero-trust-access-easy-with-menlo-security
Title: Solution BriefEasy zero trust accessSee how

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/
Title: All Resources

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/white-papers
Title: White Papers

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/data-sheets
Title: Data Sheets

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/solution-briefs
Title: Solution Briefs

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/case-studies
Title: Case Studies / Customer Stories

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/ebooks
Title: eBooks

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/reports
Title: Reports

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/videos
Title: Videos

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/webinars
Title: On-Demand Webinars

Search URL Search Domain Scan URL

URL: https://jobs.ashbyhq.com/menlosecurity
Title: Job openings

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom&title=Swindled%20Blackcat%20affiliate%20wants%20money%20from%20Change%20Healthcare%20ransom%20-%20Blog%20|%20Menlo%20Security

Search URL Search Domain Scan URL

URL: https://twitter.com/share?url=https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom

Search URL Search Domain Scan URL

URL: https://www.wired.com/story/blackcat-ransomware-disruptions-comebacks/
Title: following a cyberattack

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/blackcat-ransomware-turns-off-servers-amid-claim-they-stole-22-million-ransom/
Title: reportedly after allegedly scamming an affiliate involved in the Optum attack out of $22 million

Search URL Search Domain Scan URL

URL: https://twitter.com/fwosar/status/1765012402314023401
Title: Fabian Wosar

Search URL Search Domain Scan URL

URL: https://twitter.com/ddd1ms/status/1764979901965201552
Title: Another X user

Search URL Search Domain Scan URL

URL: https://www.axios.com/2024/03/05/providers-demand-feds-intervene-change-healthcare
Title: The healthcare industry is urging the government to intervene and provide financial support to hospitals

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/menlo-security/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Menlo-Security-411677528985544/

Search URL Search Domain Scan URL

URL: https://twitter.com/menlosecurity?lang=en

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCN0AikN5dKnhEhmtQddAYqg

Search URL Search Domain Scan URL

URL: https://csportal.menlosecurity.com/hc/en-us
Title: Support Portal

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 71

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1709863980682&li_adsId=81678573-464c-4ff1-9a37-397ffc3b3952&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1709863980682&li_adsId=81678573-464c-4ff1-9a37-397ffc3b3952&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D474058%26time%3D1709863980682%26li_adsId%3D81678573-464c-4ff1-9a37-397ffc3b3952%26url%3Dhttps%253A%252F%252Fwww.menlosecurity.com%252Fblog%252Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1709863980682&li_adsId=81678573-464c-4ff1-9a37-397ffc3b3952&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1709863980682&li_adsId=81678573-464c-4ff1-9a37-397ffc3b3952&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom&cookiesTest=true&liSync=true&e_ipv6=AQJJYVCOt_wkCAAAAY4b1dDDdDbDTCVtwFpQOWdyhRkEZQoTAwavzJFyhH38I-Gs-vfJs_7i

203 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Show response
www.menlosecurity.com/blog/ 80 KB
20 KB 195ms
62ms Document
text/html 34.249.200.254
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.249.200.254 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-200-254.eu-west-1.compute.amazonaws.com

Software

Resource Hash

e86e1e398fbcc72f22d26b888c310d364b8bd39e2e3979e405134f579c8d2177

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 38999
content-encoding: gzip
content-length: 20356
content-type: text/html
date: Fri, 08 Mar 2024 02:13:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding,x-wf-forwarded-proto
x-cache: HIT, HIT
x-cache-hits: 1, 2
x-cluster-name: eu-west-1-prod-hosting-red
x-content-type-options: nosniff
x-frame-options: DENY
x-lambda-id: 34edee71-a1c7-4dcb-9e50-68cf4763dd25
x-served-by: cache-iad-kiad7000071-IAD, cache-dub4332-DUB
x-timer: S1709863980.212805,VS0,VE0

GET
H2 200 menlo-dev.03daca6f1.min.css
assets-global.website-files.com/6536e5317bf92f62050c3585/css/ 370 KB
59 KB 61ms
11ms Stylesheet
text/css 2600:9000:21f3:3000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets-global.website-files.com/6536e5317bf92f62050c3585/css/menlo-dev.03daca6f1.min.css
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0eb85d0d2c8f3603d50877396aa75f6eb8e7fcdee3166132e0c3eeca5848f481

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

x-amz-version-id: 9Y1fVFSkOTL4CUkBo3pcL1tlQdGV0fgs
content-encoding: gzip
via: 1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
date: Thu, 07 Mar 2024 22:14:52 GMT
age: 14559
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 59376
last-modified: Wed, 06 Mar 2024 21:52:11 GMT
server: AmazonS3
etag: "e85a366c86136fcbfd90a0aec7f85799"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: 2tzF7G9U8WzrtCnPV1weO7op-XmT39zR1Ufcnn2CzgGnlAOdf2NT6Q==

GET
H2 200 OtAutoBlock.js Show response
cdn.cookielaw.org/consent/1a750de4-f18f-43d4-8b13-4ead3aa824f4/ 27 KB
5 KB 64ms
39ms Script
application/x-javascript 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/1a750de4-f18f-43d4-8b13-4ead3aa824f4/OtAutoBlock.js

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3b313873cad9e3eeadf943ad160981022d65e3a0c706869faf7a3de1240412f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 08 Mar 2024 02:13:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-md5: bt8vmXE8YF+DN/aJAvOpZg==
content-length: 5055
x-ms-lease-status: unlocked
last-modified: Thu, 22 Feb 2024 17:44:58 GMT
server: cloudflare
etag: 0x8DC33CDFD2999C4
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 251056fa-601e-0064-7eb6-65c81b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 860f4db4cd5119b1-FRA
expires: Sat, 09 Mar 2024 02:13:00 GMT

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
7 KB 44ms
19ms Script
application/javascript 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ea1823078c462969eaa59d6ef62623c19d77b72e25a103105b043aefaa0769a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 08 Mar 2024 02:13:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: TNPM/PizeaP1LGhMRcm7BA==
age: 63218
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 6841
x-ms-lease-status: unlocked
last-modified: Wed, 06 Mar 2024 17:32:11 GMT
server: cloudflare
etag: 0x8DC3E035B297D15
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: f1e8725f-e01e-00a1-033c-70e2fe000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 860f4db4cd5219b1-FRA

GET
H2 200 65b30af079f2a57286546248_icon-rounded-close-icon.svg
assets-global.website-files.com/6536e5317bf92f62050c3585/ 311 B
769 B 59ms
9ms Image
image/svg+xml 2600:9000:21f3:3000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6536e5317bf92f62050c3585/65b30af079f2a57286546248_icon-rounded-close-icon.svg
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9da14942229f055eb8acb3012a6e1fadcff12d6db2a9736e685a1113539468ba

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 20 Feb 2024 12:30:25 GMT
x-amz-version-id: zbIvUCgae1xaV2oBYvtk4AbFl.T7lTFF
via: 1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age: 1431756
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 311
last-modified: Fri, 26 Jan 2024 01:29:21 GMT
server: AmazonS3
etag: "05edd6e8fc673e0b58d2a5408c1359ac"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: RX5kJkko4qEDux7nHdCnCfjP4qc3WMFKemmtf1vSicN_rRfL44Knbw==

GET
H2 200 forms2.min.js Show response
info.menlosecurity.com/js/forms2/js/ 199 KB
67 KB 173ms
37ms Script
application/x-javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.menlosecurity.com/js/forms2/js/forms2.min.js

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

be64da47ffc5fc1e40ba8205a0974330a76815e151e84ba365a750a7c96f1d1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Fri, 05 Jan 2024 00:21:30 GMT
server: cloudflare
age: 2364
etag: "1e01605-31ad2-60e27d4627680"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 860f4db588f25d93-FRA
expires: Fri, 08 Mar 2024 06:13:00 GMT

GET
H2 200 jquery-3.5.1.min.dc5e7f18c8.js Show response
d3e54v103j8qbb.cloudfront.net/js/ 87 KB
30 KB 32ms
8ms Script
application/javascript 52.222.232.99
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=6536e5317bf92f62050c3585
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.232.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-232-99.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer: https://www.menlosecurity.com/
Origin: https://www.menlosecurity.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Thu, 07 Mar 2024 05:07:19 GMT
content-encoding: br
via: 1.1 bb3ac1595bb014e3b09608a0358d33da.cloudfront.net (CloudFront)
age: 76163
x-amz-cf-pop: FRA56-P4
x-cache: Hit from cloudfront
last-modified: Mon, 20 Jul 2020 17:53:02 GMT
server: AmazonS3
etag: W/"dc5e7f18c8d36ac1d3d4753a87c98d0a"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
vary: Accept-Encoding
x-amz-cf-id: Fvgd7CCydsylVorZKkNIC_-vh7A5Om5NamAbuNH64YWDDFILLqFecA==

GET
H2 200 menlo-dev.ed0cf4bd0.js Show response
assets-global.website-files.com/6536e5317bf92f62050c3585/js/ 819 KB
110 KB 9ms
9ms Script
text/javascript 2600:9000:21f3:3000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets-global.website-files.com/6536e5317bf92f62050c3585/js/menlo-dev.ed0cf4bd0.js
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 584af0c9b08e78cbcc50f7117519ad69852c42cb66cf3904ebc5afaf58063892

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

x-amz-version-id: 8TorUIosZpj2eMejM7KEP9Z.zXrEiav_
content-encoding: gzip
via: 1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
date: Thu, 07 Mar 2024 22:14:52 GMT
age: 16511
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 111806
last-modified: Wed, 06 Mar 2024 21:52:11 GMT
server: AmazonS3
etag: "d8e518283071697549cf31fd5a85b75c"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: vZCj5sgizbdhi_FS6xrxjSJJVKQY_-auUNU8CEq0vkVFrNA-cT5aVQ==

GET
H2 200 1a750de4-f18f-43d4-8b13-4ead3aa824f4.json Show response
cdn.cookielaw.org/consent/1a750de4-f18f-43d4-8b13-4ead3aa824f4/ 5 KB
2 KB 47ms
32ms XHR
application/x-javascript 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/1a750de4-f18f-43d4-8b13-4ead3aa824f4/1a750de4-f18f-43d4-8b13-4ead3aa824f4.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5483976e852ac7c40869c39e9c0877928cecb7c58880c1c842447a2dd97df06a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 08 Mar 2024 02:13:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 54494
content-md5: UaATZqT8S7L0KHoka6pq+Q==
content-length: 1682
x-ms-lease-status: unlocked
last-modified: Thu, 22 Feb 2024 17:44:58 GMT
server: cloudflare
etag: 0x8DC33CDFD2A35ED
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: fcaf2209-201e-0017-03b6-659088000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 860f4db53aa39293-FRA
expires: Sat, 09 Mar 2024 02:13:00 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 308 KB
102 KB 136ms
55ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7897cb9a7b1d79f447fc616987b640b0d628fc85130ad65f50a8030b57e1fab4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:00 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 104225
x-xss-protection: 0
last-modified: Fri, 08 Mar 2024 00:09:27 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 08 Mar 2024 02:13:00 GMT

GET
H2 200 embed.js Show response
hubfront.hushly.com/ 203 KB
60 KB 635ms
581ms Script
application/javascript 2600:9000:26e8:1e00:13:a3bc:6800:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hubfront.hushly.com/embed.js
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26e8:1e00:13:a3bc:6800:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: a1ed0a00886cc41429b3199124bc2b2d744d9dfdd130721e115dc235a1569d1f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:00 GMT
content-encoding: gzip
via: 1.1 38dab0d877593711162f7409f4fc8fca.cloudfront.net (CloudFront)
last-modified: Mon, 04 Mar 2024 08:40:58 GMT
server: nginx
x-amz-cf-pop: FRA56-P10
etag: W/"65e5891a-32a11"
x-cache: Miss from cloudfront
content-type: application/javascript
x-amz-cf-id: zJMdI6Uus0vYZgRX5koCOWO9vvk6A_53ECk6b_filltO-Vxq5jX46Q==

GET
H2 200 65d0f2dae177d376b0c2edf8_White_Search_Icon.svg
assets-global.website-files.com/6536e5317bf92f62050c3585/ 931 B
1 KB 10ms
10ms Image
image/svg+xml 2600:9000:21f3:3000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6536e5317bf92f62050c3585/65d0f2dae177d376b0c2edf8_White_Search_Icon.svg
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6536e5317bf92f62050c3585/css/menlo-dev.03daca6f1.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0316b910e0a7b4b953bfe8cf73598737ecaf0950899b00bf3bbbbff1b1038d96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://assets-global.website-files.com/6536e5317bf92f62050c3585/css/menlo-dev.03daca6f1.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 20 Feb 2024 15:48:28 GMT
x-amz-version-id: QJZPo1tWQCMoT6Cd4jwSQEVJ8Jt9H79J
via: 1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age: 1419873
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 931
last-modified: Sat, 17 Feb 2024 17:54:35 GMT
server: AmazonS3
etag: "366f7ad07f086ba27b215e5a4a6339c4"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: pghgl2d_5n2G3sCuyf3fY_NG9bKnrB9ftWL4-XzaHFyo0Qd-xuadmA==

GET
H2 200 6536ffc62cf41f78f153fcb5_Roboto-Bold.ttf
assets.website-files.com/6536e5317bf92f62050c3585/ 163 KB
83 KB 82ms
33ms Font
application/x-font-ttf 2600:9000:235a:d600:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6536e5317bf92f62050c3585/6536ffc62cf41f78f153fcb5_Roboto-Bold.ttf
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6536e5317bf92f62050c3585/css/menlo-dev.03daca6f1.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:d600:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ec685a46105296fe46c8744da4a11cf8118ba6c11271941766f7a546df6aa7c7

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://www.menlosecurity.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 20 Feb 2024 12:08:59 GMT
x-amz-version-id: DEN3jsgRev_OY_LYX5MYpkpFwV.0RnKX
content-encoding: br
via: 1.1 a6ec089aa02839578670b49d128782c2.cloudfront.net (CloudFront)
age: 1433042
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Mon, 23 Oct 2023 23:20:40 GMT
server: AmazonS3
etag: W/"b8e42971dec8d49207a8c8e2b919a6ac"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/x-font-ttf
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
vary: Accept-Encoding
x-amz-cf-id: iRxUcJOnSE_pb5OrqriUud2tlPElOX75PT8zwPyIbZXFUko7cyj9uA==

GET
H2 200 6536ffc6d42c74fdfbff0fc4_Roboto-Regular.ttf
assets.website-files.com/6536e5317bf92f62050c3585/ 164 KB
82 KB 90ms
41ms Font
application/x-font-ttf 2600:9000:235a:d600:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6536e5317bf92f62050c3585/6536ffc6d42c74fdfbff0fc4_Roboto-Regular.ttf
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6536e5317bf92f62050c3585/css/menlo-dev.03daca6f1.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:d600:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4e147ab64b9fdf6d89d01f6b8c3ca0b3cddc59d608a8e2218f9a2504b5c98e14

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://www.menlosecurity.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 20 Feb 2024 12:08:59 GMT
x-amz-version-id: 05LPmbO2M9nNQswHGx2VlZpg6J3t6zB8
content-encoding: br
via: 1.1 a6ec089aa02839578670b49d128782c2.cloudfront.net (CloudFront)
age: 1433042
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Fri, 01 Dec 2023 10:22:22 GMT
server: AmazonS3
etag: W/"8a36205bd9b83e03af0591a004bc97f4"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/x-font-ttf
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
vary: Accept-Encoding
x-amz-cf-id: N6HLWSCotT2m7GtDvmHjNdb3ZEgLYHUVb7WpRYL3H1OSXXb2YYty-A==

GET
H2 200 6536ffc6ee31b63c515fef73_Roboto-Black.ttf
assets.website-files.com/6536e5317bf92f62050c3585/ 164 KB
83 KB 86ms
37ms Font
application/x-font-ttf 2600:9000:235a:d600:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6536e5317bf92f62050c3585/6536ffc6ee31b63c515fef73_Roboto-Black.ttf
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6536e5317bf92f62050c3585/css/menlo-dev.03daca6f1.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:d600:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5ace0d0833ab83ff18ea94e4a7745f919c458ae4eabc298218226df4275ccd4d

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://www.menlosecurity.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 20 Feb 2024 12:08:59 GMT
x-amz-version-id: LC7K49D5wH6tDKXFHytipUF6mcbcdjJd
content-encoding: br
via: 1.1 a6ec089aa02839578670b49d128782c2.cloudfront.net (CloudFront)
age: 1433042
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Mon, 23 Oct 2023 23:20:39 GMT
server: AmazonS3
etag: W/"d6a6f8878adb0d8e69f9fa2e0b622924"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/x-font-ttf
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
vary: Accept-Encoding
x-amz-cf-id: 4oNwhIcYNioGHC2Uo5wfpNFUD0bBiT2eTcPQVh_63_4AYJ5LWNoyfA==

GET
H2 200 6536fedde312752da0449705_Raleway-VariableFont_wght.ttf
assets.website-files.com/6536e5317bf92f62050c3585/ 302 KB
148 KB 93ms
45ms Font
application/x-font-ttf 2600:9000:235a:d600:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6536e5317bf92f62050c3585/6536fedde312752da0449705_Raleway-VariableFont_wght.ttf
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6536e5317bf92f62050c3585/css/menlo-dev.03daca6f1.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:d600:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8e7948221210e0bff86b70de2a2e893e24e0d9c5a16a5db0aa47834b88bf1998

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://www.menlosecurity.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 20 Feb 2024 12:08:59 GMT
x-amz-version-id: W6TaNt0ziNCYiA6KR0lQ_yg4yL4jsmS5
content-encoding: br
via: 1.1 a6ec089aa02839578670b49d128782c2.cloudfront.net (CloudFront)
age: 1433042
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Mon, 23 Oct 2023 23:19:05 GMT
server: AmazonS3
etag: W/"3ec1aa8901bbee53c49cc8b4e011a0e1"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/x-font-ttf
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
vary: Accept-Encoding
x-amz-cf-id: X25yAheSrUqHlhybi1g99w3kmcJFkcLqxbCDQSCkWWPJoG6lRYKYIQ==

GET
H2 200 6536ffc6e312752da0459d75_Roboto-BoldItalic.ttf
assets.website-files.com/6536e5317bf92f62050c3585/ 167 KB
89 KB 61ms
12ms Font
application/x-font-ttf 2600:9000:235a:d600:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6536e5317bf92f62050c3585/6536ffc6e312752da0459d75_Roboto-BoldItalic.ttf
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6536e5317bf92f62050c3585/css/menlo-dev.03daca6f1.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:d600:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 61df597f73c91f238cbe88fe3c536702d120d048b79b25fa0f4f7818fd123a6f

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://www.menlosecurity.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 20 Feb 2024 12:09:00 GMT
x-amz-version-id: 2HFBnsPkcw6R9UfO8JzaHQJaMZQjNpb3
content-encoding: br
via: 1.1 a6ec089aa02839578670b49d128782c2.cloudfront.net (CloudFront)
age: 1433041
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Thu, 01 Feb 2024 14:49:08 GMT
server: AmazonS3
etag: W/"fd6e9700781c4aaae877999d09db9e09"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/x-font-ttf
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
vary: Accept-Encoding
x-amz-cf-id: FPqqaNjT9Lb-DB8WHXrCnV0G3l7MLi8THuPqDdbG5XVwwvmwSPanhw==

GET
H2 200 6536ffc61a22f00ee539de31_Roboto-Italic.ttf
assets.website-files.com/6536e5317bf92f62050c3585/ 167 KB
89 KB 76ms
27ms Font
application/x-font-ttf 2600:9000:235a:d600:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6536e5317bf92f62050c3585/6536ffc61a22f00ee539de31_Roboto-Italic.ttf
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6536e5317bf92f62050c3585/css/menlo-dev.03daca6f1.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:d600:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 99e4a85061136e99e052929ed0d85e36384fba5c34b773139a8f64339c609943

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://www.menlosecurity.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 20 Feb 2024 12:09:00 GMT
x-amz-version-id: K.6cn7P.TKQlJpc2rwPUk4An9TToDFe_
content-encoding: br
via: 1.1 a6ec089aa02839578670b49d128782c2.cloudfront.net (CloudFront)
age: 1433041
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Thu, 01 Feb 2024 14:50:44 GMT
server: AmazonS3
etag: W/"cebd892d1acfcc455f5e52d4104f2719"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/x-font-ttf
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
vary: Accept-Encoding
x-amz-cf-id: DF1k1v3ipA2onFniVwr4yRK1nBCKbOAefo_A7r6MVwtf6cNp6RJ_yg==

GET
H2 200 6569c2d88d994c80155279c5_Menlo_circle-arrow%E2%80%94Transparent.svg
assets-global.website-files.com/6536e5317bf92f62050c3585/ 428 B
886 B 14ms
12ms Image
image/svg+xml 2600:9000:21f3:3000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6536e5317bf92f62050c3585/6569c2d88d994c80155279c5_Menlo_circle-arrow%E2%80%94Transparent.svg
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 889d25db4b8baec5af49f52ba44f9aabf5d3ed27620850a9fd1645746dd76668

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 20 Feb 2024 12:08:22 GMT
x-amz-version-id: OTQZHJDi9C8m5Sp0xUE2N0Mz_8m_sV6H
via: 1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age: 1433079
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 428
last-modified: Fri, 01 Dec 2023 11:28:41 GMT
server: AmazonS3
etag: "684db38c541a2e1cbfaf34c61d643ed8"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: RYnR1D4ih7jNN6AUztUWmbch7wtz_0PLvkwYGqtuBis1LkhdJqoZrQ==

GET
H2 200 6564ef8254ba69f9582df989_menlo-logo-new.png
assets-global.website-files.com/6536e5317bf92f62050c3585/ 7 KB
8 KB 15ms
12ms Image
image/png 2600:9000:21f3:3000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6536e5317bf92f62050c3585/6564ef8254ba69f9582df989_menlo-logo-new.png
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca681b2b9b415d35f4ceef886b26398a76b29856294f94751f910f44dc8e14e7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 20 Feb 2024 12:05:45 GMT
x-amz-version-id: 6oM0EjA5C1tlifHw4zqf2v1C6h_csXyZ
via: 1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age: 1433236
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 7413
last-modified: Mon, 27 Nov 2023 19:35:31 GMT
server: AmazonS3
etag: "0c2965a583039629321663d795f35155"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: YxjrG2w7XvM8cM9xteN-KNmA1VBBhLJeM9kE-8w9kPUo_4ON6895Mg==

GET
H2 200 65e8e485cd344b46d4764590_BlackCat-ransomware-group_BLOG-p-800.png
assets-global.website-files.com/65565a6ae1bebedfef4026ca/ 26 KB
26 KB 18ms
16ms Image
image/png 2600:9000:21f3:3000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/65565a6ae1bebedfef4026ca/65e8e485cd344b46d4764590_BlackCat-ransomware-group_BLOG-p-800.png
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 45756d3738e4c5f55cda1d4736372780e2a15f7e50f432980ce64c54864eb3cb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 22:38:42 GMT
x-amz-version-id: qeTK9phleL2gOPzdQkEYtiwxU_bOB.Pm
via: 1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age: 99259
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 26279
last-modified: Wed, 06 Mar 2024 21:47:51 GMT
server: AmazonS3
etag: "6fc1262ea495f16c9e280a5d65263b45"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: GpdgWJxrHqRPtpqS3MqoSVpmIIzjI1LGkFd_6H43M4UzUsVmIZX86Q==

GET
H2 200 6564ef5d3a4cb7b5ea3a9057_LinkedIn_white_line_icon.svg
assets-global.website-files.com/6536e5317bf92f62050c3585/ 2 KB
2 KB 22ms
20ms Image
image/svg+xml 2600:9000:21f3:3000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6536e5317bf92f62050c3585/6564ef5d3a4cb7b5ea3a9057_LinkedIn_white_line_icon.svg
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f1214dfeb93c377d705ff4e3fa4026b177b09bd78db8c58fec8bed76042b22cb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 20 Feb 2024 12:12:44 GMT
x-amz-version-id: AcNyFpFI8aAA28ygKmwAtygggpeL.GKB
content-encoding: br
via: 1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age: 1432817
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Mon, 27 Nov 2023 19:34:54 GMT
server: AmazonS3
etag: W/"3649d7f32b11c2eeaf07d7c3e255b3e4"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
x-amz-cf-id: myhGFtZWwK272TQ_o844DJi3Zweq42oHWWXqKNQY11v-TDUVL_BpWw==

GET
H2 200 6564ef5d3a4cb7b5ea3a9056_Twitter_X_white_line_icon.svg
assets-global.website-files.com/6536e5317bf92f62050c3585/ 2 KB
1 KB 20ms
18ms Image
image/svg+xml 2600:9000:21f3:3000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6536e5317bf92f62050c3585/6564ef5d3a4cb7b5ea3a9056_Twitter_X_white_line_icon.svg
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bb1bf908b6409ef06648805751d0ab2b5266bb25cd8649f42ebdb555dba577d1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 20 Feb 2024 12:12:44 GMT
x-amz-version-id: LRWTCcxe1O67SFrUHw2p7xzNiJE9t1LM
content-encoding: br
via: 1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age: 1432817
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Mon, 27 Nov 2023 19:34:54 GMT
server: AmazonS3
etag: W/"ec3df19575f6b8918daab65f4a4395fe"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
x-amz-cf-id: oJItX1uoyzc-VCxyWTEig4B5wqzge7GOIEEoG5_iULeGpFk9PN_rNg==

GET
H2 200 6564ef5d3a4cb7b5ea3a9055_FaceBook_white_line_icon.svg
assets-global.website-files.com/6536e5317bf92f62050c3585/ 2 KB
1 KB 15ms
13ms Image
image/svg+xml 2600:9000:21f3:3000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6536e5317bf92f62050c3585/6564ef5d3a4cb7b5ea3a9055_FaceBook_white_line_icon.svg
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 573a481f2f09d26d3f240670b5e8fe7c9660e34b8b436bf6b40edf291e9e410d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 20 Feb 2024 12:12:44 GMT
x-amz-version-id: o7JKEdLK6GcbVtAiHBiLffzSk0uBmM7J
content-encoding: br
via: 1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age: 1432817
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Mon, 27 Nov 2023 19:34:54 GMT
server: AmazonS3
etag: W/"c306b7effae56674b98577f22bb9f84f"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
x-amz-cf-id: xF6oa97Q5QPp9OKq4Kre0zRoV4o35jX8Q4y5X1PSEjFiGTN2JPsAZg==

GET
H2 200 659c987cfb5d1e96866d5723_email_white_line_icon.svg
assets-global.website-files.com/6536e5317bf92f62050c3585/ 2 KB
1 KB 16ms
14ms Image
image/svg+xml 2600:9000:21f3:3000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6536e5317bf92f62050c3585/659c987cfb5d1e96866d5723_email_white_line_icon.svg
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6ded09789782fad99733cac6a94fc617f55aae1605849fa40c2b21db8a5eec34

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 20 Feb 2024 12:17:01 GMT
x-amz-version-id: fG1pMh0vPM9GwN628Hq8vJ4YzhiRfPiK
content-encoding: br
via: 1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age: 1432560
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 09 Jan 2024 00:51:10 GMT
server: AmazonS3
etag: W/"6bb63141af64165f33d46a4826528814"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
x-amz-cf-id: cpnnq6_XBfkQER96jAeTBCjwhQo-QUir0kpElumT4K4upo2AyM_j0g==

GET
H2 200 656e5ec4e41e78f4e7fd8ce1_Menlo_Purple%20Lattice-Texture_4.svg
assets-global.website-files.com/6536e5317bf92f62050c3585/ 8 KB
1 KB 22ms
21ms Image
image/svg+xml 2600:9000:21f3:3000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6536e5317bf92f62050c3585/656e5ec4e41e78f4e7fd8ce1_Menlo_Purple%20Lattice-Texture_4.svg
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 22d3654d0da0d0173edfa54dfd902133375983447b6eb86a60f3daf6d69b22f5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 20 Feb 2024 12:08:59 GMT
x-amz-version-id: r8c2Yk6zhXTsE9e5jm_f1PZhSwzL6mny
content-encoding: br
via: 1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age: 1433042
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Mon, 04 Dec 2023 23:20:38 GMT
server: AmazonS3
etag: W/"81022121e4b159d29dce49d55ce312d4"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
x-amz-cf-id: yKbnGiwNcaENj1oD3AvSrLN2GoOUYyQMQIc5S03lyBDdKxwmgWOYHg==

GET
H2 200 65e8c6883f96ad1bfc9919d1_Blog_Screen_01.png
assets-global.website-files.com/65565a6ae1bebedfef4026ca/ 78 KB
79 KB 23ms
22ms Image
image/png 2600:9000:21f3:3000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/65565a6ae1bebedfef4026ca/65e8c6883f96ad1bfc9919d1_Blog_Screen_01.png
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: eb7b0d4f40dfd54bee18b1684871b5980c78849a361a6f34e5381f4fd542bbe4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Thu, 07 Mar 2024 08:08:47 GMT
x-amz-version-id: UeWD47MJPhkhSN3qw7zGnu2noqCUQmNp
via: 1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age: 65054
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 80365
last-modified: Wed, 06 Mar 2024 19:41:44 GMT
server: AmazonS3
etag: "a858224db9ae4b9ee72c8fff18604874"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: m6ylkHJSrYWhAa3amWV_Vj2A0oxklZg1vDLVq0DWgWe81ydKSVidSg==

GET
H2 200 65e8c800a2e1939006d5f76d_blog_screen_2.png
assets-global.website-files.com/65565a6ae1bebedfef4026ca/ 252 KB
252 KB 25ms
23ms Image
image/png 2600:9000:21f3:3000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/65565a6ae1bebedfef4026ca/65e8c800a2e1939006d5f76d_blog_screen_2.png
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0f38a964a84c215c4800a13ecfaee4a670e1a0e3d3192c07390b751c14be668f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Thu, 07 Mar 2024 08:10:02 GMT
x-amz-version-id: 7ktCulkx_Kff0h5qTy11.Zfo_mQdfK38
via: 1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age: 64978
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 257629
last-modified: Wed, 06 Mar 2024 19:46:10 GMT
server: AmazonS3
etag: "79f7ae22722be11b73ed1841acbcc30c"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: 7ykE6rvuogK4MMl6_bVtC1jFPEbPNcg8eQLFyb-b7LDxlYAi4HkQxw==

GET
H2 200 65e8c87a84a68fd44424965d_Menlo_2024-03-05%20175525.png
assets-global.website-files.com/65565a6ae1bebedfef4026ca/ 150 KB
151 KB 32ms
31ms Image
image/png 2600:9000:21f3:3000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/65565a6ae1bebedfef4026ca/65e8c87a84a68fd44424965d_Menlo_2024-03-05%20175525.png
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8ddd10e57216c5eb30b31d9ac0726513c061fbfc031ae0e770ac3c3fd23939b0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Thu, 07 Mar 2024 08:11:52 GMT
x-amz-version-id: .8F7Iix0Sw2P2uFJf2XLjn7EpYkM7oFE
via: 1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age: 64869
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 153888
last-modified: Wed, 06 Mar 2024 19:48:11 GMT
server: AmazonS3
etag: "0bfea2d0741bae6705ad9dd960d5f64c"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: 6b7IHU_89iQMOfwel6EpmPKcs8u-iAkIVIjKBgApco7kcn502vKfCA==

GET
H2 200 65e8c89b53cd49f7d456ff39_Blog_Screen_04.png
assets-global.website-files.com/65565a6ae1bebedfef4026ca/ 110 KB
110 KB 37ms
36ms Image
image/png 2600:9000:21f3:3000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/65565a6ae1bebedfef4026ca/65e8c89b53cd49f7d456ff39_Blog_Screen_04.png
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7a6c575f655333b6d141e511e77fd65a5f7e184f41d4478aa1f58fd84f9c4bf2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Thu, 07 Mar 2024 08:11:52 GMT
x-amz-version-id: aF4sgM5FqMcZzXXz_GjUX1ZiIg80fvhd
via: 1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age: 64869
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 112159
last-modified: Wed, 06 Mar 2024 19:48:44 GMT
server: AmazonS3
etag: "89ec56bc650bd7bc097446cce6921dc8"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: tblx-i0qrTDORovB4x94n8tRkDIxSRdYLcJ8QFU98QqSzsqixNbwrg==

GET
H2 200 65e8c8a6fddc8c81df616219_Menlo_2024-03-05%20at%201.00.40%20PM.png
assets-global.website-files.com/65565a6ae1bebedfef4026ca/ 32 KB
32 KB 44ms
43ms Image
image/png 2600:9000:21f3:3000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/65565a6ae1bebedfef4026ca/65e8c8a6fddc8c81df616219_Menlo_2024-03-05%20at%201.00.40%20PM.png
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0c0394725992f1134128106b3e6aa8539df425f1d31502af4b5a5d80c491f09d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Thu, 07 Mar 2024 08:11:52 GMT
x-amz-version-id: wmG1z1sO5yGEW1WcniXyTW7RMZROZrcK
via: 1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age: 64869
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 32356
last-modified: Wed, 06 Mar 2024 19:48:55 GMT
server: AmazonS3
etag: "fa743ce68ae23b0225fb26970e818374"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: ysdFTdENPipA-QKqDhXWCrCz2Ir0N8OgVqeK_9qDQty4LKY7sBH21g==

GET
H2 200 65e8c8da9714a881061dfa51_Blog_Screen_06.png
assets-global.website-files.com/65565a6ae1bebedfef4026ca/ 91 KB
92 KB 39ms
38ms Image
image/png 2600:9000:21f3:3000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/65565a6ae1bebedfef4026ca/65e8c8da9714a881061dfa51_Blog_Screen_06.png
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b3c0cc52d8afeca5bab92395f05b637edb8aca01984a27c8bdb09063ea4a7fb1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Thu, 07 Mar 2024 08:13:08 GMT
x-amz-version-id: yCLDHKNGfDa7YR9kdTNODTcXBli8sUnH
via: 1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age: 64793
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 93270
last-modified: Wed, 06 Mar 2024 19:49:47 GMT
server: AmazonS3
etag: "5ad928464150634930ede01186d94c69"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: PJ0TstzWDJnQxIAJOQqJpezgvt4OX7tEns-7oZIjnoj2QMaxzgv7nQ==

GET
H2 200 65e8c901a47f99aebd54c783_Menlo-image8.png
assets-global.website-files.com/65565a6ae1bebedfef4026ca/ 63 KB
64 KB 45ms
44ms Image
image/png 2600:9000:21f3:3000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/65565a6ae1bebedfef4026ca/65e8c901a47f99aebd54c783_Menlo-image8.png
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5e27c97d4b8a6e111aad8f35ce23fe933939422d9a57012b26ae23bd8bdc61a0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Thu, 07 Mar 2024 08:13:08 GMT
x-amz-version-id: xwcIYpvQhoV_eabTfam7DApPpUnZhvB5
via: 1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age: 64793
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 64788
last-modified: Wed, 06 Mar 2024 19:50:26 GMT
server: AmazonS3
etag: "e7624742144e326bafba4fcc25fbc57f"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: wvOxT5Yj8M7RFAU4eZncndj0ab7JR05zMCbZ5wVdsyK9gHCnL_fr9w==

GET
H2 200 65e8c917b85cad0cdf33df4a_Blog_Screen_08.png
assets-global.website-files.com/65565a6ae1bebedfef4026ca/ 29 KB
29 KB 47ms
46ms Image
image/png 2600:9000:21f3:3000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/65565a6ae1bebedfef4026ca/65e8c917b85cad0cdf33df4a_Blog_Screen_08.png
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0792fff034e8b1fdfcbb22d7d88975107ca0690c6abf94c7062d7b70e358d685

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Thu, 07 Mar 2024 08:13:08 GMT
x-amz-version-id: PfM9i2..bIzmyJ7325OOjuAf_KBwtQ..
via: 1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age: 64793
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 29713
last-modified: Wed, 06 Mar 2024 19:50:49 GMT
server: AmazonS3
etag: "0b898e8fe6f765a0916035410b690cd4"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: r17YkBlkrlzIao_pGhnf3c8R2o0oywp_Qr68jpRzfg9twdQahljaXg==

GET
H2 200 65e8c93ed0c7fe86b0fa7dd9_Menlo_image7.png
assets-global.website-files.com/65565a6ae1bebedfef4026ca/ 189 KB
189 KB 41ms
40ms Image
image/png 2600:9000:21f3:3000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/65565a6ae1bebedfef4026ca/65e8c93ed0c7fe86b0fa7dd9_Menlo_image7.png
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 765bc4a5ded7b07d8c79ddb69ba1ad38c31490c7ed121b2c54b07f36c6d4aa3d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Thu, 07 Mar 2024 08:13:08 GMT
x-amz-version-id: xyZaWACcCKTbODPRZlVIIrDCDf5sKVTC
via: 1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age: 64793
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 193231
last-modified: Wed, 06 Mar 2024 19:51:27 GMT
server: AmazonS3
etag: "3ae58b4c66d62d6889bf446606f5bde4"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: F0TWJazRIbi4mqeya06078pLRtNamWL51D8XlkKrTK0btJ6y6znA1Q==

GET
H2 200 65e8c9ad9113df9de6a816bf_blog-image-code.png
assets-global.website-files.com/65565a6ae1bebedfef4026ca/ 17 KB
17 KB 46ms
45ms Image
image/png 2600:9000:21f3:3000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/65565a6ae1bebedfef4026ca/65e8c9ad9113df9de6a816bf_blog-image-code.png
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0f99115ee08c4024147bfe1601edf3e7066e4d971afd4fa4a1c55c9aee360c42

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Thu, 07 Mar 2024 08:16:35 GMT
x-amz-version-id: MooWeTkiKc_xS8aE5My04UQmhrBreTBt
via: 1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age: 64586
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 17271
last-modified: Wed, 06 Mar 2024 19:53:18 GMT
server: AmazonS3
etag: "b9eb971f5dcfe20e16a419dd8928061c"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: xi29W45BkMLlH1G4fmehiULeTON9PTqPfhjtS2_X8jG_UFff3Ms8Cg==

GET
H2 200 65e8c9c8ecf4d14f7cc1b8a4_Blog_Screen_10.png
assets-global.website-files.com/65565a6ae1bebedfef4026ca/ 31 KB
32 KB 35ms
34ms Image
image/png 2600:9000:21f3:3000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/65565a6ae1bebedfef4026ca/65e8c9c8ecf4d14f7cc1b8a4_Blog_Screen_10.png
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: af76b5b4009f30b15d718ac8ce49f23fc5eef560c5c0a97c6b1e93d64758ad09

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Thu, 07 Mar 2024 08:16:35 GMT
x-amz-version-id: xnDgNCoft.pZHJJnxEvS0BNPXbISnfei
via: 1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age: 64586
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 32047
last-modified: Wed, 06 Mar 2024 19:53:45 GMT
server: AmazonS3
etag: "6c0eeb420f4dd54cb4a1a541acce8211"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: tswSmXDetWkQ7Agdgyx8w4rx15ae38ikLS3efMRNEGIc21YZp5ZJww==

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 66 B
303 B 64ms
30ms XHR
application/json 2606:4700:4400::ac40:9b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f90d159c7a961f8d49cf0197de9f4a31f91310b5cd03edc042f82beae766c88b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept: application/json
Referer: https://www.menlosecurity.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 860f4db5aabf3aa3-FRA
access-control-allow-headers: Content-Type

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202401.2.0/ 429 KB
104 KB 14ms
14ms Script
application/javascript 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202401.2.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

619961cc5419607d2024e330d6c57c6574bf7610260fb43362fbbcc800854d5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 08 Mar 2024 02:13:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: S1Y6/40RYuKp4yHMipHDTg==
age: 57405
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 106707
x-ms-lease-status: unlocked
last-modified: Mon, 26 Feb 2024 03:25:08 GMT
server: cloudflare
etag: 0x8DC367A88B71ACE
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 9c2ae3a7-001e-0072-3a8f-683ecc000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 860f4db60e3119b1-FRA

GET
H2 200 getForm Show response
info.menlosecurity.com/index.php/form/ 23 KB
5 KB 80ms
79ms Script
application/javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://info.menlosecurity.com/index.php/form/getForm?munchkinId=281-OWV-899&form=2571&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom&callback=jQuery371038627247309098145_1709863980474&_=1709863980475
Requested by: Host: info.menlosecurity.com
URL: https://info.menlosecurity.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 67faf4e806b2ab874a9661a0140c5f9448de6bcb671f8fc1fea97c9f1e0ee2e0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:00 GMT
content-encoding: gzip
server: cloudflare
cf-ray: 860f4db609335d93-FRA
cached: true
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8

GET
H2 200 6564ef5d3a4cb7b5ea3a9059_Footer_grad_background_01.svg
assets-global.website-files.com/6536e5317bf92f62050c3585/ 963 B
1 KB 9ms
9ms Image
image/svg+xml 2600:9000:21f3:3000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6536e5317bf92f62050c3585/6564ef5d3a4cb7b5ea3a9059_Footer_grad_background_01.svg
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6536e5317bf92f62050c3585/css/menlo-dev.03daca6f1.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 24f95156ad08aa62d037edcb9140e7525436ae784cb8dbf827e4dd73c049a9c7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://assets-global.website-files.com/6536e5317bf92f62050c3585/css/menlo-dev.03daca6f1.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 07:05:59 GMT
x-amz-version-id: wZrIwSiQ3HB_4mBj4RzB_7r35bkJm7eb
via: 1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age: 1364822
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 963
last-modified: Mon, 27 Nov 2023 19:34:54 GMT
server: AmazonS3
etag: "06bc9b55903dee3955c218722211ea0b"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: ZR_zUPN_qIdsGur-Ywqzp-RpbVCO7AJEyv87f07zIJKRuFEmTI-2_g==

GET
H2 200 659d74d1fd14b8b43c2954f8_privacyoptions-gry.png
assets-global.website-files.com/6536e5317bf92f62050c3585/ 445 B
900 B 10ms
10ms Image
image/png 2600:9000:21f3:3000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6536e5317bf92f62050c3585/659d74d1fd14b8b43c2954f8_privacyoptions-gry.png
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6536e5317bf92f62050c3585/css/menlo-dev.03daca6f1.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cce437faf73c67f2163692a58b9a23a154facef1d77fe1ae8ad189659b56a93a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://assets-global.website-files.com/6536e5317bf92f62050c3585/css/menlo-dev.03daca6f1.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 20 Feb 2024 15:48:29 GMT
x-amz-version-id: qGQd80XCMBzwZfe3ECBhNqfx2KNpdjGz
via: 1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age: 1419872
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 445
last-modified: Tue, 09 Jan 2024 16:31:14 GMT
server: AmazonS3
etag: "b6ed571ffee761eed42633f077351e2f"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: I3ibtgGxOzeLhE1_pOUQQHLRknfRQllzTv73SBvqQeizXx6gw7K7yw==

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/1a750de4-f18f-43d4-8b13-4ead3aa824f4/dc74ce06-9a6b-4b0d-b927-351a98b6edc7/ 87 KB
21 KB 22ms
21ms Fetch
application/x-javascript 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/1a750de4-f18f-43d4-8b13-4ead3aa824f4/dc74ce06-9a6b-4b0d-b927-351a98b6edc7/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202401.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d7530a198af9b1342dfe307c6ab4dc6169d83147b660bf5bfd0743b98914244

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 08 Mar 2024 02:13:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 44507
content-md5: 7dU7W95CmGZ580W1L8Ikhg==
content-length: 21149
x-ms-lease-status: unlocked
last-modified: Thu, 22 Feb 2024 17:45:08 GMT
server: cloudflare
etag: 0x8DC33CE0324DC60
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 81c06e48-201e-0075-6eb9-6552af000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 860f4db65b2c9293-FRA
expires: Sat, 09 Mar 2024 02:13:00 GMT

GET
H2 200 otFloatingFlat.json Show response
cdn.cookielaw.org/scripttemplates/202401.2.0/assets/ 10 KB
3 KB 17ms
16ms Fetch
application/json 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202401.2.0/assets/otFloatingFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202401.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3321757433351762495ef3452adf0fcefa179583f4409dd04815c710c5e45f6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 08 Mar 2024 02:13:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: kyQFhMGziMN4xJToJUfDqQ==
age: 78828
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 2707
x-ms-lease-status: unlocked
last-modified: Mon, 26 Feb 2024 03:25:03 GMT
server: cloudflare
etag: 0x8DC367A858C4294
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: a46915a9-701e-00a3-0ae1-685c46000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 860f4db68b399293-FRA

GET
H2 200 otPcTab.json Show response
cdn.cookielaw.org/scripttemplates/202401.2.0/assets/v2/ 63 KB
13 KB 39ms
39ms Fetch
application/json 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202401.2.0/assets/v2/otPcTab.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202401.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d18f313f2489ed91cd15cf94a1e5668b8b0da8318f593d980228000a1757702f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 08 Mar 2024 02:13:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: +VcLy0Fhvi3ZWKBwz9NNzQ==
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 13587
x-ms-lease-status: unlocked
last-modified: Thu, 07 Mar 2024 11:26:24 GMT
server: cloudflare
etag: 0x8DC3E996C0939E8
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: cd0e65d1-d01e-002c-53d6-70d52c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 860f4db68b3a9293-FRA

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202401.2.0/assets/ 21 KB
4 KB 15ms
15ms Fetch
text/css 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202401.2.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202401.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d3f7b0ec4de079928a999641e781e80f33597a392a561bc460276dfb4efb6eec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 08 Mar 2024 02:13:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: c7xAZ9MSGAobGaTYg/Qtag==
age: 78828
x-ms-lease-status: unlocked
last-modified: Mon, 26 Feb 2024 03:25:13 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 28d984d0-301e-00a2-5ae2-68039a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 860f4db68b3b9293-FRA

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 309 KB
99 KB 66ms
65ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-C2G0PCSJKE&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

85cefebcde30bec3004dcf9762a67ae9d37bc38861797875f939b04c8cb7f773

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:00 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 101060
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 08 Mar 2024 02:13:00 GMT

GET
H2 200 9d098b8d-9cde-40ee-beab-3b850059beba.js Show response
j.6sc.co/j/ 4 KB
2 KB 565ms
455ms Script
application/javascript 95.101.133.17
TWELVE99 Arelion

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/j/9d098b8d-9cde-40ee-beab-3b850059beba.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.133.17 Liljeholmen, Sweden, ASN1299 (TWELVE99 Arelion, fka Telia Carrier, SE),
Reverse DNS: a95-101-133-17.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 2a4274b3cc3e0f1c657d92cd91051243635cf08951925f7dabcf24ce7005b0d0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

x-amz-version-id: 2xVIr_VLK.K69VKXDZbBKfWOdjNXST5u
content-encoding: gzip
date: Fri, 08 Mar 2024 02:13:01 GMT
x-amz-cf-pop: ARN54-C1
x-amz-server-side-encryption: AES256
x-amz-meta-content-type: application/json
content-length: 1456
pragma: no-cache
last-modified: Thu, 04 Jan 2024 00:00:45 GMT
server: AmazonS3
etag: "a78e9f870ad4c64f810b2020cca5d9ee"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
x-amz-cf-id: V9xNRskJ2p2oZz_hXBU487vv48U8YFp9x2192fRrySKGrAy-8GodKg==
expires: Fri, 08 Mar 2024 02:13:01 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 34ms
6ms Script
application/javascript 146.75.120.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.120.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:00 GMT
content-encoding: gzip
last-modified: Thu, 27 Oct 2022 16:56:53 GMT
etag: "32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary: Accept-Encoding,Host
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15375
x-served-by: cache-iad-kjyo7100081-IAD, cache-fra-etou8220128-FRA

GET
H2 200 hotjar-1854968.js Show response
static.hotjar.com/c/ 9 KB
4 KB 64ms
36ms Script
application/javascript 18.66.97.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-1854968.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.97.10 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-97-10.fra56.r.cloudfront.net

Software

Resource Hash

aedfc08757725003aafc414d0569933c83079a162d289045774bbf1d962c9904

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
date: Fri, 08 Mar 2024 02:13:00 GMT
via: 1.1 84294257ed643a88ee54d2e3f7d7ccea.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
etag: W/58a60f4390df0cb1f4ef00716abc6059
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
cache-control: max-age=60
cross-origin-resource-policy: cross-origin
x-amz-cf-id: hTBHkiesvJXf6bKnwjGyYbzenTQRW83_DsWyKfJDsdwkq2WhM1HVzg==

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 218 KB
78 KB 53ms
51ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-684820168&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d0c5f2e5b712f3ee9c6b36456d2cb84b79487e725b52124ee718c8ba1cb25e2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:00 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 79937
x-xss-protection: 0
last-modified: Fri, 08 Mar 2024 00:09:27 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 08 Mar 2024 02:13:00 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 48 KB
17 KB 47ms
8ms Script
application/javascript 2a02:26f0:480:f::213:7ec6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

5cd16f5174d4f1eaf208272602ce6316ddf308953db343d03f9b5d0ea273351f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 645
date: Fri, 08 Mar 2024 02:13:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 06 Mar 2024 17:13:32 GMT
x-cdn: AKAM
x-edgeconnect-midmile-rtt: 1
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=45471
accept-ranges: bytes
content-length: 17198

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 159 KB
61 KB 96ms
95ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-10976805707&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e88885832ddb949ccdcd104617572a936a43ba12c93d8247ec3088fa15852501

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:00 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61928
x-xss-protection: 0
last-modified: Fri, 08 Mar 2024 00:09:27 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 08 Mar 2024 02:13:00 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 215 KB
58 KB 25ms
11ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

50b6e67cfcfe4ac8fe9cee705b681f696065306ee42bcd4e6b37a17dba333ac5

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

permissions-policy-report-only: clipboard-read=();report-to="permissions_policy"
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 08 Mar 2024 02:13:00 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57348
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
pragma: public
x-fb-debug: LZzpZXV8WrqBsoyo0aRyUlFFQoVFYjfxbBlUTj+W4HNgdEKJEt9jTdJGOltjSIaAAmbOpodEp+zBgn7uoPafcw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 39ms
10ms Script
application/x-javascript 23.192.243.198
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.243.198 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-243-198.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Fri, 08 Mar 2024 02:13:00 GMT
Content-Encoding: gzip
Last-Modified: Fri, 17 Mar 2023 01:24:48 GMT
Server: AkamaiNetStorage
ETag: "cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary: Accept-Encoding
Content-Type: application/x-javascript
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 729

GET
H2 200 widget.js Show response
app.hushly.com/runtime/ 1 KB
2 KB 561ms
183ms Script
text/javascript 44.240.168.231
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://app.hushly.com/runtime/widget.js?aid=83162

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.240.168.231 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-240-168-231.us-west-2.compute.amazonaws.com

Software

Resource Hash

f63e2629d38d4459720800ab6343b53db8abaa24e3b347275af296267b0ba102

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Mar 2024 02:13:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-security-policy
content-type: text/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 trrsm2wf4gwm.js Show response
js.driftt.com/include/1709864100000/ 220 KB
62 KB 164ms
123ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1709864100000/trrsm2wf4gwm.js

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

67ef71c562c9dac26243f44f029b68a3b3f4f6083db04d0e77ca14cb4b6ef945

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:00 GMT
x-amz-version-id: 20qtyJY8U29vmNnLZfihA.YjkBf84.9Q
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Tue, 05 Mar 2024 20:54:03 GMT
server: istio-envoy
etag: W/"b55ba92afc26d4e52ce94a1c62e3822d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: axk7Im_SUpM7Z5C4BlvGoPi2fBO9a7BuVafPhlgiiyNjdqprHSvJzQ==

GET
H2 200 fullcircle.js Show response
d2i34c80a0ftze.cloudfront.net/ 32 KB
11 KB 45ms
7ms Script
application/json 2600:9000:275b:8a00:9:14eb:6280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=187d2103-bdc5-4e3f-b070-b5c6a4000840&domain=menlosecurity.com
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:275b:8a00:9:14eb:6280:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 5f8ece9fc3c316bd78480ef2f48dc82b47f84a1a2a39ddd4a0fec27a720cae41

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Thu, 07 Mar 2024 05:28:21 GMT
via: 1.1 cae542650fb32c773cc494fc6e7e71e6.cloudfront.net (CloudFront), 1.1 a991dcd8f589d8cb7c64929ec2a499b2.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: FRA56-C1, FRA60-P7
age: 74679
x-amzn-requestid: 5aa7cda5-38b4-4e4b-baee-ffc2f9b105b8
x-amzn-trace-id: Root=1-65e95075-332dd9eb08ad732d0fe7ba40;Parent=4845d9791236030b;Sampled=0;lineage=be50798f:0
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
x-amz-apigw-id: UPmCXHxdPHcEJwQ=
x-amz-cf-id: 9WAQFzAHAW6jwOCKAuY3u3F8LhtyGcaHBVcgBVJCmV9_Xa8sp64H_A==

GET
H2 200 tracking.js Show response
trk.techtarget.com/ 3 KB
2 KB 80ms
41ms Script
text/javascript 2606:4700:4400::6812:24c4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://trk.techtarget.com/tracking.js
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:24c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:00 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Tue, 13 Dec 2022 15:01:39 GMT
server: cloudflare
age: 67735
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1200
cf-ray: 860f4db72f534d37-FRA
expires: Fri, 08 Mar 2024 02:33:00 GMT

GET
H2 200 sl.js Show response
scout-cdn.salesloft.com/ 6 KB
3 KB 104ms
15ms Script
application/javascript 2606:4700::6811:4341
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://scout-cdn.salesloft.com/sl.js

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4341 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4a007af67f716c30c8848ab0ad0bfaab8a5fcf3e36dedf918b59c9429d522440

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:00 GMT
x-amz-version-id: 6anzvBQcvmaBDc8BSO9zI6Th.IIiwArc
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: KEADHYP9ZCZ9R3D0
age: 1655
alt-svc: h3=":443"; ma=86400
x-amz-id-2: EwylhirLpA9DI6Kq3fCLjqc/1bkW5GR8odkMlK6IpHICWvVX9IDmrw3eUwpsnLyktTXgnHxXyEU=
last-modified: Mon, 13 Dec 2021 16:28:37 GMT
server: cloudflare
etag: W/"d74cc4825c8e333b2116da3fcc649db1"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 860f4db7781019ad-FRA
expires: Fri, 08 Mar 2024 06:13:00 GMT

GET
H2 200 79031691.js Show response
extend.vimeocdn.com/ga/ 17 KB
6 KB 28ms
6ms Script
text/javascript 146.75.118.109
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://extend.vimeocdn.com/ga/79031691.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.118.109 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: Apache /
Resource Hash: 6c649cc3d4aee7683250622541a6045ad4ac3beb93df1fcdd3ec1f7f12a1ff44

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

x-cache-hits: 78367
date: Fri, 08 Mar 2024 02:13:00 GMT
content-encoding: gzip
via: 1.1 varnish
age: 3797767
x-cache: HIT
content-length: 5579
x-served-by: cache-fra-eddf8230127-FRA
last-modified: Wed, 24 Jan 2024 01:39:14 GMT
server: Apache
x-timer: S1709863981.646080,VS0,VE0
etag: "421e-60fa7215d9480-gzip"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
x-vimeo-dc: ge
x-bapp-server: assets-77db85df4d-dg6pg
cache-control: max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 21 Jan 2034 03:16:53 GMT

GET
H2 200 forms2.css
info.menlosecurity.com/js/forms2/css/ 13 KB
3 KB 29ms
28ms Stylesheet
text/css 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.menlosecurity.com/js/forms2/css/forms2.css

Requested by

Host: info.menlosecurity.com
URL: https://info.menlosecurity.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Fri, 05 Jan 2024 00:21:30 GMT
server: cloudflare
age: 2363
etag: "580082-3437-60e27d4627680"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 860f4db6a96b5d93-FRA
content-length: 2623
expires: Fri, 08 Mar 2024 06:13:00 GMT

GET
H2 200 forms2-theme-plain.css
info.menlosecurity.com/js/forms2/css/ 828 B
331 B 30ms
29ms Stylesheet
text/css 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.menlosecurity.com/js/forms2/css/forms2-theme-plain.css

Requested by

Host: info.menlosecurity.com
URL: https://info.menlosecurity.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Fri, 05 Jan 2024 00:21:30 GMT
server: cloudflare
age: 2364
etag: "1e015c1-33c-60e27d4627680"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 860f4db6a96c5d93-FRA
content-length: 246
expires: Fri, 08 Mar 2024 06:13:00 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
964 B 122ms
44ms Stylesheet
text/css 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Raleway

Requested by

Host: info.menlosecurity.com
URL: https://info.menlosecurity.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0c7b39faa08dbf48372cc45d4f2b8f05c5626dacdf9b06d1062cc43b480809a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 08 Mar 2024 02:13:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 08 Mar 2024 00:38:22 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 08 Mar 2024 02:13:00 GMT

GET
H2 200 ot_close.svg
cdn.cookielaw.org/logos/static/ 651 B
600 B 16ms
16ms Image
image/svg+xml 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_close.svg

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 08 Mar 2024 02:13:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: pcXWFGpuVeSg/jVnYCseRg==
age: 75670
x-ms-lease-status: unlocked
last-modified: Wed, 06 Mar 2024 17:32:18 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 5513c75a-701e-0068-1a4b-705f13000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 860f4db6fee119b1-FRA

GET
H2 200 ot_guard_logo.svg Show response
cdn.cookielaw.org/logos/static/ 497 B
489 B 16ms
16ms Fetch
image/svg+xml 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202401.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 08 Mar 2024 02:13:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: tXyZydHjxQshFMbbBT1/8A==
age: 54494
x-ms-lease-status: unlocked
last-modified: Wed, 06 Mar 2024 17:32:17 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: c1b1cc58-101e-00a5-0f13-706ff9000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 860f4db70b6a9293-FRA

GET
H2 200 Logo_MenloSecurity_Signature_Purple_RGB.png
cdn.cookielaw.org/logos/2f43eebf-9aac-4632-87e4-6268b1418b72/90dd6f8b-4c69-4515-bc68-3c27f610be65/9430bd48-82b5-4ae6-b08d-761d94b06151/ 12 KB
12 KB 33ms
33ms Image
image/png 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/2f43eebf-9aac-4632-87e4-6268b1418b72/90dd6f8b-4c69-4515-bc68-3c27f610be65/9430bd48-82b5-4ae6-b08d-761d94b06151/Logo_MenloSecurity_Signature_Purple_RGB.png

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

073b97779f9dc3c731a8c153f3f8dcfe2dc8f99a2c5ad7a279361a08e0302dc0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 08 Mar 2024 02:13:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: lwzbnoHyDnRH4s89KRrv8A==
content-length: 12496
x-ms-lease-status: unlocked
last-modified: Tue, 29 Jun 2021 19:44:30 GMT
server: cloudflare
etag: 0x8D93B364FFCA162
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: 41affbe8-c01e-0042-0a42-148003000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 860f4db70eea19b1-FRA

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 5 KB
2 KB 16ms
16ms Image
image/svg+xml 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 08 Mar 2024 02:13:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: Y+c301RBZNK39PvKQWrIBw==
age: 31587
x-ms-lease-status: unlocked
last-modified: Wed, 06 Mar 2024 17:32:18 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 7427f5f5-b01e-0083-1343-7027e1000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 860f4db70eec19b1-FRA

GET
H2 200 adsct
t.co/i/ 43 B
377 B 130ms
109ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=30cea1c3-e2f2-44eb-8c73-4a021b73c02f&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=1f8ee4bd-c827-4a29-b5e2-09f7d209f7e0&tw_document_href=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nx5nr&type=javascript&version=2.3.29

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

x-response-time: 103
date: Fri, 08 Mar 2024 02:13:00 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 13c7ef723c4e50cf
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: 2169ae4c452557fa3155660716876b83ba7cabb9f964dbb1a07001f07f36f8d8
content-length: 43

GET adsct
analytics.twitter.com/i/ 0
0

GET
H2 200 1626328370711236 Show response
connect.facebook.net/signals/config/ 62 KB
13 KB 81ms
81ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1626328370711236?v=2.9.148&r=stable&domain=www.menlosecurity.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3f3068231d5307bef2c322de2866522c7c88c1f9297145cd31324e3c64a8f3dc

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

permissions-policy-report-only: clipboard-read=();report-to="permissions_policy"
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 08 Mar 2024 02:13:00 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
pragma: public
x-fb-debug: DAyGnrBqi0ZpOeyTYt0TUiWFuZzv8UZ4NjzMgrzCA6GZneVY88B59+TNh5vYje8XLWAeBNAp3/9zCKjwb2u9bQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/163/ 11 KB
5 KB 11ms
11ms Script
application/x-javascript 23.192.243.198
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/163/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.243.198 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-243-198.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Fri, 08 Mar 2024 02:13:00 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Jan 2023 02:26:40 GMT
Server: AkamaiNetStorage
ETag: "ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary: Accept-Encoding
Content-Type: application/x-javascript
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4741
Expires: Sun, 16 Jun 2024 02:13:00 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1709863980682&li_adsId=81678573-464c-4ff1-9a37-397ffc3b3952&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affilia...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1709863980682&li_adsId=81678573-464c-4ff1-9a37-397ffc3b3952&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affilia...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D474058%26time%3D1709863980682%26li_adsId%3D81678573-464c-4ff1-9a37-397ffc3b3952%2...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1709863980682&li_adsId=81678573-464c-4ff1-9a37-397ffc3b3952&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affilia...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1709863980682&li_adsId=81678573-464c-4ff1-9a37-397ffc3b3952&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affili...

0
265 B

188ms
164ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1709863980682&li_adsId=81678573-464c-4ff1-9a37-397ffc3b3952&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom&cookiesTest=true&liSync=true&e_ipv6=AQJJYVCOt_wkCAAAAY4b1dDDdDbDTCVtwFpQOWdyhRkEZQoTAwavzJFyhH38I-Gs-vfJs_7i
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:00 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: ABC9605ECA1946AAA1216D0F1569C5FB Ref B: FRAEDGE1518 Ref C: 2024-03-08T02:13:01Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYTHLs6CuS1uem+KwOjNg==

Redirect headers

date: Fri, 08 Mar 2024 02:13:00 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 843860B5376847CE9612CCFCE995FE2A Ref B: FRAEDGE1705 Ref C: 2024-03-08T02:13:01Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1709863980682&li_adsId=81678573-464c-4ff1-9a37-397ffc3b3952&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom&cookiesTest=true&liSync=true&e_ipv6=AQJJYVCOt_wkCAAAAY4b1dDDdDbDTCVtwFpQOWdyhRkEZQoTAwavzJFyhH38I-Gs-vfJs_7i
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYTHLs3YXvpP/mLczUAOw==

GET
H2 200 XDFrame Show response
info.menlosecurity.com/index.php/form/ Frame 92A0 2 KB
869 B 175ms
175ms Document
text/html 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.menlosecurity.com/index.php/form/XDFrame

Requested by

Host: info.menlosecurity.com
URL: https://info.menlosecurity.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b43508242f21a59b37bba45231dd25c6c861e079ef05607273c620337e217b9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.menlosecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=3600
cf-cache-status: DYNAMIC
cf-ray: 860f4db759a55d93-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 08 Mar 2024 02:13:00 GMT
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H2 200 modules.478d49d6cc21ec95d184.js Show response
script.hotjar.com/ 221 KB
55 KB 39ms
8ms Script
application/javascript 13.32.27.107
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.478d49d6cc21ec95d184.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1854968.js?sv=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.27.107 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-27-107.fra56.r.cloudfront.net

Software

Resource Hash

074afd889f5d24ef970c7933d2b7ad2512aa3e211822d33d12bdb830bdfef8b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 13:48:06 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 0d5d2d408eb42296c7636196e25ef8a2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 131094
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 55605
last-modified: Wed, 06 Mar 2024 13:48:00 GMT
etag: "7b76c146fc6521a09685a4df28fa3dbb"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: pDC6gqBpgTMrcBo1gXf0va0C-KOSGTrxOZVwLgdb9k47sHNQnMUrfw==

POST
H2 204 collect
region1.analytics.google.com/g/ 0
258 B 47ms
18ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-C2G0PCSJKE&gtm=45je4360v868642232z8830118234za220&_p=1709863980338&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=1508834351.1709863981&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_eu=EA&_s=1&sid=1709863980&sct=1&seg=0&dl=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom&dt=Swindled%20Blackcat%20affiliate%20wants%20money%20from%20Change%20Healthcare%20ransom%20-%20Blog%20%7C%20Menlo%20Security&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=671
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-C2G0PCSJKE&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Mar 2024 02:13:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.menlosecurity.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
249 B 54ms
18ms Ping
text/plain 2a00:1450:400c:c06::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-C2G0PCSJKE&cid=1508834351.1709863981&gtm=45je4360v868642232z8830118234za220&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-C2G0PCSJKE&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c06::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Mar 2024 02:13:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.menlosecurity.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 125ms
47ms Image
image/gif 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-C2G0PCSJKE&cid=1508834351.1709863981&gtm=45je4360v868642232z8830118234za220&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&z=52314151

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Mar 2024 02:13:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK visitWebPage
281-owv-899.mktoresp.com/webevents/ 2 B
318 B 893ms
161ms Ping
text/plain 192.28.147.68
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://281-owv-899.mktoresp.com/webevents/visitWebPage?_mchNc=1709863980743&_mchCn=&_mchId=281-OWV-899&_mchTk=_mch-menlosecurity.com-1709863980743-14392&_mchHo=www.menlosecurity.com&_mchPo=&_mchRu=%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Fri, 08 Mar 2024 02:13:01 GMT
Content-Encoding: gzip
Server: nginx/1.20.1
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: 4a55e78a-492e-40da-a953-5183e054abc6

OPTIONS
H2 200 gif.gif
ibc-flow.techtarget.com/a/ Frame 0
0 148ms
111ms Preflight
text/html 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=16648054&r=1709863980750&ref=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom&version=2.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: ibc_rate_tier
Access-Control-Request-Method: GET
Origin: https://www.menlosecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 08 Mar 2024 02:13:00 GMT
expires: Fri, 08 Mar 2024 02:13:00 GMT
server: nginx/1.20.2
vary: Origin
via: 1.1 google
x-guploader-uploadid: ABPtcPrQCLEhO-RRAkaO-t3gqMoWmdPpOcFqH3-DBG0WGvueCNE4a8SdvjQHc-OATHDGZkwu659Q6Ri2Bw

GET
H2 200 gif.gif Show response
ibc-flow.techtarget.com/a/ 43 B
445 B 125ms
125ms XHR
image/gif 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=16648054&r=1709863980750&ref=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom&version=2.4
Requested by: Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

ibc_rate_tier: 16648054
Referer: https://www.menlosecurity.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:00 GMT
via: 1.1 google
x-guploader-uploadid: ABPtcPq9lOHg9Be1t_mQUtr1GjCr8tz6mjzCoKWczLI3vHxJN1GO36Fll02E59rDnb32BbBi4c7OJl59fA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
last-modified: Thu, 08 Dec 2022 21:19:29 GMT
server: nginx/1.20.2
etag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
vary: Origin
x-goog-generation: 1670534369365034
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
cache-control: public, max-age=3600
access-control-allow-methods: GET, POST, OPTIONS
x-goog-stored-content-length: 43
accept-ranges: bytes
access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
expires: Fri, 08 Mar 2024 03:13:00 GMT

GET
H2 200 r Show response
scout.salesloft.com/ 41 B
361 B 345ms
108ms XHR
application/json 52.22.229.227
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://scout.salesloft.com/r?tid=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0IjoxMDE5Njd9.V7I-NpOKgrht5OkLlxuCbuX4T0bDGUNKoOfji96SmgY

Requested by

Host: scout-cdn.salesloft.com
URL: https://scout-cdn.salesloft.com/sl.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.22.229.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-22-229-227.compute-1.amazonaws.com

Software

Resource Hash

aa011ed383cb780028a85caaa0dda67dce19b0f4bc596f4f708d1857015c1362

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.menlosecurity.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
content-length: 41
x-request-id: 22d08139a71fe2618836f62d67b7071f

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 29ms
8ms Image
text/plain 2a03:2880:f176:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1626328370711236&ev=PageView&dl=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom&rl=&if=false&ts=1709863980756&sw=1600&sh=1200&v=2.9.148&r=stable&ec=0&o=4126&fbp=fb.1.1709863980755.1702027119&cs_est=true&ler=empty&cdl=API_unavailable&it=1709863980663&coo=false&rqm=GET

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Fri, 08 Mar 2024 02:13:00 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

POST
H2 200 / Show response
content.hotjar.io/ 56 B
161 B 180ms
85ms XHR
application/json 52.51.205.226
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://content.hotjar.io/?site_id=1854968&gzip=1
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.478d49d6cc21ec95d184.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.51.205.226 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-51-205-226.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 2546e4cdd2349711cccc53c07f43723eebb2618faafade5b4ec807f17326477b

Request headers

Referer: https://www.menlosecurity.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 08 Mar 2024 02:13:00 GMT
content-length: 56
vary: Origin
content-type: application/json

GET
H2 200 forms2.min.js Show response
info.menlosecurity.com/js/forms2/js/ Frame 92A0 199 KB
66 KB 22ms
22ms Script
application/x-javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.menlosecurity.com/js/forms2/js/forms2.min.js

Requested by

Host: info.menlosecurity.com
URL: https://info.menlosecurity.com/index.php/form/XDFrame

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

be64da47ffc5fc1e40ba8205a0974330a76815e151e84ba365a750a7c96f1d1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://info.menlosecurity.com/index.php/form/XDFrame
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Fri, 05 Jan 2024 00:21:30 GMT
server: cloudflare
age: 2364
etag: "1e01605-31ad2-60e27d4627680"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 860f4db87a055d93-FRA
expires: Fri, 08 Mar 2024 06:13:00 GMT

GET
BLOB 200
OK 5389023a-0e2b-46e4-889a-636d344e6bfb
https://www.menlosecurity.com/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://www.menlosecurity.com/5389023a-0e2b-46e4-889a-636d344e6bfb
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Length: 43
Content-Type: image/gif

GET
H2 200 i Show response
scout.salesloft.com/ 48 B
468 B 106ms
106ms XHR
application/json 52.22.229.227
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://scout.salesloft.com/i

Requested by

Host: scout-cdn.salesloft.com
URL: https://scout-cdn.salesloft.com/sl.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.22.229.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-22-229-227.compute-1.amazonaws.com

Software

Resource Hash

92a6947257b201d6a77dd7e4ecad51cd1b0a4029a89b288f3c9463f0d5237015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.menlosecurity.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
content-length: 48
x-request-id: 21fb1294e2d16424073f9e4d4337af84

GET
H2 200 6si.min.js Show response
j.6sc.co/ 64 KB
18 KB 26ms
26ms Script
application/javascript 95.101.133.17
TWELVE99 Arelion

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/j/9d098b8d-9cde-40ee-beab-3b850059beba.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.133.17 Liljeholmen, Sweden, ASN1299 (TWELVE99 Arelion, fka Telia Carrier, SE),

Reverse DNS

a95-101-133-17.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

8c1781ec4483c6fb3bd9ad005d312800eaf24e232c12976624bff84f8ab908b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Mar 2024 02:13:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 22 Feb 2024 19:00:41 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "65d799d9-101dd"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 17693
expires: Fri, 08 Mar 2024 02:13:01 GMT

POST
H2 200 create Show response
st.fullcircleinsights.com/v1/visitors/ 1 KB
2 KB 520ms
520ms XHR
application/json 13.224.189.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://st.fullcircleinsights.com/v1/visitors/create
Requested by: Host: d2i34c80a0ftze.cloudfront.net
URL: https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=187d2103-bdc5-4e3f-b070-b5c6a4000840&domain=menlosecurity.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-129.fra2.r.cloudfront.net
Software: /
Resource Hash: 934ad7a7cc061d0dc6124bca37f874ebb29f41f7ccf85a253815ca6066dc8c88

Request headers

origin-fci: https://www.menlosecurity.com
Referer: https://www.menlosecurity.com/
accept-language: de-DE,de;q=0.9
js-version: 1.0.59
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
x-api-key: uSI2bzqNHv34zA8znmW0LgfsY9TBayMx9gZJf430
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 08 Mar 2024 02:13:02 GMT
via: 1.1 c2a926ef1bafe1ab239d4761594a8098.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
x-amzn-trace-id: Root=1-65ea742e-0da16c8e3ac69a365f497d2d;Parent=75d76f6340c94b04;Sampled=0;lineage=7c392b7c:0
x-amzn-requestid: 4cbed591-352a-410e-9329-e85073852601
vary: Origin
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: https://www.menlosecurity.com
x-amz-apigw-id: UScXPEXYvHcEV8A=
content-length: 1427
x-amz-cf-id: xGsEVnU6Nw6UJd1icVKYhAhhy2BlEFK7OHFEPnkUpcbDjhpWin457A==

OPTIONS
H2 200 create
st.fullcircleinsights.com/v1/visitors/ Frame 0
0 506ms
431ms Preflight
application/json 13.224.189.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://st.fullcircleinsights.com/v1/visitors/create
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-129.fra2.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: js-version,origin-fci,x-api-key
Access-Control-Request-Method: POST
Origin: https://www.menlosecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods: OPTIONS,POST
access-control-allow-origin: https://www.menlosecurity.com
content-length: 1
content-type: application/json
date: Fri, 08 Mar 2024 02:13:01 GMT
via: 1.1 c2a926ef1bafe1ab239d4761594a8098.cloudfront.net (CloudFront)
x-amz-apigw-id: UScXKH0kPHcESlg=
x-amz-cf-id: _LpCcru9Z8eT7yMhr9SROTyLycjDUFdZxk8dBgHigZoWKIHQt5kGdQ==
x-amz-cf-pop: FRA2-C1
x-amzn-requestid: 63bac270-4f26-471c-9da8-02b25b2d279a
x-cache: Miss from cloudfront

GET
H2 200 widget-ab46592fde4b3ba2c349bb7f7f39256d.js Show response
app.hushly.com/assets/ 423 KB
126 KB 346ms
345ms Script
text/javascript 44.240.168.231
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://app.hushly.com/assets/widget-ab46592fde4b3ba2c349bb7f7f39256d.js
Requested by: Host: app.hushly.com
URL: https://app.hushly.com/runtime/widget.js?aid=83162
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.240.168.231 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-240-168-231.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: 67285213e29ad93a23a2e8285a27a9cd753218b645e59b0e29b6ed406df16f6c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:01 GMT
content-encoding: gzip
last-modified: Tue, 05 Mar 2024 10:09:12 GMT
etag: "widget-ab46592fde4b3ba2c349bb7f7f39256d.js"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
cache-control: public, max-age=31536000
content-length: 128407

GET
H2 200 getuidj Show response
secure.adnxs.com/ 11 B
707 B 46ms
6ms XHR
application/json 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Mar 2024 02:13:01 GMT
an-x-request-uuid: 42cd0e80-d189-471c-bb66-8eb0fdc667a2
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.menlosecurity.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 185.213.155.153; 185.213.155.153; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 11
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
197 B 37ms
26ms XHR
text/html 95.101.133.17
TWELVE99 Arelion

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.133.17 Liljeholmen, Sweden, ASN1299 (TWELVE99 Arelion, fka Telia Carrier, SE),
Reverse DNS: a95-101-133-17.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:01 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.menlosecurity.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 20 B
316 B 382ms
92ms XHR
text/html 2a02:26f0:3100::1735:2baa
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3100::1735:2baa Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 7a38a8b8f2d5263ae8a8f8d1f4dbfd827e173b956e771bfbc9565941452de090

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Mar 2024 02:13:01 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.menlosecurity.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2a03:1b20:6:f011::3e
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1709863981378_389360550_1090750017_30_1253_90_182_219";dur=1
content-length: 20
expires: Fri, 08 Mar 2024 02:13:01 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 235ms
212ms Image
image/gif 95.101.133.17
TWELVE99 Arelion

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=ed586d43-842e-410a-87a5-0ef021b912a0&session=a3ec907f-4b7e-4ab1-8e3a-6fe7e50e586e&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Fri%2C%2008%20Mar%202024%2002%3A13%3A01%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20the%20latest%20developments%20in%20the%20cyberattack%20saga%20involving%20U.S.%20healthcare%20giant%20Change%20Healthcare%20and%20the%20notorious%20BlackCat%20ransomware%20group.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Swindled%20Blackcat%20affiliate%20wants%20money%20from%20Change%20Healthcare%20ransom%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom&pageViewId=66266a4e-ca2c-4542-8cf5-88520ed567c7&an_uid=0&webTagId=9d098b8d-9cde-40ee-beab-3b850059beba&v=1.1.15

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.133.17 Liljeholmen, Sweden, ASN1299 (TWELVE99 Arelion, fka Telia Carrier, SE),

Reverse DNS

a95-101-133-17.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:01 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 236ms
213ms Image
image/gif 95.101.133.17
TWELVE99 Arelion

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=ed586d43-842e-410a-87a5-0ef021b912a0&session=a3ec907f-4b7e-4ab1-8e3a-6fe7e50e586e&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22978e5d07c2a3a90aa4884115fca62376%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2008%20Mar%202024%2002%3A13%3A01%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2008%20Mar%202024%2002%3A13%3A01%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22cdcc21c50eb45b5f1adbb9f4723fd8296ded280b%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2008%20Mar%202024%2002%3A13%3A01%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2008%20Mar%202024%2002%3A13%3A01%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2008%20Mar%202024%2002%3A13%3A01%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2008%20Mar%202024%2002%3A13%3A01%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setWhiteListFields%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2008%20Mar%202024%2002%3A13%3A01%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2008%20Mar%202024%2002%3A13%3A01%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%229d098b8d-9cde-40ee-beab-3b850059beba%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2008%20Mar%202024%2002%3A13%3A01%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2008%20Mar%202024%2002%3A13%3A01%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCompanyDetailsExpiration%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2008%20Mar%202024%2002%3A13%3A01%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableMapCookieCapture%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2008%20Mar%202024%2002%3A13%3A01%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2008%20Mar%202024%2002%3A13%3A01%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20the%20latest%20developments%20in%20the%20cyberattack%20saga%20involving%20U.S.%20healthcare%20giant%20Change%20Healthcare%20and%20the%20notorious%20BlackCat%20ransomware%20group.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Swindled%20Blackcat%20affiliate%20wants%20money%20from%20Change%20Healthcare%20ransom%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom&pageViewId=66266a4e-ca2c-4542-8cf5-88520ed567c7&an_uid=0&webTagId=9d098b8d-9cde-40ee-beab-3b850059beba&v=1.1.15

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.133.17 Liljeholmen, Sweden, ASN1299 (TWELVE99 Arelion, fka Telia Carrier, SE),

Reverse DNS

a95-101-133-17.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:01 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 745 B
721 B 31ms
16ms XHR
application/json 3.68.168.239
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.68.168.239 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-68-168-239.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 0e35bc7004344fc251a2e47e5d5c8efde8f7fdc17bd9601b2ccd2b1ea28b0425

Request headers

Referer: https://www.menlosecurity.com/
accept-language: de-DE,de;q=0.9
Authorization: Token cdcc21c50eb45b5f1adbb9f4723fd8296ded280b
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
X-6s-CustomID: WebTag 9d098b8d-9cde-40ee-beab-3b850059beba

Response headers

x-trace-id: 2189432865639681032
date: Fri, 08 Mar 2024 02:13:01 GMT
content-encoding: gzip
server: nginx
vary: Origin, Accept-Encoding
content-type: application/json
x-6si-region: eu-central-1a
access-control-allow-origin: https://www.menlosecurity.com
access-control-expose-headers: X-6si-Region
access-control-allow-credentials: true
timing-allow-origin: https://6sense.com, https://www.ssga.com
content-length: 397

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 42ms
11ms Preflight 3.68.168.239
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.68.168.239 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-68-168-239.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.menlosecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.menlosecurity.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
date: Fri, 08 Mar 2024 02:13:01 GMT
server: nginx
timing-allow-origin: https://6sense.com, https://www.ssga.com
x-6si-region: eu-central-1a
x-trace-id: 4242558672193211313

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
198 B 153ms
153ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: *
Referer: https://www.menlosecurity.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 08 Mar 2024 02:13:01 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 894C1B256DE84B57BD3182629DE2B989 Ref B: FRAEDGE1705 Ref C: 2024-03-08T02:13:01Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
access-control-allow-origin: https://www.menlosecurity.com
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYTHLs8lQh7Lg8tCBFB/g==

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 212ms
212ms Image
image/gif 95.101.133.17
TWELVE99 Arelion

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=ed586d43-842e-410a-87a5-0ef021b912a0&session=a3ec907f-4b7e-4ab1-8e3a-6fe7e50e586e&event=ipv6&q=%7B%22address%22%3A%222a03%3A1b20%3A6%3Af011%3A%3A3e%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20the%20latest%20developments%20in%20the%20cyberattack%20saga%20involving%20U.S.%20healthcare%20giant%20Change%20Healthcare%20and%20the%20notorious%20BlackCat%20ransomware%20group.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Swindled%20Blackcat%20affiliate%20wants%20money%20from%20Change%20Healthcare%20ransom%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom&pageViewId=66266a4e-ca2c-4542-8cf5-88520ed567c7&an_uid=0&webTagId=9d098b8d-9cde-40ee-beab-3b850059beba&v=1.1.15

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.133.17 Liljeholmen, Sweden, ASN1299 (TWELVE99 Arelion, fka Telia Carrier, SE),

Reverse DNS

a95-101-133-17.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:01 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 core Show response
js.driftt.com/ Frame 529E 2 KB
1 KB 302ms
302ms Document
text/html 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1709864100000/trrsm2wf4gwm.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

ca8d259705c340a9ba8b34112e02d21e8d707e12d6927edd3dab7b860ce492c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.menlosecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 08 Mar 2024 02:13:02 GMT
etag: W/"3ce4779d1994dc24713d82e14733d95d"
last-modified: Tue, 05 Mar 2024 20:53:37 GMT
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-id: _FtN64nzJ8C8i0cTlQ5IPtn1JoUrItzMXoplo-aAbumEUSad_87BcA==
x-amz-cf-pop: FRA60-P6
x-amz-server-side-encryption: AES256
x-amz-version-id: oYX5AL0QHyvAsPoE68OQchDR6mtHsw7l
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 14

GET
H2 200 chat Show response
js.driftt.com/core/ Frame 43B6 2 KB
1 KB 110ms
110ms Document
text/html 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1709864100000/trrsm2wf4gwm.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

ca8d259705c340a9ba8b34112e02d21e8d707e12d6927edd3dab7b860ce492c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.menlosecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 08 Mar 2024 02:13:01 GMT
etag: W/"3ce4779d1994dc24713d82e14733d95d"
last-modified: Tue, 05 Mar 2024 20:53:37 GMT
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-id: w6HKHQD1m41lQX1MmAwJVKbfDLKr4Bdo5Nm1Go9LNRSq-R0t-zJAlQ==
x-amz-cf-pop: FRA60-P6
x-amz-server-side-encryption: AES256
x-amz-version-id: oYX5AL0QHyvAsPoE68OQchDR6mtHsw7l
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 12

GET
H2 200 zi-tag.js Show response
js.zi-scripts.com/ 8 KB
3 KB 48ms
23ms Script
application/javascript 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/zi-tag.js
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bfae35edc61595bd27d16c01ddc44ef00c152c0006e16f836101d3b6a6621d01

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:01 GMT
x-amz-version-id: lFoq_FZJwJ3rDVe9.7kNMZjc5YKK6r5L
content-encoding: gzip
cf-cache-status: DYNAMIC
last-modified: Mon, 11 Dec 2023 12:17:02 GMT
server: cloudflare
via: 1.1 9987fa8ab620895e83d1d8f10c40f6d2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
etag: W/"15c02cdee0df6c26ba3d8c62d912c66c"
age: 81463
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cf-ray: 860f4dbedb7237ec-FRA
x-amz-cf-id: t4m3wt3BJ7eWEoztTIU6VpDvBrnfF6FF2CoxPZ3fPyj2YeAtcO-ENw==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 113ms
35ms Script
text/javascript 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 08 Mar 2024 01:48:08 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 1493
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Fri, 08 Mar 2024 03:48:08 GMT

GET
H2 200 widget-365e4fc9661820c90743b852a36fef3c.css
app.hushly.com/assets/ 69 KB
12 KB 177ms
176ms Stylesheet
text/css 44.240.168.231
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://app.hushly.com/assets/widget-365e4fc9661820c90743b852a36fef3c.css
Requested by: Host: app.hushly.com
URL: https://app.hushly.com/assets/widget-ab46592fde4b3ba2c349bb7f7f39256d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.240.168.231 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-240-168-231.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: d8b080802cba44025db6515c924fd17cfba0f2d9123093aaa779d43f8a04a522

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:01 GMT
content-encoding: gzip
last-modified: Tue, 05 Mar 2024 10:09:12 GMT
etag: "widget-365e4fc9661820c90743b852a36fef3c.css"
vary: Accept-Encoding
content-type: text/css;charset=UTF-8
cache-control: public, max-age=31536000
content-length: 11756

POST
H2 200 83162 Show response
app.hushly.com/runtime/widgets/ 60 B
946 B 548ms
197ms XHR
application/json 44.240.168.231
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://app.hushly.com/runtime/widgets/83162

Requested by

Host: app.hushly.com
URL: https://app.hushly.com/assets/widget-ab46592fde4b3ba2c349bb7f7f39256d.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.240.168.231 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-240-168-231.us-west-2.compute.amazonaws.com

Software

Resource Hash

a8331d520e307081359e060643052b00e5529d0062b5ce516c251f4da1b9fae2

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.menlosecurity.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Fri, 08 Mar 2024 02:13:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-encoding: gzip
content-security-policy
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.menlosecurity.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex

GET
H2 200 83162 Show response
app.hushly.com/runtime/visitor/ 39 B
773 B 192ms
192ms Script
text/javascript 44.240.168.231
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://app.hushly.com/runtime/visitor/83162?callback=hushlyVisitorCallback&sid=e547d209-0123-40be-b9b5-739e58b6c7d1&vid=2e79cc18-db2a-40a3-b72c-3ff9adb15e78&version=2&hly-ip-address=&_=1709863981848

Requested by

Host: app.hushly.com
URL: https://app.hushly.com/assets/widget-ab46592fde4b3ba2c349bb7f7f39256d.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.240.168.231 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-240-168-231.us-west-2.compute.amazonaws.com

Software

Resource Hash

f595a7eeaf2e9ef60746074e0ff87a1b6bf60355ece3559d666b9b59041dc976

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-encoding: gzip
content-security-policy
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=31536000, public
x-robots-tag: noindex

OPTIONS
H2 204 getSubscriptions
js.zi-scripts.com/unified/v1/master/ Frame 0
0 182ms
167ms Preflight 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,visited_url
Access-Control-Request-Method: GET
Origin: https://www.menlosecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *
access-control-max-age: 0
apigw-requestid: UScXPgQEvHcEM7A=
cf-cache-status: DYNAMIC
cf-ray: 860f4dbf1d479265-FRA
date: Fri, 08 Mar 2024 02:13:02 GMT
server: cloudflare
vary: Access-Control-Request-Headers
via: 1.1 2ba7b49ec4c4de4e67297e603c89a5e4.cloudfront.net (CloudFront)
x-amz-cf-id: OzLlsBpEPJov02qjBlMuYzCakFYtdP9X55lwOuKLkFOjLW7ZQY1sew==
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
x-powered-by: Express

GET
H2 200 getSubscriptions Show response
js.zi-scripts.com/unified/v1/master/ 146 B
407 B 444ms
444ms Fetch
application/json 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: f5440b37afdd39e69744c91ac06d81209dc9176a0c9887c19fd2b9923bf15d90

Request headers

visited_url: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Referer: https://www.menlosecurity.com/
accept-language: de-DE,de;q=0.9
Authorization: Bearer 2b223f4b411669347307
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 08 Mar 2024 02:13:02 GMT
via: 1.1 f9c16664a13e70e73a4e280c7a0f2266.cloudfront.net (CloudFront)
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
x-amz-cf-pop: FRA56-P4
x-powered-by: Express
etag: W/"92-E/veZozmj7IrEUiEdbcvZocPhf4"
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cf-ray: 860f4dc01db49265-FRA
x-amz-cf-id: yWcIUMfOCam4-AP0TuHlE7KOyPeZb0mGzK30__iBHr3micoh9jqNGQ==
apigw-requestid: UScXTiKIvHcESxA=

GET
H2 200 runtime~main.e07e16f3.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 6 KB
3 KB 8ms
7ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

9e6a781a2013dea846dd8dda8b30b4db01e3ca0fd71e33c60beaa69302d956a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
Origin: https://js.driftt.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 20:53:37 GMT
x-amz-version-id: pu36qHdy4HpiOhgn19_ttNtyde47Wcxh
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 191964
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 22
last-modified: Tue, 05 Mar 2024 20:17:52 GMT
server: istio-envoy
etag: W/"f090136907cdfdbea306bd7125c8c198"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ZUGt-5yyJiFVPmAB_g-kA6ZnFkJl-ZF4hNgL96BPM5zvTGvM7WdQIA==

GET
H2 200 9.4a3e9801.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 35 KB
13 KB 8ms
8ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/9.4a3e9801.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

2a8a441d8086f20a64563edc759aba1de84d932e34ff77b8bb0279a730cdb428

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
Origin: https://js.driftt.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:47 GMT
x-amz-version-id: xDLMc9.vfMRinFJv17uWwlTUqFMyHh91
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 6268454
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 14
last-modified: Tue, 19 Dec 2023 18:34:39 GMT
server: istio-envoy
etag: W/"c6f58dd3d60f07462254b842dd4f9ca1"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: VpABHtwubDajgTsnuJUA0frcMFPKigno4YIHNvLW29GQpDqPfHLdqA==

GET
H2 200 main~493df0b3.b86e2669.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 7 KB
3 KB 9ms
9ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~493df0b3.b86e2669.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

d1d75ae838854e845b28c3472c3d235f92a944446d79165953ec813fc6323a70

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
Origin: https://js.driftt.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Thu, 29 Feb 2024 20:30:29 GMT
x-amz-version-id: sa7zLOvJBKmMwU293nV0gngc542FulJ_
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 625352
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 13
last-modified: Thu, 29 Feb 2024 20:12:42 GMT
server: istio-envoy
etag: W/"cb79c6ff64f9222a7df5f053d31681c8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: B5tP9KyWBKp3guMkyf8OYdX4XFTlzjoc7zP3pbhmOps2aHo8VLOL_Q==

GET
H2 200 51.558be3c5.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 23 KB
8 KB 8ms
8ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b0af909b7ae6ad2644bfe2a60d939092aaf113b2cbc4ed2981a892869143b98a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 01:42:32 GMT
x-amz-version-id: jAn.UV4FUigTQ2pXuPEfcgJGaVkaFeLh
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 5531429
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Wed, 03 Jan 2024 21:36:01 GMT
server: istio-envoy
etag: W/"fa281fcbe4b2e35558d60fae3e316367"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: WvMcnwA-FP1MvaisSUF5WOUeNxx-xGd1V9r1RhNl1M6E49FSwmdE-Q==

GET
H2 200 34.9de9c855.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 36 KB
10 KB 9ms
9ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/34.9de9c855.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

9f954d6e1256d528c39aa0b3768fae8fffc81ecddb0cda40058dc715d1cb212f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 28 Feb 2024 20:33:40 GMT
x-amz-version-id: aVYKLubPRStYzFi8RmbQTEpTBOY7Bsrb
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 711561
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 16
last-modified: Wed, 28 Feb 2024 20:09:24 GMT
server: istio-envoy
etag: W/"4db3dc70965816e2781d03c25ca5bf2e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: nh6mkqAPGxIrbNsCHf5O4a8paGFJja9ot3fkiAyiMn-z5m1_3FCQHg==

GET
H2 200 22.6b9a301a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 32 KB
11 KB 11ms
11ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/22.6b9a301a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

8f0f8792237470ee661c6afc32ca68200dd74bcc0d544d0fd54c7777af362eae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:47:36 GMT
x-amz-version-id: vXzNrqspXsAXcjt5Me_czePQe44sOTaA
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 2600725
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 18
last-modified: Tue, 06 Feb 2024 19:57:37 GMT
server: istio-envoy
etag: W/"d8739a9fe9a3a42936f5cd86c8727494"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 1HWClv2f612GuCLxQ9AUR9Cts412K4QfL1-_07Yc3L2jTw9eYJEcOw==

GET
H2 200 19.6f85b843.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 17 KB
6 KB 9ms
9ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/19.6f85b843.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

afbd41e7209fa3aef6f53c7a5713aa542a7be54c432fec2d690e0dfaccd528d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: TS.9ApOzy..rylGKiVPdLcCX5dJ9HsBw
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 6268453
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 18
last-modified: Tue, 19 Dec 2023 18:34:37 GMT
server: istio-envoy
etag: W/"e28ebc3391b56e8f01ea063dc089e9d3"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: XxhJ_TG2Grp5ZlbW3p2rbGa781oUnuBQGPZDxhsIz40a-ZKBrdOmng==

GET
H2 200 41.b4fc4de2.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 25 KB
8 KB 10ms
10ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/41.b4fc4de2.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

edf1011ad272d21b66ae82a21a9d029186dc81c9f13972203fc3107f75835d4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 15 Jan 2024 07:31:30 GMT
x-amz-version-id: E9YrwVejTprhZqeWxhn5pc.KEORxTIm1
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4560090
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 14
last-modified: Thu, 11 Jan 2024 23:20:33 GMT
server: istio-envoy
etag: W/"a2ace4f65aa7b34dedb884f6cfe9df8d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: abD0Y1Zi2CH4I49URNDGWpLDVp7JiNb7i4PckmKBjifnBLqDh45F3Q==

GET
H2 200 20.8c21ea18.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 74 KB
23 KB 16ms
15ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/20.8c21ea18.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: 4VyxTF9cOmpvyHPO7jaWSto1hTdtU.sl
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 6268453
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 45
last-modified: Tue, 19 Dec 2023 18:34:37 GMT
server: istio-envoy
etag: W/"6d77a76055d81227033363af2f18caf8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: vpHN9uWTvKaDtAAGJ0D0u0QQU4wDS4ZHJ8IQKWZUD86_e4pxhjMRjA==

GET
H2 200 26.04e7f30b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 66 KB
20 KB 17ms
17ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/26.04e7f30b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

d70fa5dc6c8bfe9d7824be31e669528533d0879a2b1600a7df68b880f4d44296

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: cqsMaYjOHahH71A7EXhyHFywLOEay3sx
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 6268453
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 32
last-modified: Tue, 19 Dec 2023 16:15:24 GMT
server: istio-envoy
etag: W/"49ce5445ddcf5d24ef3badc4eb1a11dd"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: WCWJlIUKNcozldQG_cr6nKDMX1DboO5NdNXMjq8U6X6cM1ZHXgn09Q==

GET
H2 200 14.e24a6190.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 91 KB
28 KB 12ms
12ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/14.e24a6190.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6c9c6406c9bd9814cf84974221433003377b67f071ec5411fddbcba4ec109bca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: iLluOjfpMSRsML8bOSqA9V8JfTEqMP9L
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 6268453
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Tue, 19 Dec 2023 18:34:37 GMT
server: istio-envoy
etag: W/"16d7ae86e21434a32157d3226ac9bb77"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: NlsQH0SkhMksBDr3z0_oUXVJdM2rpFpIe8wddydAubQzDt63H8Qh5A==

GET
H2 200 11.639238ba.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 23 KB
7 KB 13ms
13ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/11.639238ba.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 15 Jan 2024 07:31:30 GMT
x-amz-version-id: fTPxsmx5We5V2pMGDl1ykjBzTcYFF2dc
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4560091
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
last-modified: Thu, 11 Jan 2024 23:20:32 GMT
server: istio-envoy
etag: W/"4049f38c00add1738dc4806148ff8829"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: nq5xROs4raenb_rqkkUkVSdxif5q65RDd2djhjNbDowxxlmg-Sw9-g==

GET
H2 200 18.9c1bd1fb.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 62 KB
20 KB 14ms
14ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/18.9c1bd1fb.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e555f4b34b579e6528d6bbd4819620a634c0759b41dfa99520b7ca5aa5117b11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: q8W9FNPLIM8OX5drRDX0sp4TnKuKPMbY
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 6268453
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 21
last-modified: Tue, 19 Dec 2023 18:34:37 GMT
server: istio-envoy
etag: W/"02f09379c544befa413d22eb57ed41de"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: AEjQ7ZpYgWlpcmg-UGaroosnXYPGMamE95SVbWWaPFtaRNx2gy5BIg==

GET
H2 200 49.f7274268.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 105 KB
34 KB 18ms
18ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/49.f7274268.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6861a320271e0fda832800e20d53b858ef409f88d9bc9c1a48953888289d1ea3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: sZGsqYJSO5RNt4iGri.m215HFs7tyyoY
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 6268454
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 22
last-modified: Tue, 19 Dec 2023 16:15:24 GMT
server: istio-envoy
etag: W/"e268d36b98f0119a2bb1a15f69fd4ffe"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: tQ8-CehVT4U37PkfPbDyEqZ3iFxHRYVFlne1CujvRSZIEEhQ7go-CQ==

GET
H2 200 40.31ef8dbf.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 12 KB
4 KB 20ms
20ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/40.31ef8dbf.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

bba54915db71fc417be4d5852ec7d138d7c3fa90356ddee98b5267a7db7e6b5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 03:25:55 GMT
x-amz-version-id: d4Mpj6_OHbbARq4FSdDizJv80LDhJS9j
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 7944427
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 37
last-modified: Wed, 06 Dec 2023 19:18:01 GMT
server: istio-envoy
etag: W/"b0793fa46e8c0ae1846b7be8a833da35"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: S7jdN62Fqahk1Ary3uawPA_PsQeXgspqAByVIpBW6-fmJAAlz1_CjQ==

GET
H2 200 28.190877b8.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 13 KB
6 KB 21ms
19ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/28.190877b8.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

d7ead427aca51c227410c4595b49b48dde8f9e76864b4f3fcb32861034b0c6a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 28 Feb 2024 20:33:40 GMT
x-amz-version-id: pQnA6v43oECrxe8G1Al4Smp1uPVlKNM3
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 711562
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Wed, 28 Feb 2024 20:09:23 GMT
server: istio-envoy
etag: W/"94c7e7cb2f40e10abeee8e28c0f68eb7"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: XQgkulAc63F4omjBC8qI1PzhXrC-R-NCq8mN6jnHeSTU7HH61LYJEA==

GET
H2 200 21.b8c41db9.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 17 KB
7 KB 23ms
22ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/21.b8c41db9.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 15 Jan 2024 07:31:30 GMT
x-amz-version-id: mbKfJZbsWw.V.LuUA4S0Y6Eza3IzJhvH
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4560092
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 15
last-modified: Thu, 11 Jan 2024 23:20:33 GMT
server: istio-envoy
etag: W/"65e5c965272e021ae33ff8bc39565ef5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ZTAlZlPSIkju6Q2buz78QDqa_d4kU-Ta1GKjLoZz11AWgHLLy4zw-Q==

GET
H2 200 8.ab226b4a.chunk.css
js.driftt.com/core/assets/css/ Frame 43B6 31 KB
4 KB 20ms
20ms Stylesheet
text/css 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/8.ab226b4a.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

ff8f406b684c6674dbd3705d3f6d2cd10b5eedbc2c67a7773f235d69ef122d04

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 21:38:16 GMT
x-amz-version-id: Iy50rWLvnka9klYMF5qa_8hsgho0e_uB
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3558886
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Fri, 26 Jan 2024 18:11:46 GMT
server: istio-envoy
etag: W/"1e97f00f07b87f701d0bf06259f954e4"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: i5tUL3wHrt4-2mR5Gg_IP6rpLmPaQxasdowSruErkfKUKosHFgoTuA==

GET
H2 200 8.ce202881.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 82 KB
26 KB 23ms
23ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/8.ce202881.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

3337f36bd89c27dbe1dca4b71fb177d826b736950f2150aff6acce0180a86fc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 20:20:36 GMT
x-amz-version-id: mQIEwfFQyClv1G1Ejf6MWBI5BBswFf_l
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3217946
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 93
last-modified: Tue, 30 Jan 2024 16:30:58 GMT
server: istio-envoy
etag: W/"182944c0e758d6ff6a202ce976d91cc6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: F1x8ykOxvnjeYhPvlbenu_IgzwqvAeMfEd6bmI00W8zxN41yMwZlDA==

GET
H2 200 16.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame 43B6 24 B
697 B 21ms
21ms Stylesheet
text/css 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/16.22abfce0.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 10:04:47 GMT
x-amz-version-id: oL98YdzlpaGyxUOIAT2tnEGpxnQwpHij
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA60-P6
age: 6278895
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 13
content-length: 24
last-modified: Tue, 19 Dec 2023 18:34:35 GMT
server: istio-envoy
etag: "0c5dad92482d9a7c7c253510f5082465"
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Nn9KFWKZYE-F07IEsCl7yuIykxX2IoI15GNFrh8sNdAJ30OhrizEFg==

GET
H2 200 16.ce5b49fb.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 93 KB
24 KB 26ms
25ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/16.ce5b49fb.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6b141e7fce6d9ec4c281ca4bcf494f31fc7a24c7aa1fdda838dd5e7ceff2a3b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 28 Feb 2024 20:33:40 GMT
x-amz-version-id: dOxjx378gZY_AVke4cRWFBVQ4oz9fy0X
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 711562
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 28
last-modified: Wed, 28 Feb 2024 20:09:23 GMT
server: istio-envoy
etag: W/"2004af3a9dab938169f2ea62c789c850"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: B3geZHgT3z2qYl85dA9O00NsQRCx24os5SbX37j_8CVpYAMELZKnUg==

GET
H2 200 24.f156ac0b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 51 KB
14 KB 28ms
28ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/24.f156ac0b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e0a5cea44ef10b590cbdd293e5356beec37b4515a45af600cb6bd839d774bfb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 20:53:37 GMT
x-amz-version-id: 912IrOxTzK0d0pxydhEmBJnYzrZScyQp
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 191965
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 13
last-modified: Tue, 05 Mar 2024 20:17:50 GMT
server: istio-envoy
etag: W/"84a1a3421b124fe0033da2dc1eb60e5f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: p-cluenqwkf7TYrep0Vy0QrscPaLUm6edW1C6ueiKke1R3KMG6RLfQ==

GET
H2 200 17.e4fe4aa9.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 40 KB
13 KB 29ms
29ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/17.e4fe4aa9.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b7fe4dab17faeca12818ad0f933516d03f51fe7454e1bbfd983c221cab8358db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 20:53:37 GMT
x-amz-version-id: Du7VQSLBFHCC32UNB4Y0p04GHRSsvnKr
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 191965
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 15
last-modified: Tue, 05 Mar 2024 20:17:50 GMT
server: istio-envoy
etag: W/"3852ed7187bdfa5db5fddd577cd30fcf"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: h22GqZh6L7VXoRv0YsBlJHW3VOCM7cz7vvmJi6SALqFksQkosDA0MQ==

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
213 B 42ms
42ms XHR
text/plain 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=141188999&t=pageview&_s=1&dl=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom&ul=en-us&de=UTF-8&dt=Swindled%20Blackcat%20affiliate%20wants%20money%20from%20Change%20Healthcare%20ransom%20-%20Blog%20%7C%20Menlo%20Security&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABAAAAACAAI~&jid=1379730739&gjid=1907610967&cid=1508834351.1709863981&tid=UA-41161362-2&_gid=1131207495.1709863982&_r=1&_slc=1&gtm=45He4360n81WL64MFJv830118234za220&cd1=&cd2=&cd3=&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&npa=1&z=1280008110

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.menlosecurity.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 08 Mar 2024 02:13:02 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.menlosecurity.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 37.11d2b6a7.chunk.css
js.driftt.com/core/assets/css/ Frame 43B6 3 KB
1 KB 8ms
8ms Stylesheet
text/css 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/37.11d2b6a7.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 15 Jan 2024 07:31:32 GMT
x-amz-version-id: sRdyAX.mmmfnHJ1amTnG0RmacaiJNP23
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4560090
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 16
last-modified: Thu, 11 Jan 2024 23:20:31 GMT
server: istio-envoy
etag: W/"87532c4db85f1429fa6d759bc3332f36"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: dZxED-pfdZuU5FClRPJcfKFVeWcLUxKtwG_NQG6iDYD1n0zrxusbAg==

GET
H2 200 37.df6fa602.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 3 KB
2 KB 9ms
8ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/37.df6fa602.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

dc0198ce23a18c5daa358086995f168e1abf8d134aaec738e13229ae782b46bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 28 Feb 2024 20:33:40 GMT
x-amz-version-id: ZSwKVXfrtfDbDq_39MHGaQa8J99HBue_
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 711563
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 16
last-modified: Wed, 28 Feb 2024 20:09:24 GMT
server: istio-envoy
etag: W/"5094cc61d789f2d038934fbfcc74d115"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ucbacpUl2SsWJV9DAHcwl1p2oEFgvPGLVfxRAYgbzKYhLwH6OFgSIw==

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
151 B 20ms
18ms XHR
text/plain 2a00:1450:400c:c06::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-41161362-2&cid=1508834351.1709863981&jid=1379730739&gjid=1907610967&_gid=1131207495.1709863982&npa=1&_u=YADAAEAAAAAAACAAI~&z=751322910

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c06::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.menlosecurity.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Fri, 08 Mar 2024 02:13:02 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.menlosecurity.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 0.0b2ebd4a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 9 KB
3 KB 11ms
9ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:50 GMT
x-amz-version-id: wIYiMMOv59k7p4Fbql5xBCm9H7moGtf2
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 6268452
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 15
last-modified: Tue, 19 Dec 2023 18:34:36 GMT
server: istio-envoy
etag: W/"c5efcdc9e465604f32cf24af10fd6c13"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: zkI5NQWGxgOGH6RsyRJjlnmNeF9oqPVQpWbmwAxF0Mht-Ee1Dml8nA==

GET
H2 200 4.07aa08a5.chunk.css
js.driftt.com/core/assets/css/ Frame 43B6 7 KB
2 KB 8ms
7ms Stylesheet
text/css 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/4.07aa08a5.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 28 Feb 2024 20:33:40 GMT
x-amz-version-id: ry9PkdfdyYVnhUh9E7iQvpl0pSpoeWa0
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 711562
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
last-modified: Wed, 28 Feb 2024 20:09:21 GMT
server: istio-envoy
etag: W/"189aeffd571884559dababa22c66d75a"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 6j9zA2ODvp3OXhITEsaJLrWJyJNKIQAT2P7MZc7-s-y6MsyNRgFJQA==

GET
H2 200 4.6c355058.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 46 KB
14 KB 11ms
10ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/4.6c355058.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

51b29d6573d9fcb3e20b9021407d58c7dca539b0eb9d0e582106bf4908feac4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 28 Feb 2024 20:33:41 GMT
x-amz-version-id: Yizk8zcIxT.4bvwDYk4c2JLxgCo1ajM3
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 711561
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 22
last-modified: Wed, 28 Feb 2024 20:09:24 GMT
server: istio-envoy
etag: W/"f0317fb42e8df2093f44b37751ca8955"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 9WKTccXRIMvDnYUQ83lq9iXwBTecIAThuWeKSgdbJ-0MCrJmPji19A==

GET
H2 200 1.12ba17b6.chunk.css
js.driftt.com/core/assets/css/ Frame 43B6 44 KB
7 KB 9ms
7ms Stylesheet
text/css 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/1.12ba17b6.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

58fdb03fac3e89e51525a5a45eb777395d1b499bf4483e96201b6becddbe516f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:51 GMT
x-amz-version-id: 1xzUgPbFb7aaeyDZtp6vQOQncX9.jojY
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 6268451
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 18
last-modified: Tue, 19 Dec 2023 16:15:21 GMT
server: istio-envoy
etag: W/"3b8ba82e1bac13ee29e9764a55620d99"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: PMwKjD7Kx1DpuczSnqg-xf8QNWc7YL33js9ojlxUjamn4XYYu4DlIw==

GET
H2 200 1.28254d76.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 53 KB
17 KB 12ms
10ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/1.28254d76.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

914b72c7fe9e9c8ae81a269d5a05df6f5de5116ae133857b2c12b6cec48ea3ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 20:53:37 GMT
x-amz-version-id: rb5Y98etdZtbdGGkTTiEe5JqELdwB5.d
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 191965
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 49
last-modified: Tue, 05 Mar 2024 20:17:49 GMT
server: istio-envoy
etag: W/"97797a3b2d2d449f982ea4367e2264c1"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: lcoXc4V3o7LKystEcD-rgQ8-GkzxAQBbpYVGhbxzlBtbW7uKaIIonw==

GET
H2 200 3.81a9e32c.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 23 KB
10 KB 13ms
12ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/3.81a9e32c.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

39a22185ae99fc24a9c6cf7262ab2529721985716bfaffe811919def004f0464

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 28 Feb 2024 20:33:40 GMT
x-amz-version-id: y2eYXYLwY_FqC8Vl0nwIFAm2SkwtvjSP
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 711562
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 16
last-modified: Wed, 28 Feb 2024 20:09:24 GMT
server: istio-envoy
etag: W/"3faec1260a49f199270c53a69c0e3f81"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: x9GGvTT8v_YbW0u6aMIN8-Og4Vyr5-fKjCuYcSQWN6cua3s8-mINIQ==

GET
H2 200 33.5fdd3e3b.chunk.css
js.driftt.com/core/assets/css/ Frame 43B6 16 KB
3 KB 9ms
8ms Stylesheet
text/css 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/33.5fdd3e3b.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

a03b854d10519fd5be9cdcbc78fad3927c1a3de9e84fa74353c8a19cc20d0501

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 28 Feb 2024 20:33:40 GMT
x-amz-version-id: gplqofziMMUDcPiaSPVLPX_48i_BuPIZ
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 711562
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 28
last-modified: Wed, 28 Feb 2024 20:09:21 GMT
server: istio-envoy
etag: W/"6f779260053e30787f84dfa7ba6743e5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ePk2EYmFyI4P29JspxxIHBcU-nCOcq-f1UH7iK9b3Y2OSG_5rWkG9g==

GET
H2 200 33.63312c59.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 13 KB
5 KB 13ms
12ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/33.63312c59.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

048daa568f2e310b154fc6f410f2655422f8ed3a9317901250a865de6e7d6a8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 28 Feb 2024 20:33:40 GMT
x-amz-version-id: e5kgAJogxluL_JnZgo_rGp_byJM0j5wG
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 711562
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 32
last-modified: Wed, 28 Feb 2024 20:09:24 GMT
server: istio-envoy
etag: W/"f34d0d25c32e8ca882961d24594f2d92"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: CaS1rNbsTdCB6Tt2y6uNWZTSSJv9U0IZd9tPzF9CW1QKl9LmBOM-ww==

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 135ms
52ms Image
image/gif 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-41161362-2&cid=1508834351.1709863981&jid=1379730739&npa=1&_u=YADAAEAAAAAAACAAI~&z=407621514

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Mar 2024 02:13:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 50ms
47ms Image
image/gif 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-41161362-2&cid=1508834351.1709863981&jid=1379730739&npa=1&_u=YADAAEAAAAAAACAAI~&z=407621514

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Mar 2024 02:13:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 runtime~main.e07e16f3.js Show response
js.driftt.com/core/assets/js/ Frame 529E 6 KB
3 KB 7ms
7ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

9e6a781a2013dea846dd8dda8b30b4db01e3ca0fd71e33c60beaa69302d956a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Origin: https://js.driftt.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 20:53:37 GMT
x-amz-version-id: pu36qHdy4HpiOhgn19_ttNtyde47Wcxh
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 191965
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 22
last-modified: Tue, 05 Mar 2024 20:17:52 GMT
server: istio-envoy
etag: W/"f090136907cdfdbea306bd7125c8c198"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Tdi40EW9AJB82-Iq1HALD_qLBQBZvSkLiwxdO4TB878-jmccwrJNuw==

GET
H2 200 9.4a3e9801.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 529E 35 KB
13 KB 8ms
8ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/9.4a3e9801.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

2a8a441d8086f20a64563edc759aba1de84d932e34ff77b8bb0279a730cdb428

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Origin: https://js.driftt.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:47 GMT
x-amz-version-id: xDLMc9.vfMRinFJv17uWwlTUqFMyHh91
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 6268455
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 14
last-modified: Tue, 19 Dec 2023 18:34:39 GMT
server: istio-envoy
etag: W/"c6f58dd3d60f07462254b842dd4f9ca1"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: QbwtToR1O5WC0c7BmzgYilPPs1xN-IQexu-e7Q-ZsDiewCxOeXZKcQ==

GET
H2 200 main~493df0b3.b86e2669.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 529E 7 KB
3 KB 9ms
9ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~493df0b3.b86e2669.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

d1d75ae838854e845b28c3472c3d235f92a944446d79165953ec813fc6323a70

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Origin: https://js.driftt.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Thu, 29 Feb 2024 20:30:29 GMT
x-amz-version-id: sa7zLOvJBKmMwU293nV0gngc542FulJ_
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 625353
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 13
last-modified: Thu, 29 Feb 2024 20:12:42 GMT
server: istio-envoy
etag: W/"cb79c6ff64f9222a7df5f053d31681c8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: q4aJoeqvrjpSRVpdjOJdsah864i7gKlXpc_b03FwgtBHfnm5j8DbJg==

OPTIONS
H2 200 queue
st.fullcircleinsights.com/v1/visits/ Frame 0
0 425ms
425ms Preflight
application/json 13.224.189.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://st.fullcircleinsights.com/v1/visits/queue
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-129.fra2.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: js-version,origin-fci,x-api-key
Access-Control-Request-Method: POST
Origin: https://www.menlosecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods: OPTIONS,POST
access-control-allow-origin: https://www.menlosecurity.com
content-length: 1
content-type: application/json
date: Fri, 08 Mar 2024 02:13:02 GMT
via: 1.1 c2a926ef1bafe1ab239d4761594a8098.cloudfront.net (CloudFront)
x-amz-apigw-id: UScXUFWbPHcEOmQ=
x-amz-cf-id: -oF5Xi7aX0wj8oHVF4i_bcpWC8zbHx0_WOrgV-R-ke126TXcETdaLA==
x-amz-cf-pop: FRA2-C1
x-amzn-requestid: ee63c5b0-3831-410a-90ed-1b8cbd8c4b10
x-cache: Miss from cloudfront

POST
H2 200 queue Show response
st.fullcircleinsights.com/v1/visits/ 2 KB
2 KB 471ms
471ms XHR
application/json 13.224.189.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://st.fullcircleinsights.com/v1/visits/queue
Requested by: Host: d2i34c80a0ftze.cloudfront.net
URL: https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=187d2103-bdc5-4e3f-b070-b5c6a4000840&domain=menlosecurity.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-129.fra2.r.cloudfront.net
Software: /
Resource Hash: e6d09589bfc7d0fa73746aae2571f7419912679feeee607b9f5ba827ad00f99c

Request headers

origin-fci: https://www.menlosecurity.com
Referer: https://www.menlosecurity.com/
accept-language: de-DE,de;q=0.9
js-version: 1.0.59
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
x-api-key: uSI2bzqNHv34zA8znmW0LgfsY9TBayMx9gZJf430
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 08 Mar 2024 02:13:02 GMT
via: 1.1 c2a926ef1bafe1ab239d4761594a8098.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
x-amzn-trace-id: Root=1-65ea742e-29736ff57c8253f07e44e251;Parent=003f6e2064665e21;Sampled=0;lineage=adebd93c:0
x-amzn-requestid: 7553ac24-9e63-4a19-bf6c-d34595ae691a
vary: Origin
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: https://www.menlosecurity.com
x-amz-apigw-id: UScXYHsjPHcEO_Q=
content-length: 2092
x-amz-cf-id: IIjg-JpvjqpwWjNZ6jJDynvlwxz3Hq4KEefverQ1H3WvQxKVw5IlJw==

GET
H2 200 51.558be3c5.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 529E 23 KB
8 KB 9ms
6ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b0af909b7ae6ad2644bfe2a60d939092aaf113b2cbc4ed2981a892869143b98a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 01:42:32 GMT
x-amz-version-id: jAn.UV4FUigTQ2pXuPEfcgJGaVkaFeLh
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 5531430
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Wed, 03 Jan 2024 21:36:01 GMT
server: istio-envoy
etag: W/"fa281fcbe4b2e35558d60fae3e316367"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 0CMjxSi-fuu4qjKUYSrGuPzvQh3jnzJx6a6asT4hb3D3I_LJs76kZQ==

GET
H2 200 34.9de9c855.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 529E 36 KB
10 KB 10ms
7ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/34.9de9c855.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

9f954d6e1256d528c39aa0b3768fae8fffc81ecddb0cda40058dc715d1cb212f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 28 Feb 2024 20:33:40 GMT
x-amz-version-id: aVYKLubPRStYzFi8RmbQTEpTBOY7Bsrb
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 711562
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 16
last-modified: Wed, 28 Feb 2024 20:09:24 GMT
server: istio-envoy
etag: W/"4db3dc70965816e2781d03c25ca5bf2e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 8TREVO6t-jXBki54Hst_8ZuzdtCN1C-x4TtZWk14dTizzytlaiF0tA==

GET
H2 200 22.6b9a301a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 529E 32 KB
11 KB 10ms
8ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/22.6b9a301a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

8f0f8792237470ee661c6afc32ca68200dd74bcc0d544d0fd54c7777af362eae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 23:47:36 GMT
x-amz-version-id: vXzNrqspXsAXcjt5Me_czePQe44sOTaA
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 2600726
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 18
last-modified: Tue, 06 Feb 2024 19:57:37 GMT
server: istio-envoy
etag: W/"d8739a9fe9a3a42936f5cd86c8727494"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 6yXnX83IhpCaIFjBw008lhFSHZoHwlKNxuAngrBVT7xo-8MHd2PoeA==

GET
H2 200 19.6f85b843.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 529E 17 KB
6 KB 12ms
10ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/19.6f85b843.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

afbd41e7209fa3aef6f53c7a5713aa542a7be54c432fec2d690e0dfaccd528d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: TS.9ApOzy..rylGKiVPdLcCX5dJ9HsBw
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 6268454
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 18
last-modified: Tue, 19 Dec 2023 18:34:37 GMT
server: istio-envoy
etag: W/"e28ebc3391b56e8f01ea063dc089e9d3"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: aGWy0QAsYBobem3j6diM3_BCaKR7VNExa6Wug0vA9waVWNa3ffs6Ig==

GET
H2 200 41.b4fc4de2.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 529E 25 KB
8 KB 13ms
10ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/41.b4fc4de2.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

edf1011ad272d21b66ae82a21a9d029186dc81c9f13972203fc3107f75835d4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 15 Jan 2024 07:31:30 GMT
x-amz-version-id: E9YrwVejTprhZqeWxhn5pc.KEORxTIm1
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4560091
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 14
last-modified: Thu, 11 Jan 2024 23:20:33 GMT
server: istio-envoy
etag: W/"a2ace4f65aa7b34dedb884f6cfe9df8d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: i0z6T78Enrst-GIwicy_KjvXq0XPIAILvIaDRb0qZ3UG0hQBSxUBbg==

GET
H2 200 20.8c21ea18.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 529E 74 KB
23 KB 13ms
11ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/20.8c21ea18.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: 4VyxTF9cOmpvyHPO7jaWSto1hTdtU.sl
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 6268454
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 45
last-modified: Tue, 19 Dec 2023 18:34:37 GMT
server: istio-envoy
etag: W/"6d77a76055d81227033363af2f18caf8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: MELc5CDdJXR0NH4d9UysXguT3t5clDIhqvRGbv_nLLfuwA3pyCIcjg==

GET
H2 200 26.04e7f30b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 529E 66 KB
20 KB 14ms
12ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/26.04e7f30b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

d70fa5dc6c8bfe9d7824be31e669528533d0879a2b1600a7df68b880f4d44296

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: cqsMaYjOHahH71A7EXhyHFywLOEay3sx
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 6268454
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 32
last-modified: Tue, 19 Dec 2023 16:15:24 GMT
server: istio-envoy
etag: W/"49ce5445ddcf5d24ef3badc4eb1a11dd"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 7f7gZKxq9GZdDP0A8xUjwa-9Uy-8vqmijDHPykI848mrFyx2GY9rvQ==

GET
H2 200 14.e24a6190.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 529E 91 KB
28 KB 15ms
13ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/14.e24a6190.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6c9c6406c9bd9814cf84974221433003377b67f071ec5411fddbcba4ec109bca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: iLluOjfpMSRsML8bOSqA9V8JfTEqMP9L
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 6268454
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Tue, 19 Dec 2023 18:34:37 GMT
server: istio-envoy
etag: W/"16d7ae86e21434a32157d3226ac9bb77"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: CjgNNyf8PZC16Ig8PvLmda-Ni-azaiyausslc2R9Ym7nMRYT0vuK3Q==

GET
H2 200 11.639238ba.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 529E 23 KB
7 KB 16ms
14ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/11.639238ba.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 15 Jan 2024 07:31:30 GMT
x-amz-version-id: fTPxsmx5We5V2pMGDl1ykjBzTcYFF2dc
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4560092
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
last-modified: Thu, 11 Jan 2024 23:20:32 GMT
server: istio-envoy
etag: W/"4049f38c00add1738dc4806148ff8829"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: mheCWoVeH_Fm5goCNEjJD4NoCcZ8I0YfX_bHs07FVmssKF5eTYz5pw==

GET
H2 200 18.9c1bd1fb.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 529E 62 KB
20 KB 17ms
15ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/18.9c1bd1fb.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e555f4b34b579e6528d6bbd4819620a634c0759b41dfa99520b7ca5aa5117b11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: q8W9FNPLIM8OX5drRDX0sp4TnKuKPMbY
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 6268454
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 21
last-modified: Tue, 19 Dec 2023 18:34:37 GMT
server: istio-envoy
etag: W/"02f09379c544befa413d22eb57ed41de"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: d1aiPmAtHFqzGu4o7KDUGtW66arjZiedYMdvwCPcIxGpxsgX-DaD9g==

GET
H2 200 49.f7274268.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 529E 105 KB
34 KB 18ms
16ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/49.f7274268.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6861a320271e0fda832800e20d53b858ef409f88d9bc9c1a48953888289d1ea3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: sZGsqYJSO5RNt4iGri.m215HFs7tyyoY
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 6268454
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 22
last-modified: Tue, 19 Dec 2023 16:15:24 GMT
server: istio-envoy
etag: W/"e268d36b98f0119a2bb1a15f69fd4ffe"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: -v6s_shwYu_Ph0eYOyNWNBGUFXAQa-zar7v2efjv9ia4PDAqHg_TNw==

GET
H2 200 40.31ef8dbf.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 529E 12 KB
4 KB 20ms
18ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/40.31ef8dbf.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

bba54915db71fc417be4d5852ec7d138d7c3fa90356ddee98b5267a7db7e6b5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 03:25:55 GMT
x-amz-version-id: d4Mpj6_OHbbARq4FSdDizJv80LDhJS9j
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 7944427
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 37
last-modified: Wed, 06 Dec 2023 19:18:01 GMT
server: istio-envoy
etag: W/"b0793fa46e8c0ae1846b7be8a833da35"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: gr8G7soNRNCUNHPschMNPHr28xHmRy6GO2bqfo7fYIlkChh6DiruaA==

GET
H2 200 28.190877b8.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 529E 13 KB
6 KB 21ms
19ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/28.190877b8.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

d7ead427aca51c227410c4595b49b48dde8f9e76864b4f3fcb32861034b0c6a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 28 Feb 2024 20:33:40 GMT
x-amz-version-id: pQnA6v43oECrxe8G1Al4Smp1uPVlKNM3
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 711562
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Wed, 28 Feb 2024 20:09:23 GMT
server: istio-envoy
etag: W/"94c7e7cb2f40e10abeee8e28c0f68eb7"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: SrUwFHchmfyDnSKAkdIrG_Ae648k39XRBgCXLbUc3Dk2d8EZbUtRDg==

GET
H2 200 21.b8c41db9.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 529E 17 KB
7 KB 21ms
20ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/21.b8c41db9.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 15 Jan 2024 07:31:30 GMT
x-amz-version-id: mbKfJZbsWw.V.LuUA4S0Y6Eza3IzJhvH
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4560092
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 15
last-modified: Thu, 11 Jan 2024 23:20:33 GMT
server: istio-envoy
etag: W/"65e5c965272e021ae33ff8bc39565ef5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 5pem8dXn8mmtuv5yctkVjGGuX8Ii3wu-lGJQXYj8bDRI-yTDkCIwgw==

GET
H2 200 8.ab226b4a.chunk.css
js.driftt.com/core/assets/css/ Frame 529E 31 KB
4 KB 10ms
8ms Stylesheet
text/css 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/8.ab226b4a.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

ff8f406b684c6674dbd3705d3f6d2cd10b5eedbc2c67a7773f235d69ef122d04

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 21:38:16 GMT
x-amz-version-id: Iy50rWLvnka9klYMF5qa_8hsgho0e_uB
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3558886
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Fri, 26 Jan 2024 18:11:46 GMT
server: istio-envoy
etag: W/"1e97f00f07b87f701d0bf06259f954e4"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 0XBkc2neNV8idjjij5MWEZ9aedqZeNlV--Q2naEDtq_rggdn9p2lFA==

GET
H2 200 8.ce202881.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 529E 82 KB
26 KB 23ms
22ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/8.ce202881.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

3337f36bd89c27dbe1dca4b71fb177d826b736950f2150aff6acce0180a86fc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 20:20:36 GMT
x-amz-version-id: mQIEwfFQyClv1G1Ejf6MWBI5BBswFf_l
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3217946
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 93
last-modified: Tue, 30 Jan 2024 16:30:58 GMT
server: istio-envoy
etag: W/"182944c0e758d6ff6a202ce976d91cc6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: DL0W5PeFrpurtGbu55qkdc53PIfJEB8a2J5gZAUiWV90SIFdeiCDIw==

GET
H2 200 16.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame 529E 24 B
697 B 10ms
9ms Stylesheet
text/css 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/16.22abfce0.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 10:04:47 GMT
x-amz-version-id: oL98YdzlpaGyxUOIAT2tnEGpxnQwpHij
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA60-P6
age: 6278895
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 13
content-length: 24
last-modified: Tue, 19 Dec 2023 18:34:35 GMT
server: istio-envoy
etag: "0c5dad92482d9a7c7c253510f5082465"
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Nl0V8_zo9VeHLzA3uw2Ey06Mzq7BDQpCtXoJ7O0wMgQ8u_89mqMRvQ==

GET
H2 200 16.ce5b49fb.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 529E 93 KB
24 KB 23ms
23ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/16.ce5b49fb.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6b141e7fce6d9ec4c281ca4bcf494f31fc7a24c7aa1fdda838dd5e7ceff2a3b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 28 Feb 2024 20:33:40 GMT
x-amz-version-id: dOxjx378gZY_AVke4cRWFBVQ4oz9fy0X
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 711562
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 28
last-modified: Wed, 28 Feb 2024 20:09:23 GMT
server: istio-envoy
etag: W/"2004af3a9dab938169f2ea62c789c850"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: YwPj-6sUhEj9j0hBkFmJHfE96hkXvW4z0Hha-WunwU7OQBQ90PjpTg==

GET
H2 200 24.f156ac0b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 529E 51 KB
14 KB 26ms
25ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/24.f156ac0b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e0a5cea44ef10b590cbdd293e5356beec37b4515a45af600cb6bd839d774bfb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 20:53:37 GMT
x-amz-version-id: 912IrOxTzK0d0pxydhEmBJnYzrZScyQp
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 191965
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 13
last-modified: Tue, 05 Mar 2024 20:17:50 GMT
server: istio-envoy
etag: W/"84a1a3421b124fe0033da2dc1eb60e5f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: qriZY3BwuJ1RHvywDdi95qwHJHzmxJOlx2t8JnnW7dv3GrzgA-SZfg==

GET
H2 200 17.e4fe4aa9.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 529E 40 KB
13 KB 26ms
25ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/17.e4fe4aa9.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b7fe4dab17faeca12818ad0f933516d03f51fe7454e1bbfd983c221cab8358db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 20:53:37 GMT
x-amz-version-id: Du7VQSLBFHCC32UNB4Y0p04GHRSsvnKr
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 191965
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 15
last-modified: Tue, 05 Mar 2024 20:17:50 GMT
server: istio-envoy
etag: W/"3852ed7187bdfa5db5fddd577cd30fcf"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: EQebgR5k39mvH87yWOoqSfWTj5A0hS9qidFnrMmRkuuj3i_sqWUjMw==

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 212ms
212ms Image
image/gif 95.101.133.17
TWELVE99 Arelion

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=ed586d43-842e-410a-87a5-0ef021b912a0&session=a3ec907f-4b7e-4ab1-8e3a-6fe7e50e586e&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2008%20Mar%202024%2002%3A13%3A02%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2008%20Mar%202024%2002%3A13%3A01%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20the%20latest%20developments%20in%20the%20cyberattack%20saga%20involving%20U.S.%20healthcare%20giant%20Change%20Healthcare%20and%20the%20notorious%20BlackCat%20ransomware%20group.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Swindled%20Blackcat%20affiliate%20wants%20money%20from%20Change%20Healthcare%20ransom%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom&pageViewId=66266a4e-ca2c-4542-8cf5-88520ed567c7&an_uid=0&webTagId=9d098b8d-9cde-40ee-beab-3b850059beba&v=1.1.15

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.133.17 Liljeholmen, Sweden, ASN1299 (TWELVE99 Arelion, fka Telia Carrier, SE),

Reverse DNS

a95-101-133-17.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:02 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 0.0b2ebd4a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 529E 9 KB
3 KB 8ms
7ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:50 GMT
x-amz-version-id: wIYiMMOv59k7p4Fbql5xBCm9H7moGtf2
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 6268452
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 15
last-modified: Tue, 19 Dec 2023 18:34:36 GMT
server: istio-envoy
etag: W/"c5efcdc9e465604f32cf24af10fd6c13"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 3DcdMX_eCQJbrzscRdUaY6oIDFI-0bEkBJjsTf6ZFomfIILW2nd_PA==

GET
H2 200 30.c2cfa051.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 529E 27 KB
9 KB 8ms
8ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/30.c2cfa051.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

2c3fa8534f4d4c1cb14f56e8da5245bd5ce330ee5b5471800cad7efff6de6d32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 28 Feb 2024 20:33:40 GMT
x-amz-version-id: WRs_97QbIyhXtqFAWyOeQDG0ect7XzUO
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 711562
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Wed, 28 Feb 2024 20:09:24 GMT
server: istio-envoy
etag: W/"7b578d5ff5946531a07be989a9a973ce"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: wT6PvsZKtgZf5Gsdgr3TmIaTgXeq4l-LQl2AmHUJ_tbsqhMIk1KxIA==

GET
H2 200 27.b5e8f5e1.chunk.css
js.driftt.com/core/assets/css/ Frame 529E 8 KB
2 KB 9ms
8ms Stylesheet
text/css 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/27.b5e8f5e1.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

7849ba1748f8188749df28e9d59ca4e570a8495684353d8df4715fa70a81e787

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 28 Feb 2024 20:33:40 GMT
x-amz-version-id: zyzXY0HiUV0Kx0xDA0irOuT14sRG0uSI
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 711562
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 18
last-modified: Wed, 28 Feb 2024 20:09:21 GMT
server: istio-envoy
etag: W/"e7107bc29ccb3c6d928f0f8f10a0f22d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: SJXEklT-ve9pvDxIIDWSSW_R990p0NdS2eXX8eJOf_pve1-oSrS7Cg==

GET
H2 200 27.b57db11e.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 529E 15 KB
6 KB 10ms
10ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/27.b57db11e.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b39e7d22263c6683b1970ca8a143c4809b7467a019c0b37170633a9aed6c9e16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 28 Feb 2024 20:33:40 GMT
x-amz-version-id: DDyhxCIla0VHIBRUayAFADfdjSTthw24
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 711562
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 18
last-modified: Wed, 28 Feb 2024 20:09:23 GMT
server: istio-envoy
etag: W/"7c8b67017ca47bece2215effbb5ae466"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: AHNzSN0Bkf5P9TRHryFlb7bQMnAoinMDx4gR6fgob8_eiJuzR4sz1A==

GET
H2 200 25.c695453b.chunk.css
js.driftt.com/core/assets/css/ Frame 529E 365 B
1 KB 9ms
9ms Stylesheet
text/css 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/25.c695453b.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 12:03:54 GMT
x-amz-version-id: 0H7FjD7Jl9xIJbAVeMxI..hCPUWnSz0t
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA60-P6
age: 8777348
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
content-length: 365
last-modified: Tue, 21 Nov 2023 16:21:39 GMT
server: istio-envoy
etag: "06b2963b029c0824382815165bfea73e"
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 82CnQUjWstDR7pMLL6KfGMJ6XjVoHuxeqUYaWYg1neMH3ZokDCpKSw==

GET
H2 200 25.336e154d.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 529E 92 KB
25 KB 11ms
10ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/25.336e154d.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

ab785c5c76d12e6b62f6339857d15907af1796ace2907bf2d8c5a1e4fc264994

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 28 Feb 2024 20:33:40 GMT
x-amz-version-id: rwxXP_skNyNEbbAgaJLzImoj5vuEcmrP
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 711561
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 47
last-modified: Wed, 28 Feb 2024 20:09:23 GMT
server: istio-envoy
etag: W/"e5142d5070c3e7f472bcddfd3ba4632a"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 03uMNMRceuJ5QwrQOiTwCjOnj4Q8TNfzjQYtmGpFnPZPXZbJ03zVTQ==

POST
H2 200 v2 Show response
bootstrap.driftapi.com/widget_bootstrap/ping/ Frame 529E 208 B
851 B 182ms
95ms XHR
application/json 18.172.112.55
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://bootstrap.driftapi.com/widget_bootstrap/ping/v2

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.172.112.55 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-172-112-55.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

8a156cc165020c931aa074da38f144e3eb816e8ab4ce0d58ef693b5180530910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 08 Mar 2024 02:13:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 efb576f3260fb935bd57cce721b78428.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P8
requestid: 249f7edf896582d2
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 2
content-length: 208
server: istio-envoy
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
x-amz-cf-id: SGoi5AG_XS0Lz23zjCqAivnjXtWgmVyCbGePfwqCMQol6UtiXLPo9A==

GET
H2 200 83162 Show response
app.hushly.com/runtime/countries/ 75 KB
20 KB 178ms
178ms Script
text/javascript 44.240.168.231
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://app.hushly.com/runtime/countries/83162?callback=hushlyCountriesCallback&_=1709863981849

Requested by

Host: app.hushly.com
URL: https://app.hushly.com/assets/widget-ab46592fde4b3ba2c349bb7f7f39256d.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.240.168.231 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-240-168-231.us-west-2.compute.amazonaws.com

Software

Resource Hash

68b4b6fc343811ef9268a786ba1a6d45532277051d2db7804896df2b58a9b429

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-encoding: gzip
content-security-policy
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=31536000, public
x-robots-tag: noindex

POST
H2 200 v3 Show response
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame 529E 25 B
466 B 387ms
118ms XHR
application/json 3.94.218.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/widget/init/v3

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-94-218-138.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 08 Mar 2024 02:13:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: istio-envoy
requestid: bf3c372f3ef6bb87
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
vary: Accept-Encoding
access-control-allow-credentials: true
x-envoy-upstream-service-time: 12
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 25

POST
H2 200 widget_bootstrap Show response
bootstrap.driftapi.com/ Frame 529E 19 KB
8 KB 570ms
569ms XHR
application/json 18.172.112.55
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://bootstrap.driftapi.com/widget_bootstrap

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.172.112.55 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-172-112-55.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

29406c757b6db9e44d1678a6b414b769788fce77f3525fc0aa46906ad95647d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 08 Mar 2024 02:13:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
via: 1.1 efb576f3260fb935bd57cce721b78428.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P8
requestid: 698f3e68fb3f6ef0
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 283
server: istio-envoy
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
x-amz-cf-id: SZpCOVwqdxdtsSomSynQag-2aa2KF2N1wMT7jUIAZJa6jMEG-wW1og==

GET
H3 200 / Show response
ws.zoominfo.com/pixel/GQ57xOfAtqXGOqCfMFaF/ 3 KB
2 KB 319ms
281ms Fetch
text/javascript 2606:4700::6810:890f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/GQ57xOfAtqXGOqCfMFaF/?iszitag=true

Requested by

Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:890f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

ccdab784ba249c97ca9c318ffd0604dfa449d6c0485dcf69ca231b49ebfa82b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

visited-url: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
Referer: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
_vtok: MTg1LjIxMy4xNTUuMTUz
_zitok: adae0532f0c40f116e001709863982
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: text/javascript

Response headers

date: Fri, 08 Mar 2024 02:13:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 google
server: cloudflare
x-powered-by: Express
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: https://www.menlosecurity.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
alt-svc: h3=":443"; ma=86400
cf-ray: 860f4dc44a352bdd-FRA

OPTIONS
H2 200 /
ws.zoominfo.com/pixel/GQ57xOfAtqXGOqCfMFaF/ Frame 0
0 182ms
151ms Preflight
text/html 2606:4700::6810:890f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/GQ57xOfAtqXGOqCfMFaF/?iszitag=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:890f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: _vtok,_zitok,content-type,visited-url
Access-Control-Request-Method: GET
Origin: https://www.menlosecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
access-control-allow-origin: https://www.menlosecurity.com
allow: GET,HEAD
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 860f4dc31ae503a6-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 08 Mar 2024 02:13:02 GMT
server: cloudflare
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 212ms
212ms Image
image/gif 95.101.133.17
TWELVE99 Arelion

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=ed586d43-842e-410a-87a5-0ef021b912a0&session=a3ec907f-4b7e-4ab1-8e3a-6fe7e50e586e&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2008%20Mar%202024%2002%3A13%3A03%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2008%20Mar%202024%2002%3A13%3A02%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%222002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20the%20latest%20developments%20in%20the%20cyberattack%20saga%20involving%20U.S.%20healthcare%20giant%20Change%20Healthcare%20and%20the%20notorious%20BlackCat%20ransomware%20group.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Swindled%20Blackcat%20affiliate%20wants%20money%20from%20Change%20Healthcare%20ransom%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom&pageViewId=66266a4e-ca2c-4542-8cf5-88520ed567c7&an_uid=0&webTagId=9d098b8d-9cde-40ee-beab-3b850059beba&v=1.1.15

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.133.17 Liljeholmen, Sweden, ASN1299 (TWELVE99 Arelion, fka Telia Carrier, SE),

Reverse DNS

a95-101-133-17.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:03 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 200 track Show response
event.api.drift.com/ Frame 529E 702 B
761 B 105ms
105ms XHR
application/json 3.94.218.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://event.api.drift.com/track

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-94-218-138.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

44d206c83f9d5d2637bebd2c01344c412aa05669eed169181306c62d4daae7e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiIyMTIzOTk3NDU3NiIsImNsaWVudElkIjoiZjZ6dWl6ZHloeHJtN3IiLCJ1c2VySWRUeXBlIjoiTEVBRCIsInNjb3BlIjoibGVhZCIsImlzcyI6IjEwNDQzMzYiLCJleHAiOjE3NDEzOTk5ODIsImlhdCI6MTcwOTg2Mzk4Mn0.8YXEJrMesOkKEuL9nx3Sb__EEyoxE1wRz1H09UL9IATqZ6dOA_8NfGFahiiTi-IaaAbTuG_jqqFC0Eboe_-OFQ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 08 Mar 2024 02:13:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: istio-envoy
requestid: 269cc7099b844fb3
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 702

OPTIONS
H2 200 track
event.api.drift.com/ Frame 0
0 132ms
104ms Preflight
text/plain 3.94.218.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://event.api.drift.com/track

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-94-218-138.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://js.driftt.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-max-age: 1209600
allow: POST,OPTIONS
content-length: 13
content-type: text/plain
date: Fri, 08 Mar 2024 02:13:03 GMT
requestid: drift8a2cb914e3b9e53437dc037e9e5
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
x-envoy-upstream-service-time: 1

POST
H2 200 evaluate_with_log Show response
targeting.api.drift.com/targeting/ Frame 529E 460 B
335 B 107ms
107ms XHR
application/json 3.94.218.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/targeting/evaluate_with_log

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-94-218-138.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

3f9d4371f39aa30430e6ce0dfcc48d5155b2baeb63d0f2d886d7df52e4bf040d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiIyMTIzOTk3NDU3NiIsImNsaWVudElkIjoiZjZ6dWl6ZHloeHJtN3IiLCJ1c2VySWRUeXBlIjoiTEVBRCIsInNjb3BlIjoibGVhZCIsImlzcyI6IjEwNDQzMzYiLCJleHAiOjE3NDEzOTk5ODIsImlhdCI6MTcwOTg2Mzk4Mn0.8YXEJrMesOkKEuL9nx3Sb__EEyoxE1wRz1H09UL9IATqZ6dOA_8NfGFahiiTi-IaaAbTuG_jqqFC0Eboe_-OFQ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 08 Mar 2024 02:13:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
server: istio-envoy
requestid: e301bc07489968d2
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
vary: Accept-Encoding
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 267

OPTIONS
H2 200 evaluate_with_log
targeting.api.drift.com/targeting/ Frame 0
0 113ms
104ms Preflight
text/plain 3.94.218.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/targeting/evaluate_with_log

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-94-218-138.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://js.driftt.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-max-age: 1209600
allow: POST,OPTIONS
content-length: 13
content-type: text/plain
date: Fri, 08 Mar 2024 02:13:03 GMT
requestid: drift64a7ec74f8c9a6343aa714178f0
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
x-envoy-upstream-service-time: 1

POST
H2 204 widget Show response
targeting.api.drift.com/impressions/ Frame 529E 0
37 B 113ms
112ms XHR
text/plain 3.94.218.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/impressions/widget

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-94-218-138.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiIyMTIzOTk3NDU3NiIsImNsaWVudElkIjoiZjZ6dWl6ZHloeHJtN3IiLCJ1c2VySWRUeXBlIjoiTEVBRCIsInNjb3BlIjoibGVhZCIsImlzcyI6IjEwNDQzMzYiLCJleHAiOjE3NDEzOTk5ODIsImlhdCI6MTcwOTg2Mzk4Mn0.8YXEJrMesOkKEuL9nx3Sb__EEyoxE1wRz1H09UL9IATqZ6dOA_8NfGFahiiTi-IaaAbTuG_jqqFC0Eboe_-OFQ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 08 Mar 2024 02:13:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: istio-envoy
requestid: 20c65003f9234a4b
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-credentials: true
x-envoy-upstream-service-time: 9
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version

OPTIONS
H2 200 widget
targeting.api.drift.com/impressions/ Frame 0
0 104ms
104ms Preflight
text/plain 3.94.218.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/impressions/widget

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-94-218-138.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://js.driftt.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-max-age: 1209600
allow: POST,OPTIONS
content-length: 13
content-type: text/plain
date: Fri, 08 Mar 2024 02:13:03 GMT
requestid: driftba6c0fd46c1bf7bfaac2ac05356
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
x-envoy-upstream-service-time: 1

GET
H2 200 57.28dde8ce.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 529E 19 KB
7 KB 7ms
7ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/57.28dde8ce.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

594d3ade307f6f48a5ef5143228b9da7c4e78589177ac70e91d31fe75ea83d60

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=4a481d0e-f080-4104-9579-1ed2107bf345&sessionStarted=1709863981.857&campaignRefreshToken=872fd543-6767-4804-bbff-fd73d2e91dca&hideController=false&pageLoadStartTime=1709863980259&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 15 Jan 2024 07:31:34 GMT
x-amz-version-id: Zqc8tAJgSsjNOAXYaxQdNZubY1vGBLp.
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4560089
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 16
last-modified: Thu, 11 Jan 2024 23:20:34 GMT
server: istio-envoy
etag: W/"3c4cd13822c0069a68e9f9c8240f5ba9"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: PCChshu5ww3I-eFfV1tW2GPGWoMmydZMvGU0IWHam2Qg5jiE7pUuBg==

GET
H2 200 57.28dde8ce.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 43B6 19 KB
7 KB 8ms
8ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/57.28dde8ce.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.e07e16f3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

594d3ade307f6f48a5ef5143228b9da7c4e78589177ac70e91d31fe75ea83d60

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1709863980259
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 15 Jan 2024 07:31:34 GMT
x-amz-version-id: Zqc8tAJgSsjNOAXYaxQdNZubY1vGBLp.
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4560089
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 16
last-modified: Thu, 11 Jan 2024 23:20:34 GMT
server: istio-envoy
etag: W/"3c4cd13822c0069a68e9f9c8240f5ba9"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: H53SCtF2Kwpp9TpSa9DBY063grY7GV1xCmp6prtICfilfLNsdnDLZQ==

GET
H2 200 https%3A%2F%2Fdriftt.imgix.net%2Fhttps%253A%252F%252Fs3.amazonaws.com%252Fcustomer-api-avatars-prod%252F1193133%252Fb560b8f00aa88f9db3a4e22ecc4dfe8bz5729p78r3ak%3Ffit%3Dmax%26fm%3Dpng%26h%3D200%26w...
driftt.imgix.net/ Frame 529E 588 B
917 B 32ms
7ms Image
image/png 2a04:4e42:200::720
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://driftt.imgix.net/https%3A%2F%2Fdriftt.imgix.net%2Fhttps%253A%252F%252Fs3.amazonaws.com%252Fcustomer-api-avatars-prod%252F1193133%252Fb560b8f00aa88f9db3a4e22ecc4dfe8bz5729p78r3ak%3Ffit%3Dmax%26fm%3Dpng%26h%3D200%26w%3D200%26s%3Db1bf4f6de2ccd453089f859edf075ec1?fit=max&fm=png&h=200&w=200&s=36c1ab91f635a44e1c80c5b67cfebd98

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::720 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Google Frontend /

Resource Hash

51356fa79699268ffecc5052d61a15c56d95620b54d0c3b2c9238ce84fcc269a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:03 GMT
x-content-type-options: nosniff
age: 3856227
x-cache: HIT, HIT
x-imgix-id: 29be88909c1aab1da260a7839229e6825c7e3bf0
cross-origin-resource-policy: cross-origin
content-length: 588
x-served-by: cache-sjc1000104-SJC, cache-fra-eddf8230105-FRA
x-imgix-render-farm: 02.131624
last-modified: Tue, 23 Jan 2024 11:02:36 GMT
server: Google Frontend
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=315360000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-mu0SC55I.woff2
js.driftt.com/deploy/assets/static/fonts/ Frame 529E 38 KB
39 KB 8ms
8ms Font
font/woff2 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/deploy/assets/static/fonts/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-mu0SC55I.woff2

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/css/8.ab226b4a.chunk.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

fbeb296c1ecc216a17bda77bf65e833cc0410cfbe1908e121f7a4549cc390675

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/assets/css/8.ab226b4a.chunk.css
Origin: https://js.driftt.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 18:51:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3050516
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 50
content-length: 39372
last-modified: Fri, 03 Mar 2023 16:21:38 GMT
server: istio-envoy
etag: "40b6965b5cd26213faf61e5ab6765bb9"
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/font-woff2,font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: hq2ktHB0gkWbnnQtii5-pqMw8ZLfPljHQaFg_Cj3867dEXDGzjGjRg==

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-mu0SC55I.woff2
js.driftt.com/deploy/assets/static/fonts/ Frame 43B6 38 KB
39 KB 9ms
8ms Font
font/woff2 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/deploy/assets/static/fonts/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-mu0SC55I.woff2

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/css/8.ab226b4a.chunk.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

fbeb296c1ecc216a17bda77bf65e833cc0410cfbe1908e121f7a4549cc390675

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/assets/css/8.ab226b4a.chunk.css
Origin: https://js.driftt.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 18:51:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3050516
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 50
content-length: 39372
last-modified: Fri, 03 Mar 2023 16:21:38 GMT
server: istio-envoy
etag: "40b6965b5cd26213faf61e5ab6765bb9"
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/font-woff2,font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: f3hILzJ4prO2MZK5GtIyROW-9H7rN7eaih6KwuWcGl2kwlG_ZJESig==

GET
H2 200 3.ee35dea2.chunk.js Show response
js.driftt.com/conductor/assets/ 158 B
853 B 7ms
7ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/conductor/assets/3.ee35dea2.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1709864100000/trrsm2wf4gwm.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

3005a54fc57fc2d8c70cc41e4ca7fcaaed7514b03f28581082c454e6a2d11f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 23 Jul 2023 23:38:44 GMT
x-amz-version-id: pMohofQYEF1dohPHFcPmV3oeRzVr6CuK
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA60-P6
age: 19708459
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 22
content-length: 158
last-modified: Fri, 21 Jul 2023 20:53:14 GMT
server: istio-envoy
etag: "e6714addd36102488fb27a980401fd36"
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: xxgaNSUi-87BKgmampL0L-Dko2VYfouHYIyk829-z2TdCCZIgVrh3Q==

GET
H2 206 notification.5f7c6014.mp3
js.driftt.com/conductor/assets/media/ 8 KB
8 KB 9ms
7ms Media
audio/mpeg 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/conductor/assets/media/notification.5f7c6014.mp3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

bf06f41bb3a1429115fa2dcfbee9986234d6d319da3597648e4e980340d52027

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.menlosecurity.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Range: bytes=0-

Response headers

date: Wed, 20 Sep 2023 11:20:11 GMT
x-amz-version-id: AJ3ftWhvW2h954Q3Lc0BJKBcX87AS953
via: 1.1 fca814089bc9a82fba87ce0548f9f358.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA60-P6
age: 14655172
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
Content-Range: bytes 0-7754/7755
x-envoy-upstream-service-time: 16
Content-Length: 7755
last-modified: Mon, 18 Sep 2023 19:58:12 GMT
server: istio-envoy
etag: "5f7c6014cf73831f91963a668b71fbb9"
access-control-allow-methods: GET, POST, OPTIONS
content-type: audio/mpeg
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: g0_Oq_ak17hrTYMlCA0bPgye44R5qhKl8wg9N-vl_vHfC6xigJ6lhA==

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 213ms
213ms Image
image/gif 95.101.133.17
TWELVE99 Arelion

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=ed586d43-842e-410a-87a5-0ef021b912a0&session=a3ec907f-4b7e-4ab1-8e3a-6fe7e50e586e&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2008%20Mar%202024%2002%3A13%3A04%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2008%20Mar%202024%2002%3A13%3A03%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20the%20latest%20developments%20in%20the%20cyberattack%20saga%20involving%20U.S.%20healthcare%20giant%20Change%20Healthcare%20and%20the%20notorious%20BlackCat%20ransomware%20group.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Swindled%20Blackcat%20affiliate%20wants%20money%20from%20Change%20Healthcare%20ransom%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom&pageViewId=66266a4e-ca2c-4542-8cf5-88520ed567c7&an_uid=0&webTagId=9d098b8d-9cde-40ee-beab-3b850059beba&v=1.1.15

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.133.17 Liljeholmen, Sweden, ASN1299 (TWELVE99 Arelion, fka Telia Carrier, SE),

Reverse DNS

a95-101-133-17.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:04 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 200 bulk Show response
metrics.api.drift.com/monitoring/metrics/event3/ Frame 529E 25 B
112 B 116ms
116ms XHR
application/json 3.94.218.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/event3/bulk

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-94-218-138.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 08 Mar 2024 02:13:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: istio-envoy
requestid: ffad14ffb1d412f6
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
vary: Accept-Encoding
access-control-allow-credentials: true
x-envoy-upstream-service-time: 13
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 25

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 212ms
211ms Image
image/gif 95.101.133.17
TWELVE99 Arelion

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=ed586d43-842e-410a-87a5-0ef021b912a0&session=a3ec907f-4b7e-4ab1-8e3a-6fe7e50e586e&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2008%20Mar%202024%2002%3A13%3A05%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2008%20Mar%202024%2002%3A13%3A04%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20the%20latest%20developments%20in%20the%20cyberattack%20saga%20involving%20U.S.%20healthcare%20giant%20Change%20Healthcare%20and%20the%20notorious%20BlackCat%20ransomware%20group.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Swindled%20Blackcat%20affiliate%20wants%20money%20from%20Change%20Healthcare%20ransom%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom&pageViewId=66266a4e-ca2c-4542-8cf5-88520ed567c7&an_uid=0&webTagId=9d098b8d-9cde-40ee-beab-3b850059beba&v=1.1.15

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.133.17 Liljeholmen, Sweden, ASN1299 (TWELVE99 Arelion, fka Telia Carrier, SE),

Reverse DNS

a95-101-133-17.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:05 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 360ms
360ms Image
image/gif 95.101.133.17
TWELVE99 Arelion

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=ed586d43-842e-410a-87a5-0ef021b912a0&session=a3ec907f-4b7e-4ab1-8e3a-6fe7e50e586e&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2008%20Mar%202024%2002%3A13%3A06%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2008%20Mar%202024%2002%3A13%3A05%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%225004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20the%20latest%20developments%20in%20the%20cyberattack%20saga%20involving%20U.S.%20healthcare%20giant%20Change%20Healthcare%20and%20the%20notorious%20BlackCat%20ransomware%20group.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Swindled%20Blackcat%20affiliate%20wants%20money%20from%20Change%20Healthcare%20ransom%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom&pageViewId=66266a4e-ca2c-4542-8cf5-88520ed567c7&an_uid=0&webTagId=9d098b8d-9cde-40ee-beab-3b850059beba&v=1.1.15

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.133.17 Liljeholmen, Sweden, ASN1299 (TWELVE99 Arelion, fka Telia Carrier, SE),

Reverse DNS

a95-101-133-17.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Fri, 08 Mar 2024 02:13:06 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
54 B 18ms
17ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-C2G0PCSJKE&gtm=45je4360v868642232z8830118234za220&_p=1709863980338&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=1508834351.1709863981&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_eu=EA&_s=2&sid=1709863980&sct=1&seg=0&dl=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom&dt=Swindled%20Blackcat%20affiliate%20wants%20money%20from%20Change%20Healthcare%20ransom%20-%20Blog%20%7C%20Menlo%20Security&en=company_details_6si&_et=682&up.company_name_6si=(Non-company%20Visit)&up.company_country_6si=Germany&up.company_is_6qa_6si=false&tfd=6357
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-C2G0PCSJKE&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Mar 2024 02:13:06 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.menlosecurity.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: analytics.twitter.com
URL: https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=30cea1c3-e2f2-44eb-8c73-4a021b73c02f&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=1f8ee4bd-c827-4a29-b5e2-09f7d209f7e0&tw_document_href=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nx5nr&type=javascript&version=2.3.29

Verdicts & Comments Add Verdict or Comment

103 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

42 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.info.menlosecurity.com/	1970-01-20 18:57:45	Name: __cf_bm Value: S95TTAa6SdH2qQM0LzxmR6BxYc132h4.NirWn4Dw8p4-1709863980-1.0.1.1-3xkWZqsT1rq9bTd9s1sI9hCEnOJ39pisuA.5cXryLouzuZmMrN0F0lGfnM49SzcWUq6eThiHaBPs.phP80YXSA
.menlosecurity.com/	1970-01-20 21:07:19	Name: _gcl_au Value: 1.1.247068049.1709863981
.menlosecurity.com/	1970-01-21 03:43:19	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Fri+Mar+08+2024+03%3A13%3A00+GMT%2B0100+(Central+European+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=7614a54a-b2a3-4626-8cfa-b86c8eea4bb6&interactionCount=0&landingPath=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fswindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom&groups=C0003%3A0%2CC0002%3A0%2CC0004%3A0%2CC0001%3A1
.techtarget.com/	1970-01-20 18:57:45	Name: __cf_bm Value: XVOmu8KVdrhqy9pGW9eYdTyLPSe6Ji0ib.E1Xb7DXo8-1709863980-1.0.1.1-3QZ8IllLYjMMUfNzq4_fpjqakvcF028vrx53Qk.H8DYyC1kD7A4YzdImOaVp.P01vww30CsDIIoJHzRoeGIh_w
.menlosecurity.com/	1970-01-21 04:33:43	Name: _mkto_trk Value: id:281-OWV-899&token:_mch-menlosecurity.com-1709863980743-14392
.menlosecurity.com/	1970-01-20 21:07:19	Name: _fbp Value: fb.1.1709863980755.1702027119
.menlosecurity.com/	1970-01-21 03:43:19	Name: _hjSessionUser_1854968 Value: eyJpZCI6IjE1YTRmNGZiLTFiNzgtNTdjYS1hMWRhLWEwMjczNDQzMjE1MSIsImNyZWF0ZWQiOjE3MDk4NjM5ODA3NzYsImV4aXN0aW5nIjp0cnVlfQ==
.t.co/	1970-01-21 04:33:43	Name: muc_ads Value: a5207113-a396-4b86-ae94-9bdb37f7174c
.menlosecurity.com/	1970-01-20 18:57:45	Name: _hjSession_1854968 Value: eyJpZCI6ImRkNDI0MDc3LWI5OTAtNDQwYS1hYTVkLWJjNzJjZTY2MjI3MiIsImMiOjE3MDk4NjM5ODA3NzcsInMiOjEsInIiOjEsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
info.menlosecurity.com/	1969-12-31 23:59:59	Name: BIGipServersj21web-nginx-app_https Value: !KNEY30yhfkvJ3a1zLZqvSn7MxZbkrcxEsIqPalwUPS0Cq+5l91l5NTPJJ4+n7YHfslms7kU3EROOToM=
.linkedin.com/	1970-01-20 21:07:19	Name: li_sugr Value: 42de4b1f-ab2e-4757-8539-f4b80cbdd381
.linkedin.com/	1970-01-21 03:43:19	Name: bcookie Value: "v=2&179f7803-00d9-4ff8-89b0-8d0ef5203bf3"
.linkedin.com/	1970-01-20 18:59:10	Name: lidc Value: "b=TGST04:s=T:r=T:a=T:p=T:g=3139:u=1:x=1:i=1709863980:t=1709950380:v=2:sig=AQHnrENUaRqUlQzBk6BuXZeunCcj-tG2"
.linkedin.com/	1970-01-20 19:40:55	Name: UserMatchHistory Value: AQIccC7-lWk8VQAAAY4b1c-RR_wvBSHK7hV8bBsM6eFCGIjUF2uHObW9Lxsrgx2BbTf7nCP9UlZpdQ
.linkedin.com/	1970-01-20 19:40:55	Name: AnalyticsSyncHistory Value: AQL2xb2G3Z-uxAAAAY4b1c-RauCMhh7XTBBalF9sf8jbsO6wfkvIYAONFptRqwnx0_yJdXgYUdY3nbcS23Fxhg
www.menlosecurity.com/	1970-01-20 19:07:48	Name: slireg Value: https://scout.us2.salesloft.com
app.hushly.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: C993D20AB34586657FE92FD4EC7D92BE
.hushly.com/	1970-01-21 04:33:43	Name: _hly_gvid Value: 7fb8788a-ba4c-458e-b746-19bc4c747dec
.menlosecurity.com/	1969-12-31 23:59:59	Name: _fcdscst Value: MTcwOTg2Mzk4MTE0Ng==
.www.linkedin.com/	1970-01-21 03:43:19	Name: bscookie Value: "v=1&202403080213010e7ce8ed-d3e8-440d-84a3-7426bd06c239AQEGPUcXJwK4kx9QV1Wme7myIFprVQSs"
.linkedin.com/	1970-01-20 23:16:55	Name: li_gc Value: MTswOzE3MDk4NjM5ODE7MjswMjEMaW2QXYYBvUwuSEK01SjRY9TF7qmH2wcxGq9SWt2caQ==
www.menlosecurity.com/	1970-01-21 03:43:19	Name: sliguid Value: a0666d6f-8a41-4b83-a5bd-62d8c2c16b64
www.menlosecurity.com/	1970-01-21 03:43:19	Name: slirequested Value: true
.adnxs.com/	1970-01-21 04:33:43	Name: receive-cookie-deprecation Value: 1
www.menlosecurity.com/	1970-01-20 19:07:48	Name: _an_uid Value: 0
www.menlosecurity.com/	1970-01-21 04:33:43	Name: _gd_visitor Value: ed586d43-842e-410a-87a5-0ef021b912a0
www.menlosecurity.com/	1970-01-20 18:57:58	Name: _gd_session Value: a3ec907f-4b7e-4ab1-8e3a-6fe7e50e586e
.menlosecurity.com/	1970-01-21 04:33:43	Name: _ga_C2G0PCSJKE Value: GS1.1.1709863980.1.0.1709863981.59.0.0
.6sc.co/	1970-01-21 04:33:43	Name: 6suuid Value: 0d85655fb2c11d002d74ea65c101000051525500
www.menlosecurity.com/	1970-01-20 18:57:45	Name: drift_campaign_refresh Value: 872fd543-6767-4804-bbff-fd73d2e91dca
.menlosecurity.com/	1970-01-21 04:33:43	Name: _hly_vid Value: 2e79cc18-db2a-40a3-b72c-3ff9adb15e78
www.menlosecurity.com/	1969-12-31 23:59:59	Name: _hly_sid Value: e547d209-0123-40be-b9b5-739e58b6c7d1
.menlosecurity.com/	1970-01-21 04:33:43	Name: _ga Value: GA1.2.1508834351.1709863981
.menlosecurity.com/	1970-01-20 18:59:10	Name: _gid Value: GA1.2.1131207495.1709863982
.menlosecurity.com/	1970-01-20 18:57:44	Name: _gat_UA-41161362-2 Value: 1
.menlosecurity.com/	1970-01-21 04:33:43	Name: _fcdscv Value: eyJDdXN0b21lcklkIjoiMTg3ZDIxMDMtYmRjNS00ZTNmLWIwNzAtYjVjNmE0MDAwODQwIiwiVmlzaXRvciI6eyJFbWFpbCI6bnVsbCwiRXh0ZXJuYWxWaXNpdG9ySWQiOiI4MGMyYzhmNS1jMDJlLTQ2M2YtYTI5YS03YTk1OWYyMmE0ODQifSwiVmlzaXRzIjpbXSwiQWN0aXZpdGllcyI6W10sIkRpYWdub3N0aWNNZXNzYWdlIjpudWxsfQ==
www.menlosecurity.com/	1970-01-21 04:33:43	Name: drift_aid Value: 1a12d542-97f3-4bf1-bffa-862834c3258f
www.menlosecurity.com/	1970-01-21 04:33:43	Name: driftt_aid Value: 1a12d542-97f3-4bf1-bffa-862834c3258f
.www.menlosecurity.com/	1970-01-21 03:43:19	Name: _zitok Value: adae0532f0c40f116e001709863982
app.hushly.com/	1970-01-20 19:07:48	Name: AWSALBCORS Value: i9+dZtQh99yOn9ZFKlPg0xLqtN3+e6UuyQwj9aDnh2Twumvuvf00e7s+3At7p/grax+VVWxMxZHdnrWwTYVCEIrtUjzVwqxfwlabJRDw0Ae3Z42VkS1PlQCzQ5ld
.zoominfo.com/	1970-01-20 18:57:45	Name: __cf_bm Value: SicW4P0x65Ph5.1L2Kc98vgOc0cQBsdRj.qHyjDSnk4-1709863983-1.0.1.1-bh91mZVH2UPLLo00SiWGayO353zYMzQEevuZR2dBe5QMykyDEhx3cmv0Rh3Svk1N1bbiy_CSuJBnLBtVk581sg
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: ceAFnIsV_0tvXSh6etqiHvF7ip2Q3n738jIH7_ODcYo-1709863983035-0.0.1.1-604800000

76 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://connect.facebook.net/signals/config/1626328370711236?v=2.9.148&r=stable&domain=www.menlosecurity.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100(Line 105) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://js.driftt.com/include/1709864100000/trrsm2wf4gwm.js Message: The AudioContext was not allowed to start. It must be resumed (or created) after a user gesture on the page. https://goo.gl/7K7WLu
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.menlosecurity.com/blog/swindled-blackcat-affiliate-wants-money-from-change-healthcare-ransom Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

281-owv-899.mktoresp.com
analytics.twitter.com
app.hushly.com
assets-global.website-files.com
assets.website-files.com
b.6sc.co
bootstrap.driftapi.com
c.6sc.co
cdn.cookielaw.org
connect.facebook.net
content.hotjar.io
d2i34c80a0ftze.cloudfront.net
d3e54v103j8qbb.cloudfront.net
driftt.imgix.net
epsilon.6sense.com
event.api.drift.com
extend.vimeocdn.com
fonts.googleapis.com
geolocation.onetrust.com
hubfront.hushly.com
ibc-flow.techtarget.com
info.menlosecurity.com
ipv6.6sc.co
j.6sc.co
js.driftt.com
js.zi-scripts.com
metrics.api.drift.com
munchkin.marketo.net
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
scout-cdn.salesloft.com
scout.salesloft.com
script.hotjar.com
secure.adnxs.com
snap.licdn.com
st.fullcircleinsights.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
t.co
targeting.api.drift.com
trk.techtarget.com
ws.zoominfo.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
www.menlosecurity.com
analytics.twitter.com
104.17.70.206
104.18.37.212
104.244.42.133
13.107.42.14
13.224.189.129
13.32.27.107
146.75.118.109
146.75.120.157
18.172.112.55
18.245.86.77
18.66.97.10
192.28.147.68
2001:4860:4802:32::36
23.192.243.198
2600:9000:21f3:3000:12:9e5f:cac0:93a1
2600:9000:235a:d600:11:3b84:d200:93a1
2600:9000:26e8:1e00:13:a3bc:6800:93a1
2600:9000:275b:8a00:9:14eb:6280:93a1
2606:4700:4400::6812:24c4
2606:4700:4400::ac40:9b77
2606:4700::6810:890f
2606:4700::6811:4341
2606:4700::6812:83ec
2620:1ec:21::14
2a00:1450:4001:806::2004
2a00:1450:4001:812::2008
2a00:1450:4001:827::200e
2a00:1450:4001:829::2003
2a00:1450:4001:829::200a
2a00:1450:400c:c06::9d
2a02:26f0:3100::1735:2baa
2a02:26f0:480:f::213:7ec6
2a03:2880:f083:100:face:b00c:0:3
2a03:2880:f176:181:face:b00c:0:25de
2a04:4e42:200::720
3.68.168.239
3.94.218.138
34.111.208.231
34.249.200.254
37.252.172.123
44.240.168.231
52.22.229.227
52.222.232.99
52.51.205.226
95.101.133.17
0316b910e0a7b4b953bfe8cf73598737ecaf0950899b00bf3bbbbff1b1038d96
048daa568f2e310b154fc6f410f2655422f8ed3a9317901250a865de6e7d6a8f
073b97779f9dc3c731a8c153f3f8dcfe2dc8f99a2c5ad7a279361a08e0302dc0
074afd889f5d24ef970c7933d2b7ad2512aa3e211822d33d12bdb830bdfef8b3
0792fff034e8b1fdfcbb22d7d88975107ca0690c6abf94c7062d7b70e358d685
0c0394725992f1134128106b3e6aa8539df425f1d31502af4b5a5d80c491f09d
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0c7b39faa08dbf48372cc45d4f2b8f05c5626dacdf9b06d1062cc43b480809a6
0e35bc7004344fc251a2e47e5d5c8efde8f7fdc17bd9601b2ccd2b1ea28b0425
0eb85d0d2c8f3603d50877396aa75f6eb8e7fcdee3166132e0c3eeca5848f481
0f38a964a84c215c4800a13ecfaee4a670e1a0e3d3192c07390b751c14be668f
0f99115ee08c4024147bfe1601edf3e7066e4d971afd4fa4a1c55c9aee360c42
19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563
22d3654d0da0d0173edfa54dfd902133375983447b6eb86a60f3daf6d69b22f5
24f95156ad08aa62d037edcb9140e7525436ae784cb8dbf827e4dd73c049a9c7
2546e4cdd2349711cccc53c07f43723eebb2618faafade5b4ec807f17326477b
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
29406c757b6db9e44d1678a6b414b769788fce77f3525fc0aa46906ad95647d8
2a4274b3cc3e0f1c657d92cd91051243635cf08951925f7dabcf24ce7005b0d0
2a8a441d8086f20a64563edc759aba1de84d932e34ff77b8bb0279a730cdb428
2c3fa8534f4d4c1cb14f56e8da5245bd5ce330ee5b5471800cad7efff6de6d32
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
3005a54fc57fc2d8c70cc41e4ca7fcaaed7514b03f28581082c454e6a2d11f3b
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
3321757433351762495ef3452adf0fcefa179583f4409dd04815c710c5e45f6f
3337f36bd89c27dbe1dca4b71fb177d826b736950f2150aff6acce0180a86fc5
39a22185ae99fc24a9c6cf7262ab2529721985716bfaffe811919def004f0464
3b313873cad9e3eeadf943ad160981022d65e3a0c706869faf7a3de1240412f5
3d7530a198af9b1342dfe307c6ab4dc6169d83147b660bf5bfd0743b98914244
3f3068231d5307bef2c322de2866522c7c88c1f9297145cd31324e3c64a8f3dc
3f9d4371f39aa30430e6ce0dfcc48d5155b2baeb63d0f2d886d7df52e4bf040d
44d206c83f9d5d2637bebd2c01344c412aa05669eed169181306c62d4daae7e2
45756d3738e4c5f55cda1d4736372780e2a15f7e50f432980ce64c54864eb3cb
4a007af67f716c30c8848ab0ad0bfaab8a5fcf3e36dedf918b59c9429d522440
4e147ab64b9fdf6d89d01f6b8c3ca0b3cddc59d608a8e2218f9a2504b5c98e14
50b6e67cfcfe4ac8fe9cee705b681f696065306ee42bcd4e6b37a17dba333ac5
51356fa79699268ffecc5052d61a15c56d95620b54d0c3b2c9238ce84fcc269a
51b29d6573d9fcb3e20b9021407d58c7dca539b0eb9d0e582106bf4908feac4b
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
5483976e852ac7c40869c39e9c0877928cecb7c58880c1c842447a2dd97df06a
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
573a481f2f09d26d3f240670b5e8fe7c9660e34b8b436bf6b40edf291e9e410d
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
584af0c9b08e78cbcc50f7117519ad69852c42cb66cf3904ebc5afaf58063892
58fdb03fac3e89e51525a5a45eb777395d1b499bf4483e96201b6becddbe516f
594d3ade307f6f48a5ef5143228b9da7c4e78589177ac70e91d31fe75ea83d60
5ace0d0833ab83ff18ea94e4a7745f919c458ae4eabc298218226df4275ccd4d
5cd16f5174d4f1eaf208272602ce6316ddf308953db343d03f9b5d0ea273351f
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
5e27c97d4b8a6e111aad8f35ce23fe933939422d9a57012b26ae23bd8bdc61a0
5f8ece9fc3c316bd78480ef2f48dc82b47f84a1a2a39ddd4a0fec27a720cae41
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
619961cc5419607d2024e330d6c57c6574bf7610260fb43362fbbcc800854d5e
61df597f73c91f238cbe88fe3c536702d120d048b79b25fa0f4f7818fd123a6f
67285213e29ad93a23a2e8285a27a9cd753218b645e59b0e29b6ed406df16f6c
67ef71c562c9dac26243f44f029b68a3b3f4f6083db04d0e77ca14cb4b6ef945
67faf4e806b2ab874a9661a0140c5f9448de6bcb671f8fc1fea97c9f1e0ee2e0
6861a320271e0fda832800e20d53b858ef409f88d9bc9c1a48953888289d1ea3
68b4b6fc343811ef9268a786ba1a6d45532277051d2db7804896df2b58a9b429
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
6b141e7fce6d9ec4c281ca4bcf494f31fc7a24c7aa1fdda838dd5e7ceff2a3b2
6c649cc3d4aee7683250622541a6045ad4ac3beb93df1fcdd3ec1f7f12a1ff44
6c9c6406c9bd9814cf84974221433003377b67f071ec5411fddbcba4ec109bca
6ded09789782fad99733cac6a94fc617f55aae1605849fa40c2b21db8a5eec34
765bc4a5ded7b07d8c79ddb69ba1ad38c31490c7ed121b2c54b07f36c6d4aa3d
7849ba1748f8188749df28e9d59ca4e570a8495684353d8df4715fa70a81e787
7897cb9a7b1d79f447fc616987b640b0d628fc85130ad65f50a8030b57e1fab4
7a38a8b8f2d5263ae8a8f8d1f4dbfd827e173b956e771bfbc9565941452de090
7a6c575f655333b6d141e511e77fd65a5f7e184f41d4478aa1f58fd84f9c4bf2
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
85cefebcde30bec3004dcf9762a67ae9d37bc38861797875f939b04c8cb7f773
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
889d25db4b8baec5af49f52ba44f9aabf5d3ed27620850a9fd1645746dd76668
8a156cc165020c931aa074da38f144e3eb816e8ab4ce0d58ef693b5180530910
8c1781ec4483c6fb3bd9ad005d312800eaf24e232c12976624bff84f8ab908b3
8ddd10e57216c5eb30b31d9ac0726513c061fbfc031ae0e770ac3c3fd23939b0
8e7948221210e0bff86b70de2a2e893e24e0d9c5a16a5db0aa47834b88bf1998
8f0f8792237470ee661c6afc32ca68200dd74bcc0d544d0fd54c7777af362eae
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
914b72c7fe9e9c8ae81a269d5a05df6f5de5116ae133857b2c12b6cec48ea3ee
92a6947257b201d6a77dd7e4ecad51cd1b0a4029a89b288f3c9463f0d5237015
934ad7a7cc061d0dc6124bca37f874ebb29f41f7ccf85a253815ca6066dc8c88
99e4a85061136e99e052929ed0d85e36384fba5c34b773139a8f64339c609943
9da14942229f055eb8acb3012a6e1fadcff12d6db2a9736e685a1113539468ba
9e6a781a2013dea846dd8dda8b30b4db01e3ca0fd71e33c60beaa69302d956a3
9ea1823078c462969eaa59d6ef62623c19d77b72e25a103105b043aefaa0769a
9f954d6e1256d528c39aa0b3768fae8fffc81ecddb0cda40058dc715d1cb212f
a03b854d10519fd5be9cdcbc78fad3927c1a3de9e84fa74353c8a19cc20d0501
a1ed0a00886cc41429b3199124bc2b2d744d9dfdd130721e115dc235a1569d1f
a8331d520e307081359e060643052b00e5529d0062b5ce516c251f4da1b9fae2
aa011ed383cb780028a85caaa0dda67dce19b0f4bc596f4f708d1857015c1362
ab785c5c76d12e6b62f6339857d15907af1796ace2907bf2d8c5a1e4fc264994
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
aedfc08757725003aafc414d0569933c83079a162d289045774bbf1d962c9904
af76b5b4009f30b15d718ac8ce49f23fc5eef560c5c0a97c6b1e93d64758ad09
afbd41e7209fa3aef6f53c7a5713aa542a7be54c432fec2d690e0dfaccd528d1
b0af909b7ae6ad2644bfe2a60d939092aaf113b2cbc4ed2981a892869143b98a
b39e7d22263c6683b1970ca8a143c4809b7467a019c0b37170633a9aed6c9e16
b3c0cc52d8afeca5bab92395f05b637edb8aca01984a27c8bdb09063ea4a7fb1
b43508242f21a59b37bba45231dd25c6c861e079ef05607273c620337e217b9b
b7fe4dab17faeca12818ad0f933516d03f51fe7454e1bbfd983c221cab8358db
b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1
bb1bf908b6409ef06648805751d0ab2b5266bb25cd8649f42ebdb555dba577d1
bba54915db71fc417be4d5852ec7d138d7c3fa90356ddee98b5267a7db7e6b5b
be64da47ffc5fc1e40ba8205a0974330a76815e151e84ba365a750a7c96f1d1d
bf06f41bb3a1429115fa2dcfbee9986234d6d319da3597648e4e980340d52027
bfae35edc61595bd27d16c01ddc44ef00c152c0006e16f836101d3b6a6621d01
c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140
ca681b2b9b415d35f4ceef886b26398a76b29856294f94751f910f44dc8e14e7
ca8d259705c340a9ba8b34112e02d21e8d707e12d6927edd3dab7b860ce492c2
ccdab784ba249c97ca9c318ffd0604dfa449d6c0485dcf69ca231b49ebfa82b6
cce437faf73c67f2163692a58b9a23a154facef1d77fe1ae8ad189659b56a93a
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d0c5f2e5b712f3ee9c6b36456d2cb84b79487e725b52124ee718c8ba1cb25e2c
d18f313f2489ed91cd15cf94a1e5668b8b0da8318f593d980228000a1757702f
d1d75ae838854e845b28c3472c3d235f92a944446d79165953ec813fc6323a70
d3f7b0ec4de079928a999641e781e80f33597a392a561bc460276dfb4efb6eec
d70fa5dc6c8bfe9d7824be31e669528533d0879a2b1600a7df68b880f4d44296
d7ead427aca51c227410c4595b49b48dde8f9e76864b4f3fcb32861034b0c6a2
d8b080802cba44025db6515c924fd17cfba0f2d9123093aaa779d43f8a04a522
dc0198ce23a18c5daa358086995f168e1abf8d134aaec738e13229ae782b46bc
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e0a5cea44ef10b590cbdd293e5356beec37b4515a45af600cb6bd839d774bfb0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba
e555f4b34b579e6528d6bbd4819620a634c0759b41dfa99520b7ca5aa5117b11
e6d09589bfc7d0fa73746aae2571f7419912679feeee607b9f5ba827ad00f99c
e86e1e398fbcc72f22d26b888c310d364b8bd39e2e3979e405134f579c8d2177
e88885832ddb949ccdcd104617572a936a43ba12c93d8247ec3088fa15852501
eb7b0d4f40dfd54bee18b1684871b5980c78849a361a6f34e5381f4fd542bbe4
ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff
ec685a46105296fe46c8744da4a11cf8118ba6c11271941766f7a546df6aa7c7
edf1011ad272d21b66ae82a21a9d029186dc81c9f13972203fc3107f75835d4b
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1214dfeb93c377d705ff4e3fa4026b177b09bd78db8c58fec8bed76042b22cb
f5440b37afdd39e69744c91ac06d81209dc9176a0c9887c19fd2b9923bf15d90
f595a7eeaf2e9ef60746074e0ff87a1b6bf60355ece3559d666b9b59041dc976
f63e2629d38d4459720800ab6343b53db8abaa24e3b347275af296267b0ba102
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
f90d159c7a961f8d49cf0197de9f4a31f91310b5cd03edc042f82beae766c88b
fbeb296c1ecc216a17bda77bf65e833cc0410cfbe1908e121f7a4549cc390675
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
ff8f406b684c6674dbd3705d3f6d2cd10b5eedbc2c67a7773f235d69ef122d04

www.menlosecurity.com Open in urlscan Pro 34.249.200.254 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

203 Requests

99 %HTTPS

49 %IPv6

36 Domains

51 Subdomains

46 IPs

6 Countries

3886 kBTransfer

9889 kBSize

42 Cookies

32 Outgoing links

Redirected requests

203 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.menlosecurity.com Open in urlscan Pro
34.249.200.254 Public Scan

Screenshot
Live screenshot

Full Image

203
Requests

99 %
HTTPS

49 %
IPv6

36
Domains

51
Subdomains

46
IPs

6
Countries

3886 kB
Transfer

9889 kB
Size

42
Cookies

203 HTTP transactions
0 data transactions