abnormalsecurity.com Open in urlscan Pro
76.76.21.21  Public Scan

8 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 89

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2775268&time=1715825270268&url=https%3A%2F%2Fabnormalsecurity.com%2Fblog%2Fcybercriminals-exploit-docusign HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2775268&time=1715825270268&url=https%3A%2F%2Fabnormalsecurity.com%2Fblog%2Fcybercriminals-exploit-docusign&cookiesTest=true HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2775268%26time%3D1715825270268%26url%3Dhttps%253A%252F%252Fabnormalsecurity.com%252Fblog%252Fcybercriminals-exploit-docusign%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2775268&time=1715825270268&url=https%3A%2F%2Fabnormalsecurity.com%2Fblog%2Fcybercriminals-exploit-docusign&cookiesTest=true&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2775268&time=1715825270268&url=https%3A%2F%2Fabnormalsecurity.com%2Fblog%2Fcybercriminals-exploit-docusign&cookiesTest=true&liSync=true&e_ipv6=AQKxFHNNrARSMQAAAY9_J-A8_UaHeyCaB_-RbM4gSvavURKBBnv3ewy570rJ9cJhxEEMW5Xng4XzWQUlspYMKBmgWCwggw

124 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request cybercriminals-exploit-docusign Show response abnormalsecurity.com/blog/	762 KB 171 KB	129ms 91ms	Document text/html	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Next.js Resource Hash 7117a99d05bd8009885f7c8de72928791137df4376cc238304f75936d8388f6f Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers access-control-allow-headers Content-Type age 332 cache-control public, max-age=0, s-maxage=86400, stale-while-revalidate=86400 content-encoding br content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-type text/html; charset=utf-8 date Thu, 16 May 2024 02:02:16 GMT etag W/"szalfz5vvwgptx" permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() referrer-policy same-origin server Vercel strict-transport-security max-age=63072000 x-content-type-options nosniff x-frame-options SAMEORIGIN x-matched-path /blog/[slug] x-powered-by Next.js x-vercel-cache STALE x-vercel-id fra1::sfo1::nwrzx-1715825269336-47b116d99a0a x-xss-protection 1
GET H2	200	a8d2128c7d1ab0e1.css abnormalsecurity.com/_next/static/css/	100 KB 20 KB	21ms 21ms	Stylesheet text/css	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/css/a8d2128c7d1ab0e1.css Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 83c500a2585580bec992ae51040c79ef32456a36c9432cfa4653940703aa1f0a Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT strict-transport-security max-age=63072000 age 119664 content-disposition inline; filename="a8d2128c7d1ab0e1.css" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::ngqcc-1715825269441-424ac7917049 x-matched-path /_next/static/css/a8d2128c7d1ab0e1.css etag W/"38a501fd9b74c822da0bad695a13026c" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	webpack-7c113a4732448533.js Show response abnormalsecurity.com/_next/static/chunks/	5 KB 3 KB	10ms 10ms	Script application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/webpack-7c113a4732448533.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 2b59af45fd3fa703e663a6261bb56179ae74894c1fe3621b14f827309836e891 Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT strict-transport-security max-age=63072000 age 119505 content-disposition inline; filename="webpack-7c113a4732448533.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::chdv5-1715825269441-392abdb434ba x-matched-path /_next/static/chunks/webpack-7c113a4732448533.js etag W/"7558f3112cf0fd2b81c13fb09fcc8eb4" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	framework-9e0357d8ee41f256.js Show response abnormalsecurity.com/_next/static/chunks/	206 KB 60 KB	12ms 10ms	Script application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/framework-9e0357d8ee41f256.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 078b059071ca5718bbb8e52fc2eec179014638f55bc65fe2f9d8af6ae08ef74e Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT strict-transport-security max-age=63072000 age 119664 content-disposition inline; filename="framework-9e0357d8ee41f256.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::r787d-1715825269445-7bbc66f54091 x-matched-path /_next/static/chunks/framework-9e0357d8ee41f256.js etag W/"3b8852b28e69fcb6192de705ac740fe6" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	main-7041651cfbed3124.js Show response abnormalsecurity.com/_next/static/chunks/	123 KB 38 KB	13ms 11ms	Script application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/main-7041651cfbed3124.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 0f075a0079b04e7775600a8fd53794db05555637f345f92b4213a719887b583d Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT strict-transport-security max-age=63072000 age 119664 content-disposition inline; filename="main-7041651cfbed3124.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::vhwks-1715825269444-9cf2b9ea2ab1 x-matched-path /_next/static/chunks/main-7041651cfbed3124.js etag W/"a9888550b78dac34ad52ae8ee4885f09" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	_app-cdc7736098ca8098.js Show response abnormalsecurity.com/_next/static/chunks/pages/	855 KB 265 KB	28ms 26ms	Script application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/pages/_app-cdc7736098ca8098.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 8958a68712bdd400b4c5495135400de375ddf37b8cabc0ac9e45147003ffc8ff Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT strict-transport-security max-age=63072000 age 119664 content-disposition inline; filename="_app-cdc7736098ca8098.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::57wwl-1715825269452-0510cc67c4b1 x-matched-path /_next/static/chunks/pages/_app-cdc7736098ca8098.js etag W/"aa0681d57a80641e7d2b94aad8c55909" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	7547-dd19d918363ca781.js Show response abnormalsecurity.com/_next/static/chunks/	8 KB 3 KB	21ms 19ms	Script application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/7547-dd19d918363ca781.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 09660a1ffa10bdd2d8910aecf2888d2d0a42549cb50311dbbf486db39fb2585e Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT strict-transport-security max-age=63072000 age 119664 content-disposition inline; filename="7547-dd19d918363ca781.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::nwrzx-1715825269445-e197f35f38be x-matched-path /_next/static/chunks/7547-dd19d918363ca781.js etag W/"5b1e4a8965002724d44173212616aa0f" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	8321-568adaeacfe98eea.js Show response abnormalsecurity.com/_next/static/chunks/	40 KB 14 KB	11ms 9ms	Script application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/8321-568adaeacfe98eea.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash f4eb0013779504be5464d6edec6fbd820d39742423aec201511ad8c2195ff523 Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT strict-transport-security max-age=63072000 age 119664 content-disposition inline; filename="8321-568adaeacfe98eea.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::chdv5-1715825269445-c006d2950b4b x-matched-path /_next/static/chunks/8321-568adaeacfe98eea.js etag W/"40d0f291041c1b13ffdbea25f6464db9" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	1612-0eb08c218bba44ab.js Show response abnormalsecurity.com/_next/static/chunks/	295 KB 90 KB	14ms 12ms	Script application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/1612-0eb08c218bba44ab.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 182e8ba88d8d710c2f175538db180d49d288d44230b649f9b530b82a37291c63 Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT strict-transport-security max-age=63072000 age 119664 content-disposition inline; filename="1612-0eb08c218bba44ab.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::t8rgw-1715825269445-291275256fd5 x-matched-path /_next/static/chunks/1612-0eb08c218bba44ab.js etag W/"1e6ea807d5e3d8ca5f8d22f4407a4356" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	1034-ed07f0515f2acae4.js Show response abnormalsecurity.com/_next/static/chunks/	73 KB 23 KB	12ms 11ms	Script application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/1034-ed07f0515f2acae4.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash dbeb055f0e9e228c4a4c3c42883675e073e23bdf2d9badfd6f08fc4fbf236a6e Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT strict-transport-security max-age=63072000 age 119664 content-disposition inline; filename="1034-ed07f0515f2acae4.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::nwrzx-1715825269445-a9f27b45d940 x-matched-path /_next/static/chunks/1034-ed07f0515f2acae4.js etag W/"4b1ff447da35f0013c5d86f50660a1e6" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	7195-330f62ebb77701e4.js Show response abnormalsecurity.com/_next/static/chunks/	8 KB 3 KB	19ms 18ms	Script application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/7195-330f62ebb77701e4.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 91f90dafc341a3dd1e5b481c90a06cf9e8a3abeaffc1fe7fa67525d2e50f4444 Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT strict-transport-security max-age=63072000 age 119664 content-disposition inline; filename="7195-330f62ebb77701e4.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::jk5xf-1715825269445-3c27c3548813 x-matched-path /_next/static/chunks/7195-330f62ebb77701e4.js etag W/"f251c9feb77b0e3655b2016cdb14f097" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	7332-da80b54d0110b8a3.js Show response abnormalsecurity.com/_next/static/chunks/	13 KB 6 KB	16ms 15ms	Script application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/7332-da80b54d0110b8a3.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash c8f695a88e8f932ed308ad2b8c1cdb6a87d347b47137b5746a85fd57aa64a138 Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT strict-transport-security max-age=63072000 age 119664 content-disposition inline; filename="7332-da80b54d0110b8a3.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::9hzlp-1715825269447-dd09cd87203a x-matched-path /_next/static/chunks/7332-da80b54d0110b8a3.js etag W/"f9ab7a6ca1e9198ad81ca2586dc8520e" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	6542-73c2705b3192f5bc.js Show response abnormalsecurity.com/_next/static/chunks/	79 KB 30 KB	47ms 46ms	Script application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/6542-73c2705b3192f5bc.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 11dd3b0f2bdb1ce7a58109611b56bd95921de262c0c0583448007e4b2447722c Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT strict-transport-security max-age=63072000 age 119664 content-disposition inline; filename="6542-73c2705b3192f5bc.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::jbmzh-1715825269452-5ccaecf93b22 x-matched-path /_next/static/chunks/6542-73c2705b3192f5bc.js etag W/"911fd2f16bda4f6ade557aa249d64820" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	7233-61e7c7526f51bcd9.js Show response abnormalsecurity.com/_next/static/chunks/	20 KB 7 KB	17ms 16ms	Script application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/7233-61e7c7526f51bcd9.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash d5db67aa2d442497eccd85288a8cf18a81ce4d9e288fdd16cbd2a757e73a8179 Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT strict-transport-security max-age=63072000 age 119664 content-disposition inline; filename="7233-61e7c7526f51bcd9.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::s242c-1715825269447-202150c99603 x-matched-path /_next/static/chunks/7233-61e7c7526f51bcd9.js etag W/"b0aa244cc1cae69f1fd60b5a941fb33d" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	7419-507345af0e3991f1.js Show response abnormalsecurity.com/_next/static/chunks/	13 KB 5 KB	23ms 22ms	Script application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/7419-507345af0e3991f1.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 7d71221bc5108351402364f350cac6d5320e3c8ea1b575307558edd43e8d9a6f Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT strict-transport-security max-age=63072000 age 119664 content-disposition inline; filename="7419-507345af0e3991f1.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::jbmzh-1715825269447-57356126dff2 x-matched-path /_next/static/chunks/7419-507345af0e3991f1.js etag W/"a6105eedbfea526518b5a73e9ac5f8a6" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	2350-66a8e15f18a15403.js Show response abnormalsecurity.com/_next/static/chunks/	9 KB 4 KB	23ms 22ms	Script application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/2350-66a8e15f18a15403.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 57dd903a23884cb1628f6b34850959dc1ecc5fac9ec25ee23301a78993a0ca9f Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT strict-transport-security max-age=63072000 age 119663 content-disposition inline; filename="2350-66a8e15f18a15403.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::jk5xf-1715825269447-d4b4f411dc10 x-matched-path /_next/static/chunks/2350-66a8e15f18a15403.js etag W/"b32bcef424e70346ebb7999dea5cb499" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	2098-df5657e4767b78cc.js Show response abnormalsecurity.com/_next/static/chunks/	107 KB 26 KB	24ms 24ms	Script application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/2098-df5657e4767b78cc.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 68bd70a47d9f2c3fee9e3bbad03f09de6327be8e5ab8a52f8b68316f8450426c Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT strict-transport-security max-age=63072000 age 119664 content-disposition inline; filename="2098-df5657e4767b78cc.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::6g9db-1715825269447-56bf8204e2aa x-matched-path /_next/static/chunks/2098-df5657e4767b78cc.js etag W/"6cde6039f36251f266f71c0f0dc3ea5a" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	%5Bslug%5D-1e6f0b32d1ae44ba.js Show response abnormalsecurity.com/_next/static/chunks/pages/blog/	23 KB 8 KB	22ms 21ms	Script application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/pages/blog/%5Bslug%5D-1e6f0b32d1ae44ba.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 4720da01759970ef7f922202510c0badc3cc3939159276ff5a08ed363cbfa184 Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT strict-transport-security max-age=63072000 age 119664 content-disposition inline; filename="[slug]-1e6f0b32d1ae44ba.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::t8rgw-1715825269448-23d52c51006b x-matched-path /_next/static/chunks/pages/blog/%5Bslug%5D-1e6f0b32d1ae44ba.js etag W/"0f9ec89cd5d8de41f382baec79118215" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	_buildManifest.js Show response abnormalsecurity.com/_next/static/nS6jZ2TY2PEod_9JEiZhQ/	7 KB 3 KB	14ms 13ms	Script application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/nS6jZ2TY2PEod_9JEiZhQ/_buildManifest.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 331e87383bf2a180149ec3861c29b887c09247558528c5920a79379b3e49d1c3 Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT strict-transport-security max-age=63072000 age 119663 content-disposition inline; filename="_buildManifest.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::jfvhr-1715825269447-8a32da0c96cb x-matched-path /_next/static/nS6jZ2TY2PEod_9JEiZhQ/_buildManifest.js etag W/"940325a0330cb8fabbdb58de59187fdf" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	_ssgManifest.js Show response abnormalsecurity.com/_next/static/nS6jZ2TY2PEod_9JEiZhQ/	1 KB 558 B	21ms 20ms	Script application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/nS6jZ2TY2PEod_9JEiZhQ/_ssgManifest.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 84d4a1e14f85684bc8715af564f80ce7b6445c1d6b8668bcc1a3c747b2cf60af Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT strict-transport-security max-age=63072000 age 119664 content-disposition inline; filename="_ssgManifest.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::zbf2g-1715825269447-41b6d84a5c42 x-matched-path /_next/static/nS6jZ2TY2PEod_9JEiZhQ/_ssgManifest.js etag W/"5722c89c192d851f3fa527a64a418367" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	64e37afea593954b6e60f08f abnormalsecurity.outgrow.us/ Frame 28C7	0 0	289ms 92ms	Document text/html	2600:1f18:54d2:7a2f:3f99:b901:7e4d:2580 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.outgrow.us/64e37afea593954b6e60f08f Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:1f18:54d2:7a2f:3f99:b901:7e4d:2580 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Apache / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubdomains;preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers accept-ranges bytes cache-control max-age=600 content-length 21430 content-type text/html; charset=UTF-8 date Thu, 16 May 2024 02:07:49 GMT etag "53b6-617eb90f51c40" expires Thu, 16 May 2024 02:17:49 GMT last-modified Wed, 08 May 2024 06:39:37 GMT server Apache strict-transport-security max-age=63072000; includeSubdomains;preload x-content-type-options nosniff x-xss-protection 1; mode=block
GET DATA	200 OK	truncated /	42 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/gif
GET DATA	200 OK	truncated /	80 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b0132cf0dae0361cd4feca1b230ee0655f885036718e51f479fa5d128a4e4107 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	chatV2.css dyv6f9ner1ir9.cloudfront.net/assets/css/shared/	8 KB 2 KB	42ms 8ms	Stylesheet text/css	2600:9000:214f:b600:3:eee:d40:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dyv6f9ner1ir9.cloudfront.net/assets/css/shared/chatV2.css Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/css/a8d2128c7d1ab0e1.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:214f:b600:3:eee:d40:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash ad567b1d6b357690a4aad1a0a76618c552cc0f90befc02200b5e0872c889d5a0 Security Headers Name Value Content-Security-Policy form-action 'self'; block-all-mixed-content Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 01:47:23 GMT content-encoding gzip via 1.1 511c8b6c7e903efca023a504d527516a.cloudfront.net (CloudFront) content-security-policy form-action 'self'; block-all-mixed-content strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop FRA53-C1 age 1227 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront referrer-policy same-origin last-modified Wed, 08 May 2024 06:52:07 GMT server AmazonS3 etag W/"dd55910e9135810e13bc857aaaa0085b" vary Accept-Encoding content-type text/css cache-control public, max-age=31622400 permissions-policy interest-cohort=() x-amz-cf-id 956Leauh0oEcaSzYJnuSv5YyEAuq5-BltGu5k2vZNZ-sHVkGgtI1OQ==
GET H2	200	icon fonts.googleapis.com/	569 B 775 B	36ms 16ms	Stylesheet text/css	2a00:1450:4001:802::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/icon?family=Material+Icons Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/css/a8d2128c7d1ab0e1.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 36b2057eb5eef261a2cbb8c149dcf3a11edaa15ccd8e3d462eb34999f5ff8f2a Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=31536000 date Thu, 16 May 2024 02:07:49 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Thu, 16 May 2024 02:07:49 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 16 May 2024 02:07:49 GMT
GET H2	200	Docusign1.png optimise2.assets-servd.host/gifted-zorilla/production/images/blog/	360 B 692 B	193ms 159ms	Image image/jpeg	2606:4700:20::681a:9b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://optimise2.assets-servd.host/gifted-zorilla/production/images/blog/Docusign1.png?w=10&h=10&q=80&fm=jpg&fit=crop&crop=focalpoint&fp-x=0.5&fp-y=0.5&dm=1715717629&s=9214bb24b934c0dadb34a757febce43c Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:9b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 37d97ddac10235ee6ae51c4a617709c44535d1d15d55f3181b989a98bcf0f0f7 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-servd-from Cache EU date Thu, 16 May 2024 02:07:49 GMT cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O47vNS9cy%2B0PUSQb%2B%2BPJGDAW8%2BQ7HID4nNhIsV3TNHGVZWOC7tXvYiHYOkSdc4WOMeuyUSGl6GociadWgsQU5sKu9s6p%2B%2Fugz%2F7QuwKfOo0ECm9xAP6tjtPWG5OEtfSWvyEIRD3zpgcfsgNm%2FhIMN%2Fjr4AA9GsFp%2FA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/jpeg access-control-allow-origin * cache-control max-age=31104000 cross-origin-resource-policy cross-origin x-servd-hash 4e0ea4d0a5b76081986dc746b6a8a511 cf-ray 8847d0ff4b63372c-FRA alt-svc h3=":443"; ma=86400
GET H2	200	TWKEverett-Regular-web.woff2 abnormalsecurity.com/fonts/	53 KB 53 KB	62ms 59ms	Font font/woff2	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/fonts/TWKEverett-Regular-web.woff2 Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/css/a8d2128c7d1ab0e1.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 94de5c66331cd244e69ce3df84813f93c2213d748c7eefdbb20ac6e461faac0e Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/_next/static/css/a8d2128c7d1ab0e1.css Origin https://abnormalsecurity.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev date Thu, 16 May 2024 02:07:49 GMT x-content-type-options nosniff strict-transport-security max-age=63072000 age 119663 content-disposition inline; filename="TWKEverett-Regular-web.woff2" content-length 54524 x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::mxsk5-1715825269716-15b1b2f1a90e x-matched-path /fonts/TWKEverett-Regular-web.woff2 etag "f9a6c0ce187482f10a21a2d865025278" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type font/woff2 access-control-allow-origin * cache-control public, max-age=315360000 permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() accept-ranges bytes access-control-allow-headers Content-Type
GET H2	200	Docusign2.png optimise2.assets-servd.host/gifted-zorilla/production/images/blog/	347 B 694 B	470ms 437ms	Image image/jpeg	2606:4700:20::681a:9b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://optimise2.assets-servd.host/gifted-zorilla/production/images/blog/Docusign2.png?w=10&h=10&q=80&fm=jpg&fit=crop&crop=focalpoint&fp-x=0.5&fp-y=0.5&dm=1715717607&s=19361cfd8de3a721afc1014519fe1947 Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:9b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bdd377ac20e7e03e66829b2da1a874587d63fba34d834293702d37cc41cbeb5d Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-servd-from Cache EU date Thu, 16 May 2024 02:07:50 GMT cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oO2dSGM1YMm7%2BiOclramAVOI6PlV87BE550JMDgDAC3mUCygV7iONAw%2F07VASdnSuT4RdrrhbSgrqobBYMXb7RemFkF8i20uPC7SDBZIW%2BCHH1FT%2BWbhxGgliiKTJZ2fHrfTPZaeHmHL2e%2F4bB9sFnIElFMatJKsBg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/jpeg access-control-allow-origin * cache-control max-age=31104000 cross-origin-resource-policy cross-origin x-servd-hash fc6b43896e1d26f76c699f7ee6a651d8 cf-ray 8847d0ff4b68372c-FRA alt-svc h3=":443"; ma=86400
GET H2	200	Docusign3.png optimise2.assets-servd.host/gifted-zorilla/production/images/blog/	307 B 630 B	203ms 170ms	Image image/jpeg	2606:4700:20::681a:9b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://optimise2.assets-servd.host/gifted-zorilla/production/images/blog/Docusign3.png?w=10&h=10&q=80&fm=jpg&fit=crop&crop=focalpoint&fp-x=0.5&fp-y=0.5&dm=1715717611&s=839e936a9f5a41034561dc7385b1011f Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:9b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fa8b40bfafe1adf3b17833c77b419a50f37a3b3955d8352b128df4f3fcc66897 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-servd-from Cache EU date Thu, 16 May 2024 02:07:49 GMT cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X6%2BAxyBlZIsLNE1AiN1cpWeMtOoBQHZHQIl55Hj8XX7Vpl1cahF0JA1pOcKILAar%2BG0%2BsuXnz25geQtoErEQxbRbmjmXsXYplZd%2B8NIb8MHvKBU8IuF34w7LNFboPcDRuTnY55OF5OEG1Ea6Hc2pLIVdpEBKkH4Ggw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/jpeg access-control-allow-origin * cache-control max-age=31104000 cross-origin-resource-policy cross-origin x-servd-hash 57b1a1d5749958b346c90326b15e96c0 cf-ray 8847d0ff4b66372c-FRA alt-svc h3=":443"; ma=86400
GET H2	200	Docusign4.png optimise2.assets-servd.host/gifted-zorilla/production/images/blog/	337 B 662 B	194ms 162ms	Image image/jpeg	2606:4700:20::681a:9b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://optimise2.assets-servd.host/gifted-zorilla/production/images/blog/Docusign4.png?w=10&h=10&q=80&fm=jpg&fit=crop&crop=focalpoint&fp-x=0.5&fp-y=0.5&dm=1715717619&s=5a35e9ae2df97adeb99b5e175a71ae87 Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:9b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cf8c189a5fe3f37f64c96ce45616e5336a114f5c3cf44ea4a6417129a2a0a97b Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-servd-from Cache EU date Thu, 16 May 2024 02:07:49 GMT cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MF6rSGV2yhibPZdm3x56fWFzojokYld%2FvrxtX3Rj6A3HjKmXpRAGDLrlry9Aj8gbbD8%2F6ofM9sj0wOmdWXs6gpL8ss7Ds8%2FSSw9QS3bZpSm%2B9GwK%2FUuttIW3GTCjwrzQxMImChRi7FsOb6xQZbfOEkDebH028qlZHQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/jpeg access-control-allow-origin * cache-control max-age=31104000 cross-origin-resource-policy cross-origin x-servd-hash e1b3c72060dba0a018a4a116f44448d3 cf-ray 8847d0ff4b65372c-FRA alt-svc h3=":443"; ma=86400
GET H2	200	Docusign5.png optimise2.assets-servd.host/gifted-zorilla/production/images/blog/	302 B 856 B	97ms 65ms	Image image/jpeg	2606:4700:20::681a:9b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://optimise2.assets-servd.host/gifted-zorilla/production/images/blog/Docusign5.png?w=10&h=10&q=80&fm=jpg&fit=crop&crop=focalpoint&fp-x=0.5&fp-y=0.5&dm=1715717623&s=6e64af8b9a7435d01c49dba092224d0c Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:9b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 368a7c142595475c4f1c23ec49810a021c0e6e33627b39273760c83729f85676 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-servd-from Cache EU date Thu, 16 May 2024 02:07:49 GMT cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t6bXzX4eJsfEwdzEeTTeDeyr16ml%2B%2BbgCR6%2FfK9FfjlBzKNSTP6mPYqo48%2Bl2QbcRIoT0YzuGSpCw1x3Cmhw7Uumlvo7OErPhtQdHplv5BUxs78X%2B3YpasCF4yVQynCOwbQ7Qp2fUqnghdu8LvkAlG366nwCb8SgKQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/jpeg access-control-allow-origin * cache-control max-age=31104000 cross-origin-resource-policy cross-origin x-servd-hash b7182cac862e9bcabc3bc8651b25e12e cf-ray 8847d0ff4b67372c-FRA alt-svc h3=":443"; ma=86400
GET H2	200	flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2 fonts.gstatic.com/s/materialicons/v142/	125 KB 126 KB	30ms 7ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/materialicons/v142/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/icon?family=Material+Icons Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://fonts.googleapis.com/ Origin https://abnormalsecurity.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 13 May 2024 19:45:43 GMT x-content-type-options nosniff age 195726 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 128352 x-xss-protection 0 last-modified Mon, 08 Apr 2024 19:04:47 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Tue, 13 May 2025 19:45:43 GMT
GET H2	200	TWKEverett-RegularItalic-web.woff2 abnormalsecurity.com/fonts/	55 KB 56 KB	12ms 10ms	Font font/woff2	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/fonts/TWKEverett-RegularItalic-web.woff2 Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/css/a8d2128c7d1ab0e1.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash c642fb6f2230d36e74e53ca1e6e432da853f8ac7e9a1cb04f94dd6c31b50a4d3 Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/_next/static/css/a8d2128c7d1ab0e1.css Origin https://abnormalsecurity.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev date Thu, 16 May 2024 02:07:49 GMT x-content-type-options nosniff strict-transport-security max-age=63072000 age 119663 content-disposition inline; filename="TWKEverett-RegularItalic-web.woff2" content-length 56704 x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::jfvhr-1715825269715-827555f635ab x-matched-path /fonts/TWKEverett-RegularItalic-web.woff2 etag "1e8e3568add262c0f802778b4b5dafce" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type font/woff2 access-control-allow-origin * cache-control public, max-age=315360000 permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() accept-ranges bytes access-control-allow-headers Content-Type
GET H2	200	TWKEverett-BoldItalic-web.woff2 abnormalsecurity.com/fonts/	63 KB 63 KB	83ms 81ms	Font font/woff2	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/fonts/TWKEverett-BoldItalic-web.woff2 Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/css/a8d2128c7d1ab0e1.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash fcd5fc46e77728b0e5da04b51d40abd649eabcf637eb29ef884f668a52164d57 Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/_next/static/css/a8d2128c7d1ab0e1.css Origin https://abnormalsecurity.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev date Thu, 16 May 2024 02:07:49 GMT x-content-type-options nosniff strict-transport-security max-age=63072000 age 119663 content-disposition inline; filename="TWKEverett-BoldItalic-web.woff2" content-length 64112 x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::s9dzk-1715825269715-5987d6326cb2 x-matched-path /fonts/TWKEverett-BoldItalic-web.woff2 etag "4291e56bdaa232615ce51b3d3b67fb2d" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type font/woff2 access-control-allow-origin * cache-control public, max-age=315360000 permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() accept-ranges bytes access-control-allow-headers Content-Type
GET H2	200	TWKEverett-Bold-web.woff2 abnormalsecurity.com/fonts/	60 KB 60 KB	16ms 15ms	Font font/woff2	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/fonts/TWKEverett-Bold-web.woff2 Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/css/a8d2128c7d1ab0e1.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 4a6588416e2d67985b8e7595c5ae89d32b3176197566f8e256a1bc8d75e26b32 Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/_next/static/css/a8d2128c7d1ab0e1.css Origin https://abnormalsecurity.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev date Thu, 16 May 2024 02:07:49 GMT x-content-type-options nosniff strict-transport-security max-age=63072000 age 119663 content-disposition inline; filename="TWKEverett-Bold-web.woff2" content-length 61376 x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::l8rbm-1715825269715-0a193fa9d7c7 x-matched-path /fonts/TWKEverett-Bold-web.woff2 etag "5c80ceb188e4930bccf3be1166b8f115" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type font/woff2 access-control-allow-origin * cache-control public, max-age=315360000 permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() accept-ranges bytes access-control-allow-headers Content-Type
GET H2	200	image abnormalsecurity.com/_next/	4 KB 4 KB	10ms 10ms	Image image/avif	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://abnormalsecurity.com/_next/image?url=https%3A%2F%2Foptimise2.assets-servd.host%2Fgifted-zorilla%2Fproduction%2Fimages%2FDan-Kelly.png%3Fw%3D30%26h%3D30%26auto%3Dcompress%252Cformat%26fit%3Dcrop%26dm%3D1711743804%26s%3De31f3b5c16ff9f228842afdc02878b82&w=90&q=75 Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 3f61b47bab986e06f837f4716c5a4bf1ef750b5b9eec7f3360908681885e1617 Security Headers Name Value Content-Security-Policy script-src 'none'; frame-src 'none'; sandbox; Strict-Transport-Security max-age=63072000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy script-src 'none'; frame-src 'none'; sandbox; date Thu, 25 Apr 2024 03:40:07 GMT strict-transport-security max-age=63072000 age 1808862 x-vercel-imgsrc edcbc64f335cf3af2f60f2d6630e0f66 cross-origin-resource-policy cross-origin content-disposition inline; filename="Dan-Kelly.avif" content-length 3799 last-modified Thu, 25 Apr 2024 03:40:07 GMT server Vercel x-vercel-id fra1::lvvwj-1715825269635-bdc3937cd824 x-vercel-cache HIT vary Accept content-type image/avif access-control-allow-origin * cache-control public, max-age=2073600, must-revalidate accept-ranges bytes timing-allow-origin *
GET H2	200	image abnormalsecurity.com/_next/	6 KB 6 KB	167ms 167ms	Image image/avif	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://abnormalsecurity.com/_next/image?url=https%3A%2F%2Foptimise2.assets-servd.host%2Fgifted-zorilla%2Fproduction%2Fimages%2Fblog%2FB_5.13.24_Docusign.png%3Fw%3D760%26h%3D760%26q%3D80%26fm%3Djpg%26fit%3Dcrop%26crop%3Dfocalpoint%26fp-x%3D0.5%26fp-y%3D0.5%26dm%3D1715717006%26s%3De60dd6c70e53f5c019dec0ee0e5b3914&w=380&q=75 Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash c90ad4583baa23db0c963b6935f14a319444160ea92bfbb7316674aebc2fa339 Security Headers Name Value Content-Security-Policy script-src 'none'; frame-src 'none'; sandbox; Strict-Transport-Security max-age=63072000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy script-src 'none'; frame-src 'none'; sandbox; date Wed, 15 May 2024 13:01:54 GMT strict-transport-security max-age=63072000 age 47155 x-vercel-imgsrc 4e7cc302727952cbb2a2ce89acaf1bdb cross-origin-resource-policy cross-origin content-disposition inline; filename="B_5.avif" content-length 6361 last-modified Wed, 15 May 2024 13:01:54 GMT server Vercel x-vercel-id fra1::n8l2p-1715825269635-b75e76cdbbc7 x-vercel-cache HIT vary Accept content-type image/avif access-control-allow-origin * cache-control public, max-age=2073600, must-revalidate accept-ranges bytes timing-allow-origin *
OPTIONS H2	200	graphql cms.abnormalsecurity.com/ Frame	0 0	407ms 132ms	Preflight text/html	167.172.14.134 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://cms.abnormalsecurity.com/graphql Protocol H2 Security TLS 1.3, , AES_256_GCM Server 167.172.14.134 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15724800 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept */* Access-Control-Request-Headers authorization,content-type Access-Control-Request-Method POST Origin https://abnormalsecurity.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type, X-Craft-Authorization, X-Craft-Token access-control-allow-origin * content-encoding gzip content-type text/html; charset=UTF-8 date Thu, 16 May 2024 02:07:50 GMT strict-transport-security max-age=15724800 x-content-type-options nosniff x-xss-protection 1; mode=block
POST H2	200	graphql Show response cms.abnormalsecurity.com/	7 KB 1 KB	187ms 186ms	Fetch application/json	167.172.14.134 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://cms.abnormalsecurity.com/graphql Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/chunks/1612-0eb08c218bba44ab.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 167.172.14.134 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash 1a7073fba5629dadcce95e8f78460659eb3fc5742716fff94cdbaae7f9fcce9e Security Headers Name Value Strict-Transport-Security max-age=15724800 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 Authorization Bearer he3ov7WMe88DxirU9L5BeVDxGCGYnzCF User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type application/json Accept application/json Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 02:07:50 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=15724800 content-type application/json; charset=UTF-8 access-control-allow-origin * access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type, X-Craft-Authorization, X-Craft-Token x-xss-protection 1; mode=block
POST H2	200	vitals vitals.vercel-insights.com/v1/	2 B 166 B	115ms 34ms	Ping text/plain	18.203.30.8 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vitals.vercel-insights.com/v1/vitals Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/chunks/main-7041651cfbed3124.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.203.30.8 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-203-30-8.eu-west-1.compute.amazonaws.com Software / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-platform "Win32" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers date Thu, 16 May 2024 02:07:49 GMT x-ratelimit-reset 60 x-ratelimit-limit 1000 cross-origin-resource-policy cross-origin content-length 2 x-ratelimit-remaining 999 content-type text/plain; charset=utf-8
OPTIONS H2	200	graphql cms.abnormalsecurity.com/ Frame	0 0	338ms 135ms	Preflight text/html	167.172.14.134 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://cms.abnormalsecurity.com/graphql Protocol H2 Security TLS 1.3, , AES_256_GCM Server 167.172.14.134 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15724800 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept */* Access-Control-Request-Headers authorization,content-type Access-Control-Request-Method POST Origin https://abnormalsecurity.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type, X-Craft-Authorization, X-Craft-Token access-control-allow-origin * content-encoding gzip content-type text/html; charset=UTF-8 date Thu, 16 May 2024 02:07:50 GMT strict-transport-security max-age=15724800 x-content-type-options nosniff x-xss-protection 1; mode=block
POST H2	200	graphql Show response cms.abnormalsecurity.com/	7 KB 1 KB	185ms 184ms	Fetch application/json	167.172.14.134 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://cms.abnormalsecurity.com/graphql Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/chunks/1612-0eb08c218bba44ab.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 167.172.14.134 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash 1a7073fba5629dadcce95e8f78460659eb3fc5742716fff94cdbaae7f9fcce9e Security Headers Name Value Strict-Transport-Security max-age=15724800 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 Authorization Bearer he3ov7WMe88DxirU9L5BeVDxGCGYnzCF User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type application/json Accept application/json Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 02:07:50 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=15724800 content-type application/json; charset=UTF-8 access-control-allow-origin * access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type, X-Craft-Authorization, X-Craft-Token x-xss-protection 1; mode=block
GET H2	200	css2 fonts.googleapis.com/	7 KB 633 B	17ms 16ms	Stylesheet text/css	2a00:1450:4001:802::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Inconsolata%3Aital%2Cwght%400%2C200%3B0%2C400%3B0%2C500%3B0%2C600%3B0%2C700&display=swap Requested by Host: client URL: about:client Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 2f58b833c3751c3782f1ccfd8f14276e90196d3fe0c7cd7b10e9df2589137d57 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=31536000 date Thu, 16 May 2024 02:07:49 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Thu, 16 May 2024 02:07:49 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 16 May 2024 02:07:49 GMT
GET DATA	200 OK	truncated /	84 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 86027890704f9d2d32b7ceb1f4e25cfe75e7f7d96e6b2a061c9989c9e42f51e4 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	5b44b2eaae896b504d4f83df72a96cba.svg site-assets.plasmic.app/	3 KB 1005 B	85ms 9ms	Image image/svg+xml	2600:9000:2359:5e00:d:1a25:7e40:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://site-assets.plasmic.app/5b44b2eaae896b504d4f83df72a96cba.svg Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2359:5e00:d:1a25:7e40:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash ac4e49ff0d6f85af4ad5d6694a17031c7f32c9209c771c5c8ddb8f020888e3b9 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Sun, 24 Sep 2023 11:08:19 GMT x-amz-version-id UEf87VnS1C0wPqysr3re_lXo60gy5TJO content-encoding gzip via 1.1 0ccdc706b9b907d47a4960eec0e95f2a.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P10 age 20271571 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Wed, 19 Apr 2023 18:16:05 GMT server AmazonS3 etag W/"5b44b2eaae896b504d4f83df72a96cba" vary Accept-Encoding, Origin content-type image/svg+xml cache-control max-age=3600, s-maxage=31536000 x-robots-tag noindex x-amz-cf-id 0dO2R75snMMucUxU-qBfqhd47Ql2lagoBEstJ23vSlJRJnE_wxU_qw==
GET H2	200	99d4c78cfc19004cfbc919edcce78b01.png site-assets.plasmic.app/	16 KB 16 KB	84ms 8ms	Image image/png	2600:9000:2359:5e00:d:1a25:7e40:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://site-assets.plasmic.app/99d4c78cfc19004cfbc919edcce78b01.png Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2359:5e00:d:1a25:7e40:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash e13dc6a89c3720cb259e14957837154c0410b2a9af37601320054d52ea1fd24b Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 06 Mar 2024 08:16:46 GMT x-amz-version-id FQ8TZYVhfJaXl8d5RwlBza0PwrRCl2Il via 1.1 0ccdc706b9b907d47a4960eec0e95f2a.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P10 age 6112263 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront content-length 16191 last-modified Tue, 19 Dec 2023 21:59:24 GMT server AmazonS3 etag "cb78b63ea9c36fd4f822b4361f484c62" vary Origin content-type image/png cache-control max-age=3600, s-maxage=31536000 accept-ranges bytes x-robots-tag noindex x-amz-cf-id R39FmMmqszPYrzpNYK7ASyJXVeYQTJLZAtzKL7U-EEfEY9NSvYI9fA==
GET H2	200	c7c2264fdecad9e1d34deb6b5f784c3a.svg site-assets.plasmic.app/	2 KB 978 B	83ms 7ms	Image image/svg+xml	2600:9000:2359:5e00:d:1a25:7e40:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://site-assets.plasmic.app/c7c2264fdecad9e1d34deb6b5f784c3a.svg Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2359:5e00:d:1a25:7e40:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 22e6a2b8a95a5c863569cd3813ca6a44c683ce6b6b59372d0ff4b4e3107ad72f Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 19 Dec 2023 23:30:07 GMT x-amz-version-id 4gukJsAllgSBLGPvqtUvkHc82gXYM5h5 content-encoding br via 1.1 0ccdc706b9b907d47a4960eec0e95f2a.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P10 age 12796663 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Tue, 19 Dec 2023 21:34:52 GMT server AmazonS3 etag W/"c7c2264fdecad9e1d34deb6b5f784c3a" vary Accept-Encoding, Origin content-type image/svg+xml cache-control max-age=3600, s-maxage=31536000 x-robots-tag noindex x-amz-cf-id 2Jz2bmA1_9IHXjJrX8WmCRMhlZu5nLeb0N2-Tj-xX5RW1-cchXdtsw==
POST H2	200	capture Show response analytics.plasmic.app/	13 B 359 B	529ms 170ms	Fetch application/json	44.238.205.61 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://analytics.plasmic.app/capture Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/chunks/pages/_app-cdc7736098ca8098.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 44.238.205.61 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-44-238-205-61.us-west-2.compute.amazonaws.com Software / Resource Hash 7d4afed20a912db310862a5294bcf8fb6269c76a292908ddc1fbd496456eff56 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Accept application/json Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 02:07:50 GMT strict-transport-security max-age=15724800; includeSubDomains x-content-type-options nosniff referrer-policy same-origin x-frame-options DENY access-control-allow-methods GET, POST, OPTIONS content-type application/json access-control-allow-origin https://abnormalsecurity.com vary Cookie access-control-allow-credentials true access-control-allow-headers X-Requested-With,Content-Type content-length 13
OPTIONS H2	200	graphql cms.abnormalsecurity.com/ Frame	0 0	222ms 134ms	Preflight text/html	167.172.14.134 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://cms.abnormalsecurity.com/graphql Protocol H2 Security TLS 1.3, , AES_256_GCM Server 167.172.14.134 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15724800 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept */* Access-Control-Request-Headers authorization,content-type Access-Control-Request-Method POST Origin https://abnormalsecurity.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type, X-Craft-Authorization, X-Craft-Token access-control-allow-origin * content-encoding gzip content-type text/html; charset=UTF-8 date Thu, 16 May 2024 02:07:50 GMT strict-transport-security max-age=15724800 x-content-type-options nosniff x-xss-protection 1; mode=block
POST H2	200	graphql Show response cms.abnormalsecurity.com/	7 KB 1 KB	181ms 181ms	Fetch application/json	167.172.14.134 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://cms.abnormalsecurity.com/graphql Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/chunks/1612-0eb08c218bba44ab.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 167.172.14.134 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash 1a7073fba5629dadcce95e8f78460659eb3fc5742716fff94cdbaae7f9fcce9e Security Headers Name Value Strict-Transport-Security max-age=15724800 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 Authorization Bearer he3ov7WMe88DxirU9L5BeVDxGCGYnzCF User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type application/json Accept application/json Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 02:07:50 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=15724800 content-type application/json; charset=UTF-8 access-control-allow-origin * access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type, X-Craft-Authorization, X-Craft-Token x-xss-protection 1; mode=block
GET H2	200	image abnormalsecurity.com/_next/	32 KB 32 KB	172ms 170ms	Image image/avif	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://abnormalsecurity.com/_next/image?url=https%3A%2F%2Foptimise2.assets-servd.host%2Fgifted-zorilla%2Fproduction%2Fimages%2Fblog%2FDocusign1.png%3Fw%3D1536%26h%3D2232%26auto%3Dcompress%252Cformat%26fit%3Dcrop%26dm%3D1715717629%26s%3D74129f8130ca643478b371ce7bee7523&w=825&q=75 Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 749c7827ccf265b40ac45e705297f820271dc66d52487b3faafe1a40988e7531 Security Headers Name Value Content-Security-Policy script-src 'none'; frame-src 'none'; sandbox; Strict-Transport-Security max-age=63072000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy script-src 'none'; frame-src 'none'; sandbox; date Wed, 15 May 2024 13:01:54 GMT strict-transport-security max-age=63072000 age 47155 x-vercel-imgsrc 36a610cbc63255380ae2d492be2b610c cross-origin-resource-policy cross-origin content-disposition inline; filename="Docusign1.avif" content-length 32892 last-modified Wed, 15 May 2024 13:01:54 GMT server Vercel x-vercel-id fra1::n8l2p-1715825269862-4ff3017598ae x-vercel-cache HIT vary Accept content-type image/avif access-control-allow-origin * cache-control public, max-age=2073600, must-revalidate accept-ranges bytes timing-allow-origin *
GET H2	200	index.json Show response abnormalsecurity.com/_next/data/nS6jZ2TY2PEod_9JEiZhQ/	1 MB 242 KB	31ms 31ms	Fetch application/json	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/data/nS6jZ2TY2PEod_9JEiZhQ/index.json Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/chunks/main-7041651cfbed3124.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 62d0454c9e6d76d6d426848ca59dcbe1d1d3e52313839302a3f2d0bda4b22684 Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign x-middleware-prefetch 1 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 00:13:34 GMT strict-transport-security max-age=63072000 age 6854 x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::sfo1::57wwl-1715825269887-96b9f760352c x-matched-path /_next/data/nS6jZ2TY2PEod_9JEiZhQ/[[...slug]].json etag W/"9kfycncif0qyyb" x-vercel-cache STALE x-frame-options SAMEORIGIN content-type application/json cache-control public, max-age=0, s-maxage=86400, stale-while-revalidate=86400 permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() x-nextjs-rewrite /__pm__plasmic_seed=8 access-control-allow-headers Content-Type
GET H2	200	demo.json Show response abnormalsecurity.com/_next/data/nS6jZ2TY2PEod_9JEiZhQ/	961 KB 204 KB	42ms 42ms	Fetch application/json	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/data/nS6jZ2TY2PEod_9JEiZhQ/demo.json?slug=demo Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/chunks/main-7041651cfbed3124.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 2c2a6d5a86e5a8fad060a8cfae7e65473474a213f5bddf35740dc52fe6f3890c Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign x-middleware-prefetch 1 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:01:29 GMT strict-transport-security max-age=63072000 age 379 x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::sfo1::jbmzh-1715825269887-0f8d8cdcc098 x-matched-path /_next/data/nS6jZ2TY2PEod_9JEiZhQ/[[...slug]].json etag W/"sldk2za301l3fe" x-vercel-cache STALE x-frame-options SAMEORIGIN content-type application/json cache-control public, max-age=0, s-maxage=86400, stale-while-revalidate=86400 permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() x-nextjs-rewrite /demo/__pm__plasmic_seed=8?slug=demo access-control-allow-headers Content-Type
GET H2	200	daniel-kelly.json Show response abnormalsecurity.com/_next/data/nS6jZ2TY2PEod_9JEiZhQ/blog/author/	575 KB 147 KB	41ms 41ms	Fetch application/json	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/data/nS6jZ2TY2PEod_9JEiZhQ/blog/author/daniel-kelly.json?authorSlug=daniel-kelly Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/chunks/main-7041651cfbed3124.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 474cdd8971c5cca9c3a5ff83ab6d8ff7c4e9ee3d0638dfe3f7d90f521f865fdd Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign x-middleware-prefetch 1 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Wed, 15 May 2024 16:02:44 GMT strict-transport-security max-age=63072000 age 823 x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::sfo1::6g9db-1715825269887-87940eecf010 x-matched-path /_next/data/nS6jZ2TY2PEod_9JEiZhQ/blog/author/[authorSlug].json etag W/"de2x0jr4uecmhh" x-vercel-cache STALE x-frame-options SAMEORIGIN content-type application/json cache-control public, max-age=0, s-maxage=86400, stale-while-revalidate=86400 permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	demo.json Show response abnormalsecurity.com/_next/data/nS6jZ2TY2PEod_9JEiZhQ/	961 KB 204 KB	35ms 35ms	Fetch application/json	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/data/nS6jZ2TY2PEod_9JEiZhQ/demo.json Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/chunks/main-7041651cfbed3124.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 2eda17297371323af4129a382dea8497e735557eef00a303f3cd091fb6c41abd Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Wed, 15 May 2024 18:49:21 GMT strict-transport-security max-age=63072000 age 26308 x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::sfo1::chdv5-1715825269887-df9f313c2b2f x-matched-path /_next/data/nS6jZ2TY2PEod_9JEiZhQ/[[...slug]].json etag W/"hwgm5jkxyyl3fm" x-vercel-cache STALE x-frame-options SAMEORIGIN content-type application/json cache-control public, max-age=0, s-maxage=86400, stale-while-revalidate=86400 permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() x-nextjs-rewrite /demo/__pm__plasmic_seed=12 access-control-allow-headers Content-Type
GET H2	200	3268-a8f3ce0f9dd81dcc.js abnormalsecurity.com/_next/static/chunks/	0 21 KB	9ms 9ms	Other application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/3268-a8f3ce0f9dd81dcc.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/chunks/main-7041651cfbed3124.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT strict-transport-security max-age=63072000 age 119662 content-disposition inline; filename="3268-a8f3ce0f9dd81dcc.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::jbmzh-1715825269888-3bf4fe04118d x-matched-path /_next/static/chunks/3268-a8f3ce0f9dd81dcc.js etag W/"9f7cb3d30d946734a4d67120ff9f0383" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	3628-b16188eda94468f5.js abnormalsecurity.com/_next/static/chunks/	0 6 KB	10ms 9ms	Other application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/3628-b16188eda94468f5.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/chunks/main-7041651cfbed3124.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT strict-transport-security max-age=63072000 age 119662 content-disposition inline; filename="3628-b16188eda94468f5.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::jk5xf-1715825269889-379112990b96 x-matched-path /_next/static/chunks/3628-b16188eda94468f5.js etag W/"cf43c5d7f640cfb65b060651892ec529" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	8033-4b978e91e3b9dd5f.js abnormalsecurity.com/_next/static/chunks/	0 38 KB	12ms 12ms	Other application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/8033-4b978e91e3b9dd5f.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/chunks/main-7041651cfbed3124.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT strict-transport-security max-age=63072000 age 119662 content-disposition inline; filename="8033-4b978e91e3b9dd5f.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::p9967-1715825269889-6c66a1ec9746 x-matched-path /_next/static/chunks/8033-4b978e91e3b9dd5f.js etag W/"be01057d465a7a7ad9c2985e66e7fc44" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	%5B%5B...slug%5D%5D-238be366e9766b98.js abnormalsecurity.com/_next/static/chunks/pages/	0 4 KB	9ms 8ms	Other application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/pages/%5B%5B...slug%5D%5D-238be366e9766b98.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/chunks/main-7041651cfbed3124.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT strict-transport-security max-age=63072000 age 119662 content-disposition inline; filename="[[...slug]]-238be366e9766b98.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::t8rgw-1715825269889-1425c5758467 x-matched-path /_next/static/chunks/pages/%5B%5B...slug%5D%5D-238be366e9766b98.js etag W/"f67d1d6232efb13c116396e11cdc8e98" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
OPTIONS H2	200	graphql cms.abnormalsecurity.com/ Frame	0 0	179ms 130ms	Preflight text/html	167.172.14.134 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://cms.abnormalsecurity.com/graphql Protocol H2 Security TLS 1.3, , AES_256_GCM Server 167.172.14.134 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15724800 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept */* Access-Control-Request-Headers authorization,content-type Access-Control-Request-Method POST Origin https://abnormalsecurity.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type, X-Craft-Authorization, X-Craft-Token access-control-allow-origin * content-encoding gzip content-type text/html; charset=UTF-8 date Thu, 16 May 2024 02:07:50 GMT strict-transport-security max-age=15724800 x-content-type-options nosniff x-xss-protection 1; mode=block
POST H2	200	graphql Show response cms.abnormalsecurity.com/	7 KB 1 KB	180ms 180ms	Fetch application/json	167.172.14.134 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://cms.abnormalsecurity.com/graphql Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/chunks/1612-0eb08c218bba44ab.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 167.172.14.134 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash 1a7073fba5629dadcce95e8f78460659eb3fc5742716fff94cdbaae7f9fcce9e Security Headers Name Value Strict-Transport-Security max-age=15724800 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 Authorization Bearer he3ov7WMe88DxirU9L5BeVDxGCGYnzCF User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type application/json Accept application/json Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 02:07:50 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=15724800 content-type application/json; charset=UTF-8 access-control-allow-origin * access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type, X-Craft-Authorization, X-Craft-Token x-xss-protection 1; mode=block
OPTIONS H2	200	graphql cms.abnormalsecurity.com/ Frame	0 0	167ms 136ms	Preflight text/html	167.172.14.134 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://cms.abnormalsecurity.com/graphql Protocol H2 Security TLS 1.3, , AES_256_GCM Server 167.172.14.134 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15724800 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept */* Access-Control-Request-Headers authorization,content-type Access-Control-Request-Method POST Origin https://abnormalsecurity.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type, X-Craft-Authorization, X-Craft-Token access-control-allow-origin * content-encoding gzip content-type text/html; charset=UTF-8 date Thu, 16 May 2024 02:07:50 GMT strict-transport-security max-age=15724800 x-content-type-options nosniff x-xss-protection 1; mode=block
POST H2	200	graphql Show response cms.abnormalsecurity.com/	7 KB 1 KB	197ms 196ms	Fetch application/json	167.172.14.134 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://cms.abnormalsecurity.com/graphql Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/chunks/1612-0eb08c218bba44ab.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 167.172.14.134 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash 1a7073fba5629dadcce95e8f78460659eb3fc5742716fff94cdbaae7f9fcce9e Security Headers Name Value Strict-Transport-Security max-age=15724800 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 Authorization Bearer he3ov7WMe88DxirU9L5BeVDxGCGYnzCF User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type application/json Accept application/json Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 02:07:50 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=15724800 content-type application/json; charset=UTF-8 access-control-allow-origin * access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type, X-Craft-Authorization, X-Craft-Token x-xss-protection 1; mode=block
GET H2	200	3268-a8f3ce0f9dd81dcc.js Show response abnormalsecurity.com/_next/static/chunks/	68 KB 0	1ms 1ms	Script application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/3268-a8f3ce0f9dd81dcc.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/chunks/main-7041651cfbed3124.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash e2bc7bf63476f93810546bddd45baaf1f15593ceb8039bd4bc0d42680ba04e2b Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT age 119662 content-disposition inline; filename="3268-a8f3ce0f9dd81dcc.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::jbmzh-1715825269888-3bf4fe04118d x-matched-path /_next/static/chunks/3268-a8f3ce0f9dd81dcc.js etag W/"9f7cb3d30d946734a4d67120ff9f0383" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	3628-b16188eda94468f5.js Show response abnormalsecurity.com/_next/static/chunks/	17 KB 0	3ms 3ms	Script application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/3628-b16188eda94468f5.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/chunks/main-7041651cfbed3124.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 001a1b72f18bdd6972f541d841786ddeccbece491fa524619272e7cf6b89e06a Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT age 119662 content-disposition inline; filename="3628-b16188eda94468f5.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::jk5xf-1715825269889-379112990b96 x-matched-path /_next/static/chunks/3628-b16188eda94468f5.js etag W/"cf43c5d7f640cfb65b060651892ec529" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	8033-4b978e91e3b9dd5f.js Show response abnormalsecurity.com/_next/static/chunks/	321 KB 0	3ms 3ms	Script application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/8033-4b978e91e3b9dd5f.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/chunks/main-7041651cfbed3124.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash e28438a652ba23ce2d9317b3b5c8c18d07f13bd6dcf46884110117c13ed7cc56 Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT age 119662 content-disposition inline; filename="8033-4b978e91e3b9dd5f.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::p9967-1715825269889-6c66a1ec9746 x-matched-path /_next/static/chunks/8033-4b978e91e3b9dd5f.js etag W/"be01057d465a7a7ad9c2985e66e7fc44" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	%5B%5B...slug%5D%5D-238be366e9766b98.js Show response abnormalsecurity.com/_next/static/chunks/pages/	9 KB 0	4ms 4ms	Script application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/pages/%5B%5B...slug%5D%5D-238be366e9766b98.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/chunks/main-7041651cfbed3124.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 4ed7f265df1a4337ee2228a543d1c01f914468616b0922b899cfab34808088ea Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT age 119662 content-disposition inline; filename="[[...slug]]-238be366e9766b98.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::t8rgw-1715825269889-1425c5758467 x-matched-path /_next/static/chunks/pages/%5B%5B...slug%5D%5D-238be366e9766b98.js etag W/"f67d1d6232efb13c116396e11cdc8e98" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	%5BauthorSlug%5D-6b599b1a957572a3.js abnormalsecurity.com/_next/static/chunks/pages/blog/author/	0 3 KB	10ms 10ms	Other application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/pages/blog/author/%5BauthorSlug%5D-6b599b1a957572a3.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/chunks/main-7041651cfbed3124.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT strict-transport-security max-age=63072000 age 119656 content-disposition inline; filename="[authorSlug]-6b599b1a957572a3.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::6g9db-1715825269963-51f55a909bef x-matched-path /_next/static/chunks/pages/blog/author/%5BauthorSlug%5D-6b599b1a957572a3.js etag W/"38e73b74a2b5b2258975576de57d76a6" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
GET H2	200	%5BauthorSlug%5D-6b599b1a957572a3.js Show response abnormalsecurity.com/_next/static/chunks/pages/blog/author/	6 KB 0	0ms 0ms	Script application/javascript	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/_next/static/chunks/pages/blog/author/%5BauthorSlug%5D-6b599b1a957572a3.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/chunks/main-7041651cfbed3124.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash ec066df4ad4ee143630ccd123a5c5a2ec341ee4d059e9ab3a91c424bb1e06cc6 Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev content-encoding br x-content-type-options nosniff date Thu, 16 May 2024 02:07:49 GMT age 119656 content-disposition inline; filename="[authorSlug]-6b599b1a957572a3.js" x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::6g9db-1715825269963-51f55a909bef x-matched-path /_next/static/chunks/pages/blog/author/%5BauthorSlug%5D-6b599b1a957572a3.js etag W/"38e73b74a2b5b2258975576de57d76a6" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() access-control-allow-headers Content-Type
POST H2	200	vitals vitals.vercel-insights.com/v1/	2 B 165 B	34ms 33ms	Ping text/plain	18.203.30.8 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vitals.vercel-insights.com/v1/vitals Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/chunks/main-7041651cfbed3124.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.203.30.8 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-203-30-8.eu-west-1.compute.amazonaws.com Software / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-platform "Win32" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers date Thu, 16 May 2024 02:07:50 GMT x-ratelimit-reset 60 x-ratelimit-limit 1000 cross-origin-resource-policy cross-origin content-length 2 x-ratelimit-remaining 999 content-type text/plain; charset=utf-8
GET H2	200	favicon-32x32.png abnormalsecurity.com/	569 B 1 KB	15ms 15ms	Other image/png	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/favicon-32x32.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash bf476698abdef8e392e23987f01542f9526bc37974417c6eb6130e42d3f710fb Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev date Thu, 16 May 2024 02:07:50 GMT x-content-type-options nosniff strict-transport-security max-age=63072000 age 119504 content-disposition inline; filename="favicon-32x32.png" content-length 569 x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::grxw6-1715825270091-efe580c30f84 x-matched-path /favicon-32x32.png etag "c7398ddb820b5e86fd154cca3e8044c0" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type image/png access-control-allow-origin * cache-control public, max-age=0, s-maxage=86400, stale-while-revalidate=86400 permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() accept-ranges bytes access-control-allow-headers Content-Type
GET H2	200	osano.js Show response cmp.osano.com/169lRDSj6676CDt8D/88b78aa1-c424-4eeb-96cb-59809bf84390/	238 KB 62 KB	411ms 377ms	Script application/javascript	2600:9000:266e:a000:3:b7e:8940:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cmp.osano.com/169lRDSj6676CDt8D/88b78aa1-c424-4eeb-96cb-59809bf84390/osano.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:266e:a000:3:b7e:8940:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software CloudFront / Resource Hash 62753ea6593ce35571a1e0e18e23584aaa56618dd71ea67947a3e82e1504f496 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 02:07:50 GMT content-encoding br via 1.1 edfa50bbeda89838b4ee2ce6eaea1b04.cloudfront.net (CloudFront) x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload x-amz-cf-pop FRA56-P8 x-cache Miss from cloudfront cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 62793 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 14 May 2024 22:48:05 GMT server CloudFront etag "49f5914802db4dece1213db4f976b74d" x-frame-options SAMEORIGIN vary Origin content-type application/javascript; charset=utf-8 cache-control public, max-age=86400, s-maxage=86400, must-revalidate, proxy-revalidate, no-transform x-amz-cf-id gJaiHKhLY4LZMdB0ILxtJH_WjOpwLbuHCepbZ4I5jcB4qW-XOvR4Jg==
GET H2	200	gtm.js Show response www.googletagmanager.com/	314 KB 108 KB	46ms 25ms	Script application/javascript	2a00:1450:4001:806::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-5DSW3JC Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash f1cce074c933d1711ae6e36362e6a65d77af82f5c8834b5c19d923393a9164b7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 02:07:50 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 109950 x-xss-protection 0 last-modified Thu, 16 May 2024 00:08:53 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 16 May 2024 02:07:50 GMT
GET H2	200	st.js Show response s.swiftypecdn.com/install/v2/	416 KB 110 KB	40ms 7ms	Script text/javascript	151.101.1.167 FASTLY
General Check archive.org Show headers Download Go to Full URL https://s.swiftypecdn.com/install/v2/st.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.1.167 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 2d7c7930eb39d59cd8c2dc00652977da3ed72347e7cd465f7b540e10e2121c22 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-served-by cache-fra-eddf8230082-FRA date Thu, 16 May 2024 02:07:50 GMT content-encoding gzip via 1.1 varnish age 45 x-timer S1715825270.139082,VS0,VE1 etag "644bc37d-1b6c6" vary Accept-Encoding x-cache HIT content-type text/javascript access-control-allow-origin * cache-control max-age=300, public, max-age=300, public accept-ranges bytes content-length 112326 x-cache-hits 1
GET H2	200	chatV2.js Show response dyv6f9ner1ir9.cloudfront.net/assets/js/	998 B 2 KB	7ms 7ms	Script text/javascript	2600:9000:214f:b600:3:eee:d40:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dyv6f9ner1ir9.cloudfront.net/assets/js/chatV2.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:214f:b600:3:eee:d40:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 333d71153215f5f9299fa750c8b4b1e774e62f69ba13ee47e14d6385afcc69ec Security Headers Name Value Content-Security-Policy form-action 'self'; block-all-mixed-content Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 05:23:25 GMT via 1.1 511c8b6c7e903efca023a504d527516a.cloudfront.net (CloudFront) content-security-policy form-action 'self'; block-all-mixed-content strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop FRA53-C1 age 74855 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront content-length 998 referrer-policy same-origin last-modified Wed, 08 May 2024 06:52:35 GMT server AmazonS3 etag "6e836226ec0cee4ccc1b1ef7c684584d" vary Accept-Encoding content-type text/javascript cache-control public, max-age=31622400 permissions-policy interest-cohort=() accept-ranges bytes x-amz-cf-id 0HZKjHoJHAZlONfG_P1UEXt2dk7-ciQi3YlGUpPlf9XBK_TJpgTysw==
GET H2	200	MPCTbKVvgW6arYio-yHr.json Show response s.swiftypecdn.com/install/v2/config/	19 KB 5 KB	532ms 517ms	XHR application/json	151.101.1.167 FASTLY
General Check archive.org Show headers Download Go to Full URL https://s.swiftypecdn.com/install/v2/config/MPCTbKVvgW6arYio-yHr.json Requested by Host: s.swiftypecdn.com URL: https://s.swiftypecdn.com/install/v2/st.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.1.167 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash e927d7fbd371b71537496dd2bc52f767f2e0f5c23e873075b367b8a5e7a26215 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept */* Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 02:07:50 GMT content-encoding gzip x-content-type-options nosniff via 1.1 varnish x-permitted-cross-domain-policies none age 0 x-cache HIT content-length 4250 x-xss-protection 1; mode=block x-request-id 76b73b61e27ae9745e8da525294f12e1 x-served-by cache-fra-eddf8230131-FRA referrer-policy strict-origin-when-cross-origin last-modified Fri, 06 Jan 2023 17:39:17 GMT x-timer S1715825270.188645,VS0,VE511 etag W/"41ea9ae29cb453065d6ee8ac2b35f23e" x-download-options noopen x-frame-options SAMEORIGIN access-control-max-age 7200 access-control-allow-methods GET, POST content-type application/json; charset=utf-8 access-control-allow-origin * access-control-expose-headers cache-control max-age=300, public access-control-allow-credentials true vary Accept-Encoding, Origin accept-ranges bytes x-cache-hits 0
GET H2	200	js Show response www.googletagmanager.com/gtag/	313 KB 103 KB	27ms 26ms	Script application/javascript	2a00:1450:4001:806::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-F60FHP0104&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5DSW3JC Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash a81758413cb78437c36250c56802377d0bd3fcf94a547a42e69bb35535e6fc53 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 02:07:50 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 105617 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Thu, 16 May 2024 02:07:50 GMT
GET H2	200	6si.min.js Show response j.6sc.co/	66 KB 18 KB	110ms 22ms	Script application/javascript	2.17.147.176 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.147.176 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-147-176.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dc93c5b3243e66c7b2e27c51b76fa6a11bd7a6d7546c5fa26bbffa001f885305 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 02:07:50 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 09 May 2024 06:01:25 GMT server nginx/1.14.0 (Ubuntu) etag "663c66b5-106b3" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 18038 expires Thu, 16 May 2024 02:07:50 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	52 KB 21 KB	37ms 6ms	Script text/javascript	2a00:1450:4001:827::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5DSW3JC Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Thu, 16 May 2024 00:20:27 GMT last-modified Tue, 12 Dec 2023 18:09:08 GMT server Golfe2 age 6443 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20994 expires Thu, 16 May 2024 02:20:27 GMT
GET H2	200	destination Show response www.googletagmanager.com/gtag/	263 KB 90 KB	21ms 21ms	Script application/javascript	2a00:1450:4001:806::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/destination?id=AW-759321003&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5DSW3JC Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash a55ced0537dea6fbf4b6e7045a3650d2c72dc724865f9bb1ce4c32b45afb7247 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 02:07:50 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 92539 x-xss-protection 0 last-modified Thu, 16 May 2024 00:08:53 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 16 May 2024 02:07:50 GMT
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	47 KB 17 KB	64ms 15ms	Script application/javascript	2a02:26f0:3500:16::215:148d AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5DSW3JC Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:148d Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 899d1ec3c095342571d3be2091ec6f984d4cc82390d1f61945c391fa035b00d9 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 02:07:50 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 06 May 2024 17:20:18 GMT x-cdn AKAM x-amz-server-side-encryption AES256 vary Accept-Encoding content-type application/javascript;charset=utf-8 cache-control max-age=34901 accept-ranges bytes content-length 16683
GET H2	200	bat.js Show response bat.bing.com/	45 KB 13 KB	63ms 36ms	Script application/javascript	2620:1ec:c11::237 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5DSW3JC Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip date Thu, 16 May 2024 02:07:49 GMT last-modified Thu, 29 Feb 2024 19:58:06 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 5902668E6023452DBD9813D4634C8FB7 Ref B: FRAEDGE1807 Ref C: 2024-05-16T02:07:50Z etag "01b4e9c496bda1:0" vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript cache-control private,max-age=1800 accept-ranges bytes content-length 13261
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/	1 KB 1 KB	45ms 11ms	Script application/x-javascript	88.221.60.75 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 88.221.60.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a88-221-60-75.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Thu, 16 May 2024 02:07:50 GMT Content-Encoding gzip Last-Modified Fri, 17 Mar 2023 01:24:48 GMT Server AkamaiNetStorage ETag "cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Content-Type application/x-javascript Connection keep-alive Accept-Ranges bytes Content-Length 729
GET H3	200	55451921-8278-4244-87a2-1e0b878bdae0.js Show response cdn.mouseflow.com/projects/	171 KB 50 KB	43ms 23ms	Script application/javascript	2606:4700::6812:1a32 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.mouseflow.com/projects/55451921-8278-4244-87a2-1e0b878bdae0.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6812:1a32 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 36c8e9918e33aeed67d4c34e9b511b507fec7892723e25a575d6cd9383c7e80b Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 02:07:50 GMT strict-transport-security max-age=15552000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br x-mf-continent EU age 187165 x-cache-status HIT alt-svc h3=":443"; ma=86400 x-mf-script-region enforced-privacy x-mf-country DE last-modified Mon, 06 May 2024 20:23:45 GMT server cloudflare etag W/"d1c5bb4bf39fda1:0" vary Accept-Encoding, Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=86400 cf-ray 8847d102dc2fbb5b-FRA expires Fri, 17 May 2024 02:07:50 GMT
GET H3	200	zi-tag.js Show response js.zi-scripts.com/	9 KB 3 KB	46ms 24ms	Script application/javascript	172.64.150.44 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.zi-scripts.com/zi-tag.js Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Protocol H3 Security QUIC, , AES_128_GCM Server 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c3ea3a972768896d2a84d6eb36d3f5919478ad9c091477c22a5362eb6d53aee4 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 02:07:50 GMT x-amz-version-id 4TVPkf0eH3kVl0Vjj3KPZI_FUiecs6et via 1.1 89e34e3fd814f1393ef77867b93dd12e.cloudfront.net (CloudFront) cf-cache-status DYNAMIC content-encoding gzip x-amz-cf-pop FRA56-P4 age 70216 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400 last-modified Wed, 15 May 2024 06:37:27 GMT server cloudflare etag W/"5c7228fc2640a4dfce48217428980fe3" vary Accept-Encoding content-type application/javascript cf-ray 8847d102da2e4d7f-FRA x-amz-cf-id RuDPxak2-jfrIa0ved1ma662yinBIpAExm31xb9IIXp1CXx45SAINg==
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/163/	11 KB 5 KB	8ms 7ms	Script application/x-javascript	88.221.60.75 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/163/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/munchkin.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 88.221.60.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a88-221-60-75.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Thu, 16 May 2024 02:07:50 GMT Content-Encoding gzip Last-Modified Fri, 06 Jan 2023 02:26:40 GMT Server AkamaiNetStorage ETag "ea7826f34518d7c2295738f39c7640fa:1672972000.238769" Vary Accept-Encoding Content-Type application/x-javascript P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Cache-Control max-age=8640000 Connection keep-alive Accept-Ranges bytes Content-Length 4741 Expires Sat, 24 Aug 2024 02:07:50 GMT
OPTIONS H3	204	getSubscriptions js.zi-scripts.com/unified/v1/master/ Frame	0 0	187ms 168ms	Preflight	172.64.150.44 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.zi-scripts.com/unified/v1/master/getSubscriptions Protocol H3 Security QUIC, , AES_128_GCM Server 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,content-type,visited_url Access-Control-Request-Method GET Origin https://abnormalsecurity.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers access-control-allow-headers * access-control-allow-methods * access-control-allow-origin * access-control-max-age 0 alt-svc h3=":443"; ma=86400 apigw-requestid X12Sijj4vHcESQA= cf-cache-status DYNAMIC cf-ray 8847d103280c3835-FRA date Thu, 16 May 2024 02:07:50 GMT server cloudflare vary Access-Control-Request-Headers via 1.1 8a6f67a9421de326f43e9107751b580e.cloudfront.net (CloudFront) x-amz-cf-id 0m539R4o_-FAbSofOBWYalR0P_L9bBsO93NAhLKXiBBtHtfH2j0HzA== x-amz-cf-pop FRA56-P4 x-cache Miss from cloudfront x-powered-by Express
GET H3	200	getSubscriptions Show response js.zi-scripts.com/unified/v1/master/	199 B 564 B	514ms 514ms	Fetch application/json	172.64.150.44 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.zi-scripts.com/unified/v1/master/getSubscriptions Requested by Host: js.zi-scripts.com URL: https://js.zi-scripts.com/zi-tag.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 6c11b259e4afd1d45d14064cf1f383901ba2a60506ee1499359fc70f1db5afcb Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-platform "Win32" Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 Authorization Bearer da2adf007b1682358524 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type application/json Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign visited_url https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Response headers date Thu, 16 May 2024 02:07:50 GMT via 1.1 8a6f67a9421de326f43e9107751b580e.cloudfront.net (CloudFront) content-encoding gzip cf-cache-status DYNAMIC x-amz-cf-pop FRA56-P4 x-powered-by Express x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 apigw-requestid X12SmhXiPHcESeA= server cloudflare etag W/"c7-5eEtAFmZPeY2YQsxAjITsfwCq9Q" content-type application/json; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cf-ray 8847d10428953835-FRA x-amz-cf-id pQ0TxkCGjqRpCqNyvHdtIHA56mfMhZt7ZdAcFowhHAPDe6whggwtuA==
GET H2	200	init Show response n2.mouseflow.com/	0 244 B	684ms 92ms	XHR text/plain	192.96.202.199 LEASEWEB-USA-WDC
General Check archive.org Show headers Download Go to Full URL https://n2.mouseflow.com/init?v=18.04&p=55451921-8278-4244-87a2-1e0b878bdae0&s=bc8569f5c9e81599d3bee3f076be993b&page=05165060a25bff374b36f954e7740a1130dbaa6e&ret=0&u=c0fa79c517e104dd1edc0959896997dc&href=https%3A%2F%2Fabnormalsecurity.com%2Fblog%2Fcybercriminals-exploit-docusign&url=abnormalsecurity.com%2Fblog%2Fcybercriminals-exploit-docusign&ref=&title=Cybercriminals%20Exploit%20Docusign%20With%20Customizable%20Phishing%E2%80%A6%20%7C%20Abnormal&res=1600x1200&tz=-60&to=0&dnt=0&ori=&dw=1600&dh=1200&time=834&pxr=1&gdpr=1 Requested by Host: cdn.mouseflow.com URL: https://cdn.mouseflow.com/projects/55451921-8278-4244-87a2-1e0b878bdae0.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.96.202.199 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US), Reverse DNS Software Mouseflow / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-platform "Win32" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-type text/plain Response headers date Thu, 16 May 2024 02:07:50 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff server Mouseflow content-type text/plain; charset=UTF-8 access-control-allow-origin https://abnormalsecurity.com access-control-allow-credentials true alt-svc h3=":443"; ma=86400 content-length 0
POST H/1.1	200 OK	visitWebPage 231-idp-139.mktoresp.com/webevents/	2 B 318 B	1091ms 157ms	Ping text/plain	192.28.147.68 OMNITURE
General Check archive.org Show headers Download Go to Full URL https://231-idp-139.mktoresp.com/webevents/visitWebPage?_mchNc=1715825270267&_mchCn=&_mchId=231-IDP-139&_mchTk=_mch-abnormalsecurity.com-1715825270266-32423&_mchHo=abnormalsecurity.com&_mchPo=&_mchRu=%2Fblog%2Fcybercriminals-exploit-docusign&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp= Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/163/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.28.147.68 , United States, ASN15224 (OMNITURE, US), Reverse DNS Software nginx/1.20.1 / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Thu, 16 May 2024 02:07:51 GMT Content-Encoding gzip Server nginx/1.20.1 Transfer-Encoding chunked Content-Type text/plain; charset=UTF-8 Access-Control-Allow-Origin * Connection keep-alive X-Request-Id ed703e82-4d93-4453-a211-0f9adeb3dd45
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2775268&time=1715825270268&url=https%3A%2F%2Fabnormalsecurity.com%2Fblog%2Fcybercriminals-exploit-docusign https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2775268&time=1715825270268&url=https%3A%2F%2Fabnormalsecurity.com%2Fblog%2Fcybercriminals-exploit-docusign&cookiesTest=true https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2775268%26time%3D1715825270268%26url%3Dhttps%253A%252F%252Fabnormalsecurity.com%2... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2775268&time=1715825270268&url=https%3A%2F%2Fabnormalsecurity.com%2Fblog%2Fcybercriminals-exploit-docusign&cookiesTest=true&liSync=true https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2775268&time=1715825270268&url=https%3A%2F%2Fabnormalsecurity.com%2Fblog%2Fcybercriminals-exploit-docusign&cookiesTest=true&liSync=true&e_ipv6=AQ...	0 266 B	146ms 111ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2775268&time=1715825270268&url=https%3A%2F%2Fabnormalsecurity.com%2Fblog%2Fcybercriminals-exploit-docusign&cookiesTest=true&liSync=true&e_ipv6=AQKxFHNNrARSMQAAAY9_J-A8_UaHeyCaB_-RbM4gSvavURKBBnv3ewy570rJ9cJhxEEMW5Xng4XzWQUlspYMKBmgWCwggw Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers date Thu, 16 May 2024 02:07:50 GMT x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: 71B9D80EC07643EB927D9BFA59AD67D3 Ref B: FRAEDGE1414 Ref C: 2024-05-16T02:07:50Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-lva1 x-li-proto http/2 content-length 0 x-li-uuid AAYYiLPF+xHOjgnwXVO2UQ== Redirect headers date Thu, 16 May 2024 02:07:50 GMT x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: 5DFB9322C3CD49AAABA96F3C164E99AC Ref B: FRAEDGE2010 Ref C: 2024-05-16T02:07:50Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-lva1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2775268&time=1715825270268&url=https%3A%2F%2Fabnormalsecurity.com%2Fblog%2Fcybercriminals-exploit-docusign&cookiesTest=true&liSync=true&e_ipv6=AQKxFHNNrARSMQAAAY9_J-A8_UaHeyCaB_-RbM4gSvavURKBBnv3ewy570rJ9cJhxEEMW5Xng4XzWQUlspYMKBmgWCwggw x-li-proto http/2 content-length 0 x-li-uuid AAYYiLPD0rtCZtWR/JVZqw==
GET H2	204	56361138.js Show response bat.bing.com/p/action/	0 116 B	33ms 33ms	Script text/plain	2620:1ec:c11::237 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/56361138.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control private,max-age=1800 date Thu, 16 May 2024 02:07:49 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: DCC0EBE29E664B6185F6E7430E347688 Ref B: FRAEDGE1807 Ref C: 2024-05-16T02:07:50Z x-cache CONFIG_NOCACHE
GET H2	204	0 bat.bing.com/action/	0 285 B	78ms 75ms	Image text/plain	2620:1ec:c11::237 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=56361138&tm=gtm002&Ver=2&mid=936bc399-9a1f-414d-8fdc-3a923228f504&sid=18d339b0132911ef8f376d477e98282c&vid=18d3aa80132911ef9a24097e45ffcae0&vids=1&msclkid=N&pi=918639831&lg=de-DE&sw=1600&sh=1200&sc=24&tl=Cybercriminals%20Exploit%20Docusign%20With%20Customizable%20Phishing%E2%80%A6%20%7C%20Abnormal&kw=phishing,%20customizable,%20templates,%20credentials,%20business,%20docusign,%20selling,%20cybercrime,%20forums,%20allowing,%20attackers,%20steal,%20email,%20abusing,%20compromise&p=https%3A%2F%2Fabnormalsecurity.com%2Fblog%2Fcybercriminals-exploit-docusign&r=&lt=791&evt=pageLoad&sv=1&rn=256116 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache strict-transport-security max-age=31536000; includeSubDomains; preload date Thu, 16 May 2024 02:07:49 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: B4514D185F07458CBB1374BAB7FF9B4A Ref B: FRAEDGE1807 Ref C: 2024-05-16T02:07:50Z x-cache CONFIG_NOCACHE access-control-allow-origin * cache-control no-cache, must-revalidate expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	TWKEverett-Medium-web.woff2 abnormalsecurity.com/fonts/	60 KB 60 KB	9ms 8ms	Font font/woff2	76.76.21.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://abnormalsecurity.com/fonts/TWKEverett-Medium-web.woff2 Requested by Host: abnormalsecurity.com URL: https://abnormalsecurity.com/_next/static/css/a8d2128c7d1ab0e1.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash d91033f65778252fc30b9aa96ff688f60a08c40cd89e947d795762b8da785d20 Security Headers Name Value Content-Security-Policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/_next/static/css/a8d2128c7d1ab0e1.css Origin https://abnormalsecurity.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy object-src data:; base-uri 'self' studio.plasmic.app analytics.plasmic.app; frame-ancestors 'self' studio.plasmic.app analytics.plasmic.app partners.abnormalsecurity.com cms.abnormalsecurity.com staging-cms.abnormalmarketing.dev date Thu, 16 May 2024 02:07:50 GMT x-content-type-options nosniff strict-transport-security max-age=63072000 age 119662 content-disposition inline; filename="TWKEverett-Medium-web.woff2" content-length 61120 x-xss-protection 1 referrer-policy same-origin server Vercel x-vercel-id fra1::n8l2p-1715825270309-6e0ff1acbff4 x-matched-path /fonts/TWKEverett-Medium-web.woff2 etag "f31631e88d6dfd9860d1013e7d77dd05" x-vercel-cache HIT x-frame-options SAMEORIGIN content-type font/woff2 access-control-allow-origin * cache-control public, max-age=315360000 permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), serial=(), sync-script=(), trust-token-redemption=() accept-ranges bytes access-control-allow-headers Content-Type
GET H2	200	/ Show response c.6sc.co/	7 B 196 B	32ms 21ms	XHR text/html	2.17.147.176 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.147.176 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-147-176.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 02:07:50 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://abnormalsecurity.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	36 B 339 B	52ms 12ms	XHR text/html	2a02:26f0:ab00::214:8e41 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:ab00::214:8e41 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash eb7c278ac8bbdb7f816328f0942bcddfa2344f736469023cc218edcf14ba4672 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 02:07:50 GMT vary Origin content-type text/html access-control-allow-origin https://abnormalsecurity.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2001:ac8:20:3d00:1011:ec89:7076:4282 server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715825270354_34901565_109396074_22_978_7_14_219";dur=1 content-length 36 expires Thu, 16 May 2024 02:07:50 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	133ms 125ms	Image image/gif	2.17.147.176 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=bbf40b2956d4bb7805e99ad643493df0&svisitor=null&visitor=191625df-e42c-4e06-88b2-06ff96d720ff&session=1390e2d6-5a67-41f3-8361-3aec42115d1f&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2016%20May%202024%2002%3A07%3A50%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Cybercriminals%20are%20abusing%20Docusign%20by%20selling%20customizable%20phishing%20templates%20on%20cybercrime%20forums%2C%20allowing%20attackers%20to%20steal%20credentials%20for%20phishing%E2%80%A6%22%2C%22keywords%22%3A%22phishing%2C%20customizable%2C%20templates%2C%20credentials%2C%20business%2C%20docusign%2C%20selling%2C%20cybercrime%2C%20forums%2C%20allowing%2C%20attackers%2C%20steal%2C%20email%2C%20abusing%2C%20compromise%22%2C%22title%22%3A%22Cybercriminals%20Exploit%20Docusign%20With%20Customizable%20Phishing%E2%80%A6%20%7C%20Abnormal%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fabnormalsecurity.com%2Fblog%2Fcybercriminals-exploit-docusign&pageViewId=b69a4723-9589-4956-83ff-14c5b6a0e3dd&v=1.1.20 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.147.176 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-147-176.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 02:07:50 GMT x-content-type-options nosniff last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 16 May 2024 02:07:50 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	132ms 124ms	Image image/gif	2.17.147.176 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=bbf40b2956d4bb7805e99ad643493df0&svisitor=null&visitor=191625df-e42c-4e06-88b2-06ff96d720ff&session=1390e2d6-5a67-41f3-8361-3aec42115d1f&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2016%20May%202024%2002%3A07%3A50%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22bbf40b2956d4bb7805e99ad643493df0%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2016%20May%202024%2002%3A07%3A50%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22fd01a97e4bdb20630a440f57b6e3085b2ff29834%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2016%20May%202024%2002%3A07%3A50%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2016%20May%202024%2002%3A07%3A50%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2016%20May%202024%2002%3A07%3A50%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Cybercriminals%20are%20abusing%20Docusign%20by%20selling%20customizable%20phishing%20templates%20on%20cybercrime%20forums%2C%20allowing%20attackers%20to%20steal%20credentials%20for%20phishing%E2%80%A6%22%2C%22keywords%22%3A%22phishing%2C%20customizable%2C%20templates%2C%20credentials%2C%20business%2C%20docusign%2C%20selling%2C%20cybercrime%2C%20forums%2C%20allowing%2C%20attackers%2C%20steal%2C%20email%2C%20abusing%2C%20compromise%22%2C%22title%22%3A%22Cybercriminals%20Exploit%20Docusign%20With%20Customizable%20Phishing%E2%80%A6%20%7C%20Abnormal%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fabnormalsecurity.com%2Fblog%2Fcybercriminals-exploit-docusign&pageViewId=b69a4723-9589-4956-83ff-14c5b6a0e3dd&v=1.1.20 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.147.176 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-147-176.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 02:07:50 GMT x-content-type-options nosniff last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 16 May 2024 02:07:50 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	124ms 123ms	Image image/gif	2.17.147.176 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=bbf40b2956d4bb7805e99ad643493df0&svisitor=null&visitor=191625df-e42c-4e06-88b2-06ff96d720ff&session=1390e2d6-5a67-41f3-8361-3aec42115d1f&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A20%3A3d00%3A1011%3Aec89%3A7076%3A4282%22%7D&isIframe=false&m=%7B%22description%22%3A%22Cybercriminals%20are%20abusing%20Docusign%20by%20selling%20customizable%20phishing%20templates%20on%20cybercrime%20forums%2C%20allowing%20attackers%20to%20steal%20credentials%20for%20phishing%E2%80%A6%22%2C%22keywords%22%3A%22phishing%2C%20customizable%2C%20templates%2C%20credentials%2C%20business%2C%20docusign%2C%20selling%2C%20cybercrime%2C%20forums%2C%20allowing%2C%20attackers%2C%20steal%2C%20email%2C%20abusing%2C%20compromise%22%2C%22title%22%3A%22Cybercriminals%20Exploit%20Docusign%20With%20Customizable%20Phishing%E2%80%A6%20%7C%20Abnormal%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fabnormalsecurity.com%2Fblog%2Fcybercriminals-exploit-docusign&pageViewId=b69a4723-9589-4956-83ff-14c5b6a0e3dd&v=1.1.20 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.147.176 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-147-176.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 02:07:50 GMT x-content-type-options nosniff last-modified Sat, 18 Feb 2023 02:04:22 GMT server nginx/1.14.0 (Ubuntu) etag "63f03226-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 16 May 2024 02:07:50 GMT
GET H2	200	details Show response epsilon.6sense.com/v3/company/	745 B 720 B	28ms 15ms	XHR application/json	13.248.142.121 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.248.142.121 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ac3ff6aafb2cddae2.awsglobalaccelerator.com Software nginx / Resource Hash 4160094e8e7a55a3dd60c62de930a81375ddce09c11dc6d7b28332da6dbbdf14 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 Authorization Token fd01a97e4bdb20630a440f57b6e3085b2ff29834 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 X-6s-CustomID WebTag1.0 bbf40b2956d4bb7805e99ad643493df0 Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign sec-ch-ua-platform "Win32" Response headers x-trace-id 4918263020424667 date Thu, 16 May 2024 02:07:50 GMT content-encoding gzip server nginx vary Origin, Accept-Encoding content-type application/json x-6si-region eu-central-1a access-control-allow-origin https://abnormalsecurity.com access-control-expose-headers X-6si-Region access-control-allow-credentials true timing-allow-origin https://6sense.com, https://www.ssga.com content-length 399
OPTIONS H2	200	details epsilon.6sense.com/v3/company/ Frame	0 0	30ms 9ms	Preflight	13.248.142.121 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.248.142.121 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ac3ff6aafb2cddae2.awsglobalaccelerator.com Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,x-6s-customid Access-Control-Request-Method GET Origin https://abnormalsecurity.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization,x-6s-customid access-control-allow-methods OPTIONS,GET access-control-allow-origin https://abnormalsecurity.com access-control-expose-headers X-6si-Region access-control-max-age 1800 date Thu, 16 May 2024 02:07:50 GMT server nginx timing-allow-origin https://6sense.com, https://www.ssga.com x-6si-region eu-central-1a x-trace-id 3782426759613941773
GET BLOB	200 OK	a9f4dd11-b6e6-4426-8198-0f3103b6d2e7 https://abnormalsecurity.com/	390 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://abnormalsecurity.com/a9f4dd11-b6e6-4426-8198-0f3103b6d2e7 Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Length 390 Content-Type text/javascript
GET H2	200	new_embed-2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241.css s.swiftypecdn.com/assets/	89 KB 33 KB	6ms 6ms	Stylesheet text/css	151.101.1.167 FASTLY
General Check archive.org Show headers Download Go to Full URL https://s.swiftypecdn.com/assets/new_embed-2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241.css Requested by Host: cmp.osano.com URL: https://cmp.osano.com/169lRDSj6676CDt8D/88b78aa1-c424-4eeb-96cb-59809bf84390/osano.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.1.167 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-cache-hits 4849 date Thu, 16 May 2024 02:07:50 GMT content-encoding gzip via 1.1 varnish age 1235111 x-cache HIT content-length 33983 x-served-by cache-fra-eddf8230082-FRA x-timer S1715825271.708608,VS0,VE0 etag "62b9d075-84bf" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=31536000, public accept-ranges bytes expires Thu, 01 May 2025 19:02:39 GMT
GET H/1.1	200 OK	cc.js cc.swiftype.com/	43 B 279 B	546ms 130ms	Image image/gif	169.48.219.66 SOFTLAYER
General Check archive.org Show headers Download Go to Show image Full URL https://cc.swiftype.com/cc.js?engine_key=Jf5CnSM-5QHr_uqSbubJ&url=https%3A%2F%2Fabnormalsecurity.com%2Fblog%2Fcybercriminals-exploit-docusign Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 169.48.219.66 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS 42.db.30a9.ip4.static.sl-reverse.com Software / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Content-Type image/gif Date Thu, 16 May 2024 02:07:51 GMT Cache-Control no-cache Last-Modified Mon, 28 Sep 1970 06:00:00 GMT Connection keep-alive Content-Length 43 Expires Thu, 16 May 2024 02:07:50 GMT
OPTIONS H3	200	/ ws.zoominfo.com/pixel/LKxXxg7SWf5zxXA3vzqV/ Frame	0 0	170ms 149ms	Preflight text/html	2606:4700::6810:752b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/LKxXxg7SWf5zxXA3vzqV/?iszitag=true Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6810:752b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept */* Access-Control-Request-Headers _vtok,_zitok,content-type,visited-url Access-Control-Request-Method GET Origin https://abnormalsecurity.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url access-control-allow-origin https://abnormalsecurity.com allow GET,HEAD alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8847d1079e383664-FRA content-encoding gzip content-type text/html; charset=utf-8 date Thu, 16 May 2024 02:07:51 GMT server cloudflare via 1.1 google x-content-type-options nosniff x-powered-by Express x-robots-tag noindex, nofollow
GET H3	200	/ Show response ws.zoominfo.com/pixel/LKxXxg7SWf5zxXA3vzqV/	3 KB 2 KB	255ms 245ms	Fetch text/javascript	2606:4700::6810:752b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/LKxXxg7SWf5zxXA3vzqV/?iszitag=true Requested by Host: js.zi-scripts.com URL: https://js.zi-scripts.com/zi-tag.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6810:752b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash e477ca404fbee794f067fdf124298c85c550d9d963a5281565e6aefca576fad6 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type text/javascript visited-url https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign _vtok NDUuMTQxLjE1Mi43Mg== _zitok 886f2ed858cd2e6b41501715825270 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 02:07:51 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 google server cloudflare x-powered-by Express vary Accept-Encoding content-type text/javascript access-control-allow-origin https://abnormalsecurity.com access-control-allow-credentials true x-robots-tag noindex, nofollow access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url alt-svc h3=":443"; ma=86400 cf-ray 8847d1089d539f42-FRA
GET BLOB	200 OK	db6157ec-d158-4c4e-885e-f024754a0366 https://abnormalsecurity.com/	390 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://abnormalsecurity.com/db6157ec-d158-4c4e-885e-f024754a0366 Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Length 390 Content-Type text/javascript
GET BLOB	200 OK	c1bde35f-dba9-4848-a722-affc68ddbe3c https://abnormalsecurity.com/	390 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://abnormalsecurity.com/c1bde35f-dba9-4848-a722-affc68ddbe3c Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Length 390 Content-Type text/javascript
GET BLOB	200 OK	4255f0d5-4b72-4f72-a10c-c1dfc16d64c1 https://abnormalsecurity.com/	390 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://abnormalsecurity.com/4255f0d5-4b72-4f72-a10c-c1dfc16d64c1 Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Length 390 Content-Type text/javascript
GET BLOB	200 OK	7d3d2ba8-6743-4d01-b036-067de3c09abf https://abnormalsecurity.com/	390 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://abnormalsecurity.com/7d3d2ba8-6743-4d01-b036-067de3c09abf Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Length 390 Content-Type text/javascript
GET BLOB	200 OK	1e9846cd-8a08-4500-946a-f3b9a6d497d6 https://abnormalsecurity.com/	390 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://abnormalsecurity.com/1e9846cd-8a08-4500-946a-f3b9a6d497d6 Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Length 390 Content-Type text/javascript
GET BLOB	200 OK	11aea2a5-8ad5-40e1-bb4a-493a3d4325e3 https://abnormalsecurity.com/	390 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://abnormalsecurity.com/11aea2a5-8ad5-40e1-bb4a-493a3d4325e3 Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Length 390 Content-Type text/javascript
GET BLOB	200 OK	d60fa5e0-dc22-4c06-a42f-b2a61b35c284 https://abnormalsecurity.com/	390 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://abnormalsecurity.com/d60fa5e0-dc22-4c06-a42f-b2a61b35c284 Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Length 390 Content-Type text/javascript
GET BLOB	200 OK	d1369bdc-71e2-47ea-b0eb-322fd05b1819 https://abnormalsecurity.com/	390 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://abnormalsecurity.com/d1369bdc-71e2-47ea-b0eb-322fd05b1819 Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Length 390 Content-Type text/javascript
GET BLOB	200 OK	9feeb6f9-9324-4353-8792-1aad1a49b259 https://abnormalsecurity.com/	390 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://abnormalsecurity.com/9feeb6f9-9324-4353-8792-1aad1a49b259 Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Length 390 Content-Type text/javascript
GET BLOB	200 OK	d2922019-67c3-4ff1-9826-0c1a059ef4f7 https://abnormalsecurity.com/	390 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://abnormalsecurity.com/d2922019-67c3-4ff1-9826-0c1a059ef4f7 Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Length 390 Content-Type text/javascript
GET BLOB	200 OK	e233f781-106c-4da5-97c3-b801a1b7d844 https://abnormalsecurity.com/	390 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://abnormalsecurity.com/e233f781-106c-4da5-97c3-b801a1b7d844 Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Length 390 Content-Type text/javascript
POST H2	204	/ Show response px.ads.linkedin.com/wa/	0 197 B	106ms 106ms	XHR text/plain	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/wa/ Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Accept * Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 02:07:50 GMT x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: 42C1DB54C69E4584BBB1D986E3256BAC Ref B: FRAEDGE2010 Ref C: 2024-05-16T02:07:51Z linkedin-action 1 vary Origin x-cache CONFIG_NOCACHE x-li-fabric prod-lva1 access-control-allow-origin https://abnormalsecurity.com x-li-proto http/2 access-control-allow-credentials true x-li-uuid AAYYiLPHt2uYDOG1mzmi1g==
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	124ms 124ms	Image image/gif	2.17.147.176 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=bbf40b2956d4bb7805e99ad643493df0&svisitor=null&visitor=191625df-e42c-4e06-88b2-06ff96d720ff&session=1390e2d6-5a67-41f3-8361-3aec42115d1f&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2016%20May%202024%2002%3A07%3A51%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2016%20May%202024%2002%3A07%3A50%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Cybercriminals%20are%20abusing%20Docusign%20by%20selling%20customizable%20phishing%20templates%20on%20cybercrime%20forums%2C%20allowing%20attackers%20to%20steal%20credentials%20for%20phishing%E2%80%A6%22%2C%22keywords%22%3A%22phishing%2C%20customizable%2C%20templates%2C%20credentials%2C%20business%2C%20docusign%2C%20selling%2C%20cybercrime%2C%20forums%2C%20allowing%2C%20attackers%2C%20steal%2C%20email%2C%20abusing%2C%20compromise%22%2C%22title%22%3A%22Cybercriminals%20Exploit%20Docusign%20With%20Customizable%20Phishing%E2%80%A6%20%7C%20Abnormal%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fabnormalsecurity.com%2Fblog%2Fcybercriminals-exploit-docusign&pageViewId=b69a4723-9589-4956-83ff-14c5b6a0e3dd&v=1.1.20 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.147.176 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-147-176.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 02:07:51 GMT x-content-type-options nosniff last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu) etag "63f020a0-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 16 May 2024 02:07:51 GMT
GET BLOB	200 OK	1c689ef7-5121-4a99-bbc2-94eaac9dcec2 Show response https://abnormalsecurity.com/	3 KB 0		Script text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://abnormalsecurity.com/1c689ef7-5121-4a99-bbc2-94eaac9dcec2 Requested by Host: cmp.osano.com URL: https://cmp.osano.com/169lRDSj6676CDt8D/88b78aa1-c424-4eeb-96cb-59809bf84390/osano.js Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash e477ca404fbee794f067fdf124298c85c550d9d963a5281565e6aefca576fad6 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Length 2911 Content-Type text/javascript
POST H3	200	html Show response n2.mouseflow.com/	0 256 B	404ms 103ms	XHR text/plain	2607:f5b7:1:52::10 LEASEWEB-USA-WDC
General Check archive.org Show headers Download Go to Full URL https://n2.mouseflow.com/html?website=55451921-8278-4244-87a2-1e0b878bdae0&session=bc8569f5c9e81599d3bee3f076be993b&page=05165060a25bff374b36f954e7740a1130dbaa6e&gz=1 Requested by Host: cdn.mouseflow.com URL: https://cdn.mouseflow.com/projects/55451921-8278-4244-87a2-1e0b878bdae0.js Protocol H3 Security QUIC, , AES_256_GCM Server 2607:f5b7:1:52::10 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US), Reverse DNS Software Mouseflow / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-platform "Win32" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-type text/plain Response headers date Thu, 16 May 2024 02:07:52 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff server Mouseflow x-recorder rec-19-us content-type text/plain; charset=UTF-8 access-control-allow-origin https://abnormalsecurity.com access-control-allow-credentials true alt-svc h3=":443"; ma=86400 content-length 0
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	125ms 125ms	Image image/gif	2.17.147.176 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=bbf40b2956d4bb7805e99ad643493df0&svisitor=null&visitor=191625df-e42c-4e06-88b2-06ff96d720ff&session=1390e2d6-5a67-41f3-8361-3aec42115d1f&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2016%20May%202024%2002%3A07%3A52%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2016%20May%202024%2002%3A07%3A51%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Cybercriminals%20are%20abusing%20Docusign%20by%20selling%20customizable%20phishing%20templates%20on%20cybercrime%20forums%2C%20allowing%20attackers%20to%20steal%20credentials%20for%20phishing%E2%80%A6%22%2C%22keywords%22%3A%22phishing%2C%20customizable%2C%20templates%2C%20credentials%2C%20business%2C%20docusign%2C%20selling%2C%20cybercrime%2C%20forums%2C%20allowing%2C%20attackers%2C%20steal%2C%20email%2C%20abusing%2C%20compromise%22%2C%22title%22%3A%22Cybercriminals%20Exploit%20Docusign%20With%20Customizable%20Phishing%E2%80%A6%20%7C%20Abnormal%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fabnormalsecurity.com%2Fblog%2Fcybercriminals-exploit-docusign&pageViewId=b69a4723-9589-4956-83ff-14c5b6a0e3dd&v=1.1.20 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.147.176 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-147-176.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 02:07:52 GMT x-content-type-options nosniff last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu) etag "63f020a0-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 16 May 2024 02:07:52 GMT
GET BLOB	200 OK	4e9f3429-ba70-4cc1-9269-a14062721955 https://abnormalsecurity.com/	390 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://abnormalsecurity.com/4e9f3429-ba70-4cc1-9269-a14062721955 Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Length 390 Content-Type text/javascript
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	124ms 124ms	Image image/gif	2.17.147.176 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=bbf40b2956d4bb7805e99ad643493df0&svisitor=null&visitor=191625df-e42c-4e06-88b2-06ff96d720ff&session=1390e2d6-5a67-41f3-8361-3aec42115d1f&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2016%20May%202024%2002%3A07%3A53%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2016%20May%202024%2002%3A07%3A52%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Cybercriminals%20are%20abusing%20Docusign%20by%20selling%20customizable%20phishing%20templates%20on%20cybercrime%20forums%2C%20allowing%20attackers%20to%20steal%20credentials%20for%20phishing%E2%80%A6%22%2C%22keywords%22%3A%22phishing%2C%20customizable%2C%20templates%2C%20credentials%2C%20business%2C%20docusign%2C%20selling%2C%20cybercrime%2C%20forums%2C%20allowing%2C%20attackers%2C%20steal%2C%20email%2C%20abusing%2C%20compromise%22%2C%22title%22%3A%22Cybercriminals%20Exploit%20Docusign%20With%20Customizable%20Phishing%E2%80%A6%20%7C%20Abnormal%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fabnormalsecurity.com%2Fblog%2Fcybercriminals-exploit-docusign&pageViewId=b69a4723-9589-4956-83ff-14c5b6a0e3dd&v=1.1.20 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.147.176 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-147-176.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 02:07:53 GMT x-content-type-options nosniff last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu) etag "63f02dad-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 16 May 2024 02:07:53 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	125ms 125ms	Image image/gif	2.17.147.176 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=bbf40b2956d4bb7805e99ad643493df0&svisitor=null&visitor=191625df-e42c-4e06-88b2-06ff96d720ff&session=1390e2d6-5a67-41f3-8361-3aec42115d1f&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2016%20May%202024%2002%3A07%3A54%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2016%20May%202024%2002%3A07%3A53%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Cybercriminals%20are%20abusing%20Docusign%20by%20selling%20customizable%20phishing%20templates%20on%20cybercrime%20forums%2C%20allowing%20attackers%20to%20steal%20credentials%20for%20phishing%E2%80%A6%22%2C%22keywords%22%3A%22phishing%2C%20customizable%2C%20templates%2C%20credentials%2C%20business%2C%20docusign%2C%20selling%2C%20cybercrime%2C%20forums%2C%20allowing%2C%20attackers%2C%20steal%2C%20email%2C%20abusing%2C%20compromise%22%2C%22title%22%3A%22Cybercriminals%20Exploit%20Docusign%20With%20Customizable%20Phishing%E2%80%A6%20%7C%20Abnormal%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fabnormalsecurity.com%2Fblog%2Fcybercriminals-exploit-docusign&pageViewId=b69a4723-9589-4956-83ff-14c5b6a0e3dd&v=1.1.20 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.147.176 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-147-176.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 02:07:54 GMT x-content-type-options nosniff last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 16 May 2024 02:07:54 GMT
POST H3	200	dom Show response n2.mouseflow.com/	0 238 B	93ms 93ms	XHR text/plain	2607:f5b7:1:52::10 LEASEWEB-USA-WDC
General Check archive.org Show headers Download Go to Full URL https://n2.mouseflow.com/dom?gz=1 Requested by Host: cdn.mouseflow.com URL: https://cdn.mouseflow.com/projects/55451921-8278-4244-87a2-1e0b878bdae0.js Protocol H3 Security QUIC, , AES_256_GCM Server 2607:f5b7:1:52::10 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US), Reverse DNS Software Mouseflow / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-platform "Win32" Referer https://abnormalsecurity.com/blog/cybercriminals-exploit-docusign Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-type text/plain Response headers date Thu, 16 May 2024 02:07:54 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff server Mouseflow content-type text/plain; charset=UTF-8 access-control-allow-origin https://abnormalsecurity.com access-control-allow-credentials true alt-svc h3=":443"; ma=86400 content-length 0
GET		img.gif b.6sc.co/v1/beacon/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

b.6sc.co

URL

https://b.6sc.co/v1/beacon/img.gif?token=bbf40b2956d4bb7805e99ad643493df0&svisitor=null&visitor=191625df-e42c-4e06-88b2-06ff96d720ff&session=1390e2d6-5a67-41f3-8361-3aec42115d1f&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2016%20May%202024%2002%3A07%3A55%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2016%20May%202024%2002%3A07%3A54%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%225005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Cybercriminals%20are%20abusing%20Docusign%20by%20selling%20customizable%20phishing%20templates%20on%20cybercrime%20forums%2C%20allowing%20attackers%20to%20steal%20credentials%20for%20phishing%E2%80%A6%22%2C%22keywords%22%3A%22phishing%2C%20customizable%2C%20templates%2C%20credentials%2C%20business%2C%20docusign%2C%20selling%2C%20cybercrime%2C%20forums%2C%20allowing%2C%20attackers%2C%20steal%2C%20email%2C%20abusing%2C%20compromise%22%2C%22title%22%3A%22Cybercriminals%20Exploit%20Docusign%20With%20Customizable%20Phishing%E2%80%A6%20%7C%20Abnormal%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fabnormalsecurity.com%2Fblog%2Fcybercriminals-exploit-docusign&pageViewId=b69a4723-9589-4956-83ff-14c5b6a0e3dd&v=1.1.20