redcanary.com Open in urlscan Pro
104.198.136.223  Public Scan

15 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 46

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1634353262654&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1634353262654%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fblog%252Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%252F%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1634353262654&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&liSync=true

Request Chain 48

• https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=849207035&utmhn=redcanary.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies&utmhid=240183180&utmr=-&utmp=%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&utmht=1634353262665&utmac=UA-52702906-1&utmgtm=2wgad0PXWC8JW&utmcc=__utma%3D111991431.196332420.1634353263.1634353263.1634353263.1%3B%2B__utmz%3D111991431.1634353263.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1773262821&utmredir=1&utmu=qmAgAABAAAGBAAAAAgABAAAE~ HTTP 302
• https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-52702906-1&cid=196332420.1634353263&jid=1773262821&_v=5.7.2&z=849207035 HTTP 302
• https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-52702906-1&cid=196332420.1634353263&jid=1773262821&_v=5.7.2&z=849207035

164 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/	1 MB 125 KB	553ms 181ms	Document text/html	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / WP Engine Resource Hash d84808ae4c02ba19e86bd61bf904ba10a7c988653d0872da1de864b736736886 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests upgrade-insecure-requests Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers :method GET :authority redcanary.com :scheme https :path /blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers server nginx date Sat, 16 Oct 2021 03:01:01 GMT content-type text/html; charset=UTF-8 vary Accept-Encoding Accept-Encoding Accept-Encoding content-security-policy upgrade-insecure-requests upgrade-insecure-requests link <https://redcanary.com/wp-json/>; rel="https://api.w.org/" <https://redcanary.com/wp-json/wp/v2/posts/17816>; rel="alternate"; type="application/json" <https://redcanary.com/?p=17816>; rel=shortlink x-powered-by WP Engine x-cacheable SHORT cache-control max-age=600, must-revalidate x-cache HIT: 1 x-cache-group normal x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin x-content-type-options nosniff x-frame-options deny feature-policy microphone 'none'; geolocation 'none' x-permitted-cross-domain-policies master-only strict-transport-security max-age=63072000 content-encoding br
GET H2	200	forms2.min.js Show response resource.redcanary.com/js/forms2/js/	205 KB 68 KB	407ms 304ms	Script application/x-javascript	104.17.72.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/js/forms2.min.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2689a0237a95cfd8135f8da3ac79c430e903f3c542f8b862f68141c84c348c43 Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status REVALIDATED last-modified Tue, 10 Aug 2021 17:41:08 GMT server cloudflare etag "3080753-33210-5c93801bbf500" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=14400 cf-ray 69ee0a50d9a7f9e2-PRG expires Sat, 16 Oct 2021 07:01:02 GMT
GET H2	200	default.min.css cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/	763 B 1 KB	46ms 18ms	Stylesheet text/css	104.16.19.94 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/default.min.css Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.19.94 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3cc36c64ef86bed21592653daac82fd7e4c364c32c8344336aa13f7dbf52c90 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 997606 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 271 timing-allow-origin * last-modified Mon, 08 Feb 2021 15:10:43 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "60215473-2fb" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=inxl%2B0yHqUoj4DAHICnqZSNy6lG4Ixt6JpQWwaye5ICMInGlfkwa0PY5Z%2Bh7Fb8721pZ8JYz0Y74w9mJkIOYEQ%2FUcda9X1jLAeewP2T8zkblId32L7kz7kIgbuSLSwlz61YQbw78"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 69ee0a50585c4138-PRG expires Thu, 06 Oct 2022 03:01:02 GMT
GET H2	200	highlight.min.js Show response cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/	130 KB 33 KB	47ms 19ms	Script application/javascript	104.16.19.94 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/highlight.min.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.19.94 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d2f545bb226e5bcc1d50af37b345d245dce63bc07aaeba2243e0f1ea87b2dcb9 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 1782472 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 33250 timing-allow-origin * last-modified Mon, 08 Feb 2021 15:10:43 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "60215473-20801" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i%2FVPyLv5BThdWPNW%2BIiWcROKlkeBqOJrNlY93WVeVMpLLCbWrq3V9QDCZLFXeLLpqQX643QPaDs398C%2FmF0XwV8VWTeGwazzRUQ53wB5xNGJr8aZB0IFDJCNEgf1JDiINMltNW%2FO"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 69ee0a50585d4138-PRG expires Thu, 06 Oct 2022 03:01:02 GMT
GET H2	200	bizible.js Show response cdn.bizible.com/scripts/	83 KB 32 KB	27ms 6ms	Script application/x-javascript	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67F3) / Resource Hash de22a1f465480545ea9595d61c16ad21ad40e6b2509cca0e76d2601980e52988 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT content-encoding gzip last-modified Fri, 15 Oct 2021 00:26:12 GMT server ECS (frb/67F3) age 18676 etag "3f86e8415bc1d71:0" vary Accept-Encoding x-cache HIT content-type application/x-javascript cache-control max-age=86400 accept-ranges bytes content-length 32240
GET H2	200	9416.js Show response script.crazyegg.com/pages/scripts/0096/	5 KB 2 KB	659ms 624ms	Script text/javascript	104.19.147.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/scripts/0096/9416.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2b553fd2efd49c7f926b23eba945357178e61367684db16696535f8e99cf11f0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT content-encoding gzip cf-cache-status MISS cf-ray 69ee0a511c1f4137-PRG ce-version 11.1.351 content-length 1856 last-modified Sat, 16 Oct 2021 03:01:02 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * access-control-expose-headers CE-Version cache-control public, max-age=300, s-maxage=1209600 accept-ranges bytes timing-allow-origin *
GET H2	200	js Show response www.googletagmanager.com/gtag/	124 KB 49 KB	60ms 31ms	Script application/javascript	142.250.185.104 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.104 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s49-in-f8.1e100.net Software Google Tag Manager / Resource Hash 5b0d4328e1046b70fb261cc6174c2e45b8e5f609d528cd457f1d903200473ad4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT content-encoding br server Google Tag Manager access-control-allow-headers Cache-Control vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 49362 x-xss-protection 0 expires Sat, 16 Oct 2021 03:01:02 GMT
GET H2	200	css fonts.googleapis.com/	7 KB 1 KB	58ms 23ms	Stylesheet text/css	142.250.186.42 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.42 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s04-in-f10.1e100.net Software ESF / Resource Hash 987a1e64929833a5eec95db2badabea568bd1ed323451cf07d076f7f4df16722 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Sat, 16 Oct 2021 01:42:29 GMT server ESF date Sat, 16 Oct 2021 03:01:02 GMT x-frame-options SAMEORIGIN report-to {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin cross-origin-opener-policy-report-only same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU" expires Sat, 16 Oct 2021 03:01:02 GMT
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/	1 KB 1 KB	43ms 7ms	Script application/x-javascript	104.111.234.67 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-234-67.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 92cd91bcde106f185809cbbc19c8bc82f72f4e7f598a273f054aee9d07e06a6a Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sat, 16 Oct 2021 03:01:02 GMT Content-Encoding gzip Last-Modified Fri, 15 Oct 2021 04:58:23 GMT Server AkamaiNetStorage ETag "a209e5424e6518562afe0db5aa7a7cbc:1634273903.364708" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 765
GET H2	200	gtm.js Show response www.googletagmanager.com/	202 KB 66 KB	71ms 42ms	Script application/javascript	142.250.185.104 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.104 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s49-in-f8.1e100.net Software Google Tag Manager / Resource Hash 65e69e7de3d021701f9bc2fb85a41319105efc8d874724799e225594386a80b7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT content-encoding br server Google Tag Manager access-control-allow-headers Cache-Control vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 67482 x-xss-protection 0 expires Sat, 16 Oct 2021 03:01:02 GMT
GET H/1.1	200 OK	6si.min.js Show response j.6sc.co/	27 KB 9 KB	51ms 7ms	Script application/javascript	104.111.233.140 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-140.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 2707e48726a3f7ec48a1d1aec9738f20b36bac1535cfa9de2e4d92310c4e7e7a Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sat, 16 Oct 2021 03:01:02 GMT Content-Encoding gzip X-Content-Type-Options nosniff Connection keep-alive Vary Accept-Encoding Content-Length 8575 Pragma no-cache Last-Modified Thu, 07 Oct 2021 17:17:43 GMT Server nginx/1.14.0 (Ubuntu) ETag "615f2bb7-6a5f" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type application/javascript Access-Control-Allow-Origin Cache-Control private, no-cache, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Sat, 16 Oct 2021 03:01:02 GMT
GET H2	200	65zait4t5ws7.js Show response js.driftt.com/include/1634353500000/	216 KB 62 KB	171ms 133ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/include/1634353500000/65zait4t5ws7.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash bff6d07735d6955c73fdb1b8d0bc93f4e8e5233aca673be93ddcdb5f7d223ac1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT content-encoding gzip x-amz-cf-pop FRA53-C1 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 15 Oct 2021 18:24:39 GMT server nginx etag W/"b4859602671de98d7897be7cd874456c" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id ar3mxwNRWFmSSqrfz33gJE6K_UJvYWUz via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control no-cache access-control-allow-credentials true content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id rDVGS8o6lN01qeJPU3buCoZ7A6JYpw-KDXbT_ha89RS4FLXPSbC-gQ==
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.4.1/	86 KB 31 KB	49ms 13ms	Script text/javascript	142.250.186.138 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.138 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f10.1e100.net Software sffe / Resource Hash 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 13 Oct 2021 19:30:38 GMT content-encoding gzip x-content-type-options nosniff age 199824 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30774 x-xss-protection 0 last-modified Mon, 13 May 2019 14:37:17 GMT server sffe vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="hosted-libraries-pushers" expires Thu, 13 Oct 2022 19:30:38 GMT
GET H2	200	css2 fonts.googleapis.com/	9 KB 830 B	24ms 24ms	Stylesheet text/css	142.250.186.42 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Source+Sans+Pro:wght@300;400;600;700&display=swap Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.42 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s04-in-f10.1e100.net Software ESF / Resource Hash 2ce628395376a2e6978400c6ae017defeb1423c4c458ec3f02de01d187beecd0 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Sat, 16 Oct 2021 01:55:46 GMT server ESF date Sat, 16 Oct 2021 03:01:02 GMT x-frame-options SAMEORIGIN report-to {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin cross-origin-opener-policy-report-only same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU" expires Sat, 16 Oct 2021 03:01:02 GMT
GET H2	200	wp-embed.min.js Show response redcanary.com/wp-includes/js/	1 KB 1016 B	120ms 119ms	Script application/javascript	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-includes/js/wp-embed.min.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers :path /wp-includes/js/wp-embed.min.js pragma no-cache cookie _biz_uid=4d37cf7d42174c3eeca41e9ba4c84084; _biz_sid=571098; _biz_nA=1; _biz_pendingA=%5B%22m%2Fipv%3F_biz_r%3D%26_biz_h%3D-1906410348%26_biz_u%3D4d37cf7d42174c3eeca41e9ba4c84084%26_biz_s%3D571098%26_biz_l%3Dhttps%253A%252F%252Fredcanary.com%252Fblog%252Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%252F%26_biz_t%3D1634353262216%26_biz_i%3Dnull%26_biz_n%3D0%26a%3Dredcanary.com%26rnd%3D534195%22%5D accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority redcanary.com referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT content-encoding br last-modified Tue, 26 Jan 2021 15:18:33 GMT server nginx etag W/"601032c9-592" vary Accept-Encoding Accept-Encoding Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000
GET H2	200	autoptimize_dc334f7536f5e5cc403e87e0367c562c.js Show response redcanary.com/wp-content/cache/autoptimize/js/	279 KB 80 KB	135ms 135ms	Script application/javascript	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/cache/autoptimize/js/autoptimize_dc334f7536f5e5cc403e87e0367c562c.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 39936c2d55f12f137593792439014e4d6e0bb78af150548fef48fb25139d24a5 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers :path /wp-content/cache/autoptimize/js/autoptimize_dc334f7536f5e5cc403e87e0367c562c.js pragma no-cache cookie _biz_uid=4d37cf7d42174c3eeca41e9ba4c84084; _biz_sid=571098; _biz_nA=1; _biz_pendingA=%5B%22m%2Fipv%3F_biz_r%3D%26_biz_h%3D-1906410348%26_biz_u%3D4d37cf7d42174c3eeca41e9ba4c84084%26_biz_s%3D571098%26_biz_l%3Dhttps%253A%252F%252Fredcanary.com%252Fblog%252Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%252F%26_biz_t%3D1634353262216%26_biz_i%3Dnull%26_biz_n%3D0%26a%3Dredcanary.com%26rnd%3D534195%22%5D accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority redcanary.com referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT content-encoding br last-modified Thu, 07 Oct 2021 20:24:50 GMT server nginx etag W/"615f5792-45b9a" vary Accept-Encoding Accept-Encoding Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000
GET H2	200	SmartForms.js Show response sfc.leadspace.com/	3 KB 3 KB	32ms 7ms	Script application/javascript	35.190.114.154 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://sfc.leadspace.com/SmartForms.js Requested by Host: ajax.googleapis.com URL: https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.190.114.154 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 154.114.190.35.bc.googleusercontent.com Software UploadServer / Resource Hash 0645386b306fc6a2e7a59f44e38fb44e53c519a4ba0f0701e0caa07e9ab601d6 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 02:12:10 GMT age 2932 x-guploader-uploadid ADPycdttmczSEc-w5H-BQyEz8H89qw0L-PgNrap9eBNkgwEZJvTehlpwwUXrPNiAXtF8DmVt2GOyatJW4MDuqdQ-bw x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity alt-svc clear content-length 2718 last-modified Sun, 30 May 2021 06:36:45 GMT server UploadServer etag "557a04d61944100c7badd3f08c3e0fd3" strict-transport-security max-age=31536000 x-goog-hash crc32c=6Pcn1A==, md5=VXoE1hlEEAx7rdPwjD4P0w== x-goog-generation 1622356605704395 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=3600 x-goog-stored-content-length 2718 accept-ranges bytes content-type application/javascript expires Sat, 16 Oct 2021 03:12:10 GMT
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5de2ebfe321cc3b353aa22e923fde9cbc2e266cf6309a9b3185c2c0c6b98600b Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c677eb73148157a4ec4d0a2795b7a9728e940f1af8b2ebdaf0c04bb0fe78c519 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash bbf5dd16a1072e7928a65f0a37dc0d41bd517ed908c7c86df49e9b9089d52d1f Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	bullet-square.svg redcanary.com/wp-content/themes/redcanary/assets/img/	443 B 574 B	194ms 193ms	Image image/svg+xml	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/bullet-square.svg Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 6217f642930c0d2411329fb00cf9a7e2e138a98f56eece6e82b3a7359f20cb11 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers :path /wp-content/themes/redcanary/assets/img/bullet-square.svg pragma no-cache cookie _biz_uid=4d37cf7d42174c3eeca41e9ba4c84084; _biz_sid=571098; _biz_nA=1; _biz_pendingA=%5B%22m%2Fipv%3F_biz_r%3D%26_biz_h%3D-1906410348%26_biz_u%3D4d37cf7d42174c3eeca41e9ba4c84084%26_biz_s%3D571098%26_biz_l%3Dhttps%253A%252F%252Fredcanary.com%252Fblog%252Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%252F%26_biz_t%3D1634353262216%26_biz_i%3Dnull%26_biz_n%3D0%26a%3Dredcanary.com%26rnd%3D534195%22%5D accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority redcanary.com referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT content-encoding br last-modified Mon, 23 Aug 2021 16:46:07 GMT server nginx etag W/"6123d0cf-1bb" vary Accept-Encoding Accept-Encoding Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000
GET H2	200	6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2 fonts.gstatic.com/s/sourcesanspro/v14/	16 KB 16 KB	30ms 7ms	Font font/woff2	142.250.184.227 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.227 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s12-in-f3.1e100.net Software sffe / Resource Hash a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://redcanary.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sun, 10 Oct 2021 11:16:30 GMT x-content-type-options nosniff age 488672 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 16112 x-xss-protection 0 last-modified Tue, 15 Sep 2020 18:10:09 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Mon, 10 Oct 2022 11:16:30 GMT
GET H2	200	6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2 fonts.gstatic.com/s/sourcesanspro/v14/	15 KB 16 KB	35ms 12ms	Font font/woff2	142.250.184.227 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.227 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s12-in-f3.1e100.net Software sffe / Resource Hash 24f7e397faec79e62c37ff2f00b170f6dc1557fb46ac169f9f1897a9d641dd03 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://redcanary.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sun, 10 Oct 2021 14:38:52 GMT x-content-type-options nosniff age 476530 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15764 x-xss-protection 0 last-modified Tue, 15 Sep 2020 18:10:17 GMT server sffe content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Mon, 10 Oct 2022 14:38:52 GMT
GET H2	200	6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu.woff2 fonts.gstatic.com/s/sourcesanspro/v14/	16 KB 16 KB	38ms 15ms	Font font/woff2	142.250.184.227 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.227 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s12-in-f3.1e100.net Software sffe / Resource Hash f3d7092e6eb6f3aa0c572e52e061a59cc88a3e9eff581c95c4bd7456800904d0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://redcanary.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sun, 10 Oct 2021 11:16:53 GMT x-content-type-options nosniff age 488649 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 16064 x-xss-protection 0 last-modified Tue, 15 Sep 2020 18:09:56 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Mon, 10 Oct 2022 11:16:53 GMT
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/160/	11 KB 5 KB	7ms 7ms	Script application/x-javascript	104.111.234.67 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/160/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/munchkin.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-234-67.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 99fa5a280296b5fc7b63433ee121a359fc68c4a37f04a87d363e751164b96ff1 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sat, 16 Oct 2021 03:01:02 GMT Content-Encoding gzip Last-Modified Fri, 19 Feb 2021 02:54:38 GMT Server AkamaiNetStorage ETag "19a9335fd71267d56e65bc19390f3100:1613703278.138281" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Cache-Control max-age=8640000 Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 4811 Expires Mon, 24 Jan 2022 03:01:02 GMT
GET H2	200	360de60f-3edb-4ca3-a55f-a3762adf8653.js Show response sfc.leadspace.com/	14 KB 14 KB	134ms 134ms	Script text/javascript	35.190.114.154 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://sfc.leadspace.com/360de60f-3edb-4ca3-a55f-a3762adf8653.js Requested by Host: sfc.leadspace.com URL: https://sfc.leadspace.com/SmartForms.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.190.114.154 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 154.114.190.35.bc.googleusercontent.com Software UploadServer / Resource Hash 51dd4b0f7d9e586d92bc38614e9c97601a184b9062b3cc43da00bf69e8ab39a2 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT age 0 x-guploader-uploadid ADPycdv5ldWbh6N-QHctr4ELg0oPrp0nXIF0HLOvh94F2BjQNfofPTQC_eo2OCS_BF6v6tK--Bi0e3PcKCyKIjxvh_w x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity alt-svc clear content-length 14348 last-modified Wed, 25 Aug 2021 20:41:42 GMT server UploadServer etag "cf568eaa22b6e0a7bc7eef8807c003d6" strict-transport-security max-age=31536000 x-goog-hash crc32c=cJsKSw==, md5=z1aOqiK24Ke8fu+IB8AD1g== x-goog-generation 1629924102366899 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=3600 x-goog-stored-content-length 14348 accept-ranges bytes content-type text/javascript expires Sat, 16 Oct 2021 04:01:02 GMT
GET H2	200	getForm Show response resource.redcanary.com/index.php/form/	9 KB 2 KB	484ms 483ms	Script application/javascript	104.17.72.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/index.php/form/getForm?munchkinId=003-YRU-314&form=1034&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&callback=jQuery112406094105795563955_1634353262538&_=1634353262539 Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4d2b80abec1e263902297d4ece5e6e78e9f989f4917879e53a512a5def3e9eaa Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:03 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cf-ray 69ee0a52faadf9e2-PRG cached false
GET H2	200	globe-white-right.png redcanary.com/wp-content/themes/redcanary/assets/img/	259 KB 260 KB	133ms 133ms	Image image/png	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/globe-white-right.png Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash d3d589e680bc49f54cb5721723fc2ec1a68d5e8ce3946db7192fb0d207e9b6cf Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers :path /wp-content/themes/redcanary/assets/img/globe-white-right.png pragma no-cache cookie _biz_uid=4d37cf7d42174c3eeca41e9ba4c84084; _biz_sid=571098; _biz_nA=1; _biz_pendingA=%5B%22m%2Fipv%3F_biz_r%3D%26_biz_h%3D-1906410348%26_biz_u%3D4d37cf7d42174c3eeca41e9ba4c84084%26_biz_s%3D571098%26_biz_l%3Dhttps%253A%252F%252Fredcanary.com%252Fblog%252Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%252F%26_biz_t%3D1634353262216%26_biz_i%3Dnull%26_biz_n%3D0%26a%3Dredcanary.com%26rnd%3D534195%22%5D accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority redcanary.com referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT last-modified Wed, 27 Feb 2019 15:51:11 GMT server nginx etag "5c76b1ef-40da2" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000 accept-ranges bytes content-length 265634
GET H2	200	search-btn.svg redcanary.com/wp-content/themes/redcanary/assets/img/	161 B 411 B	122ms 122ms	Image image/svg+xml	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/search-btn.svg Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 0f57969cdf0d61b86fc25ded8a8c5058a5edd346d1845b232610a54f08d0fcb8 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers :path /wp-content/themes/redcanary/assets/img/search-btn.svg pragma no-cache cookie _biz_uid=4d37cf7d42174c3eeca41e9ba4c84084; _biz_sid=571098; _biz_nA=1; _biz_pendingA=%5B%22m%2Fipv%3F_biz_r%3D%26_biz_h%3D-1906410348%26_biz_u%3D4d37cf7d42174c3eeca41e9ba4c84084%26_biz_s%3D571098%26_biz_l%3Dhttps%253A%252F%252Fredcanary.com%252Fblog%252Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%252F%26_biz_t%3D1634353262216%26_biz_i%3Dnull%26_biz_n%3D0%26a%3Dredcanary.com%26rnd%3D534195%22%5D accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority redcanary.com referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT content-encoding br last-modified Wed, 08 Sep 2021 23:08:04 GMT server nginx etag W/"61394254-a1" vary Accept-Encoding Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000
GET H2	200	getForm Show response resource.redcanary.com/index.php/form/	30 KB 6 KB	69ms 68ms	Script application/javascript	104.17.72.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/index.php/form/getForm?munchkinId=003-YRU-314&form=1664&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&callback=jQuery112406094105795563955_1634353262540&_=1634353262541 Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f33fb8520c85e0d3517cc55c74825ff60d55236bae22f3b8155d612bdadead29 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT content-encoding gzip server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript; charset=utf-8 cf-ray 69ee0a531abbf9e2-PRG cached true
POST H/1.1	200 OK	visitWebPage 003-yru-314.mktoresp.com/webevents/	2 B 311 B	732ms 162ms	Ping text/plain	192.28.147.68 OMNITURE
General Check archive.org Show headers Download Go to Full URL https://003-yru-314.mktoresp.com/webevents/visitWebPage?_mchNc=1634353262571&_mchCn=&_mchId=003-YRU-314&_mchTk=_mch-redcanary.com-1634353262571-98975&_mchHo=redcanary.com&_mchPo=&_mchRu=%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&_mchPc=https%3A&_mchVr=160&_mchEcid=&_mchHa=&_mchRe=&_mchQp= Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/160/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.28.147.68 , United States, ASN15224 (OMNITURE, US), Reverse DNS Software nginx / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers Referer https://redcanary.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Date Sat, 16 Oct 2021 03:01:03 GMT Content-Encoding gzip Server nginx Transfer-Encoding chunked Content-Type text/plain; charset=UTF-8 Access-Control-Allow-Origin * Connection keep-alive X-Request-Id db622e97-be27-4e57-8636-cdbf1a3a9208
POST H2	204	collect www.google-analytics.com/g/	0 366 B	36ms 13ms	Ping text/plain	142.250.185.142 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/g/collect?v=2&tid=G-T3K4MTNQJN&gtm=2oead0&_p=240183180&sr=1600x1200&ul=en-us&cid=196332420.1634353263&_s=1&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&dt=It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies&sid=1634353262&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.142 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s50-in-f14.1e100.net Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://redcanary.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers pragma no-cache date Sat, 16 Oct 2021 03:01:02 GMT server Golfe2 content-type text/plain access-control-allow-origin https://redcanary.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	uwt.js Show response static.ads-twitter.com/	14 KB 6 KB	23ms 6ms	Script application/javascript	199.232.136.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.136.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT content-encoding gzip last-modified Mon, 20 Sep 2021 23:58:10 GMT etag "8dc11b7ca1d5ed9ec3b1ab1beb621c75+gzip+gzip" vary Accept-Encoding,Host x-tw-cdn FT p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" x-tw-geo-cc_and_ra DE-BB cache-control no-cache x-cache HIT, HIT accept-ranges bytes content-type application/javascript; charset=utf-8 content-length 5410 x-served-by cache-iad-kcgs7200175-IAD, cache-hhn11559-HHN
GET H/1.1	200 OK	insight.min.js Show response snap.licdn.com/li.lms-analytics/	5 KB 2 KB	26ms 7ms	Script application/x-javascript	2.16.186.10 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2.16.186.10 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-186-10.deploy.static.akamaitechnologies.com Software / Resource Hash fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sat, 16 Oct 2021 03:01:02 GMT Content-Encoding gzip Last-Modified Wed, 29 Sep 2021 19:17:49 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=66794 Connection keep-alive Accept-Ranges bytes Content-Length 2036
GET H2	200	pixel.js Show response www.redditstatic.com/ads/	22 KB 7 KB	32ms 6ms	Script application/javascript	151.101.193.140 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.redditstatic.com/ads/pixel.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.193.140 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 7125a66456daa35dd3e3e8cca4b9523e05caf0b4fa5bd5874676e7c6db40f3aa Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT via 1.1 varnish, 1.1 varnish last-modified Wed, 14 Jul 2021 17:50:00 GMT server snooserv etag "912f60c72fda50b2f21068c65115175d" vary Accept-Encoding,Origin content-type application/javascript cache-control public, max-age=60 accept-ranges bytes content-encoding gzip content-length 7018
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/	37 KB 15 KB	42ms 17ms	Script text/javascript	172.217.23.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.23.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS mil04s23-in-f2.1e100.net Software cafe / Resource Hash 0b52dc3851559db81b5517ed0d7f0ae732f1f758f09834c62d09c02189ca2155 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14435 x-xss-protection 0 server cafe etag 3499052782129861849 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Sat, 16 Oct 2021 03:01:02 GMT
GET H2	200	bat.js Show response bat.bing.com/	34 KB 10 KB	89ms 48ms	Script application/javascript	204.79.197.200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 204.79.197.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS a-0001.a-msedge.net Software / Resource Hash d891455e32c9a425e36e190047b1f58abeb7e3709eff687134ddea7ac9cfdd3b Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT content-encoding gzip last-modified Wed, 06 Oct 2021 19:11:47 GMT x-msedge-ref Ref A: FACB7368772A4DFBADCB6A6601C14C7B Ref B: PRG01EDGE0821 Ref C: 2021-10-16T03:01:02Z etag "805b72e6bad71:0" vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript access-control-allow-origin * cache-control private,max-age=1800 accept-ranges bytes content-length 10001
GET H2	200	ga.js Show response ssl.google-analytics.com/	45 KB 17 KB	30ms 6ms	Script text/javascript	142.250.185.232 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ssl.google-analytics.com/ga.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.232 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f8.1e100.net Software Golfe2 / Resource Hash 1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Wed, 13 Oct 2021 16:38:54 GMT server Golfe2 age 215 date Sat, 16 Oct 2021 02:57:27 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 17168 expires Sat, 16 Oct 2021 04:57:27 GMT
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	98 KB 26 KB	22ms 7ms	Script application/x-javascript	157.240.20.19 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 157.240.20.19 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS xx-fbcdn-shv-02-frt3.fbcdn.net Software / Resource Hash 4b5e988359c30afd1d84b7a5118296f1fc33f4527d530b096ca27aa7fbfef99a Security Headers Name Value Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 25969 x-xss-protection 0 pragma public x-fb-debug Lx1X4bmnl2kDb99J6vIkDFI8PgXx6fbhWTJ6k2lAW23BuueW7s6neh0eJatfobgpRqiJaDjld4WQOVL8AyjP1Q== x-fb-trip-id 2050670934 x-frame-options DENY date Sat, 16 Oct 2021 03:01:02 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 x-fb-rlafr 0 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H/1.1	200 OK	getuidj Show response secure.adnxs.com/	11 B 689 B	43ms 12ms	XHR application/json	185.33.220.100 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.17.9 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Pragma no-cache Date Sat, 16 Oct 2021 03:01:02 GMT X-Proxy-Origin 216.131.114.13; 216.131.114.13; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com AN-X-Request-Uuid 00db58e0-be4b-4cad-bdd2-eedb155d2951 Server nginx/1.17.9 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://redcanary.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 11 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H/1.1	200 OK	/ Show response c.6sc.co/	47 B 369 B	29ms 7ms	XHR text/plain	104.111.233.140 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-140.deploy.static.akamaitechnologies.com Software / Resource Hash 52267232f7ad29ea9eb109034537983b4f0a215c9d50678c83e768fea3753b23 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sat, 16 Oct 2021 03:01:02 GMT Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type text/plain Access-Control-Allow-Origin https://redcanary.com Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Content-Length 47
GET H/1.1	200 OK	getuidj Show response secure.adnxs.com/	11 B 689 B	41ms 12ms	XHR application/json	185.33.220.100 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.17.9 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Pragma no-cache Date Sat, 16 Oct 2021 03:01:02 GMT X-Proxy-Origin 216.131.114.13; 216.131.114.13; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com AN-X-Request-Uuid fe538406-488f-45a5-873c-44bf4cbe4ddd Server nginx/1.17.9 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://redcanary.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 11 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H/1.1	200 OK	/ Show response c.6sc.co/	47 B 369 B	27ms 6ms	XHR text/plain	104.111.233.140 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-140.deploy.static.akamaitechnologies.com Software / Resource Hash 52267232f7ad29ea9eb109034537983b4f0a215c9d50678c83e768fea3753b23 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sat, 16 Oct 2021 03:01:02 GMT Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type text/plain Access-Control-Allow-Origin https://redcanary.com Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Content-Length 47
GET H2	200	forms2.css resource.redcanary.com/js/forms2/css/	13 KB 3 KB	187ms 186ms	Stylesheet text/css	104.17.72.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/css/forms2.css Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status REVALIDATED last-modified Tue, 10 Aug 2021 17:41:08 GMT server cloudflare etag "2ca0082-3437-5c93801bbf500" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css cache-control public, max-age=14400 accept-ranges bytes cf-ray 69ee0a539adef9e2-PRG content-length 2623 expires Sat, 16 Oct 2021 07:01:02 GMT
GET H2	200	forms2-theme-plain.css resource.redcanary.com/js/forms2/css/	828 B 332 B	204ms 203ms	Stylesheet text/css	104.17.72.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/css/forms2-theme-plain.css Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status REVALIDATED last-modified Tue, 10 Aug 2021 17:41:08 GMT server cloudflare etag "308075d-33c-5c93801bbf500" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css cache-control public, max-age=14400 accept-ranges bytes cf-ray 69ee0a539adff9e2-PRG content-length 246 expires Sat, 16 Oct 2021 07:01:02 GMT
GET H2	200	adsct Show response analytics.twitter.com/i/	31 B 657 B	136ms 119ms	Script application/javascript	104.244.42.131 TWITTER
General Check archive.org Show headers Download Go to Full URL https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o015g&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=580624ad-c155-48c4-946d-aa7fe29be479&tw_document_href=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&tpx_cb=twttr.conversion.loadPixels Requested by Host: static.ads-twitter.com URL: https://static.ads-twitter.com/uwt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.131 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf Security Headers Name Value Strict-Transport-Security max-age=631138519 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT content-encoding gzip x-content-type-options nosniff p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" status 200 OK x-twitter-response-tags BouncerCompliant content-length 57 x-xss-protection 0 pragma no-cache last-modified Sat, 16 Oct 2021 03:01:02 GMT server tsa_o x-frame-options SAMEORIGIN strict-transport-security max-age=631138519 content-type application/javascript;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash 38f6f2a151a13f04a155fcc60c1e62f19c83b9b9b98a662a4fde30020b755dd1 x-transaction 328389345c97f23f expires Tue, 31 Mar 1981 05:00:00 GMT
GET H2	200	adsct t.co/i/	43 B 454 B	134ms 117ms	Image image/gif	104.244.42.5 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o015g&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=580624ad-c155-48c4-946d-aa7fe29be479&tw_document_href=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.5 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT content-encoding gzip x-content-type-options nosniff status 200 OK x-twitter-response-tags BouncerCompliant content-length 65 x-xss-protection 0 pragma no-cache last-modified Sat, 16 Oct 2021 03:01:02 GMT server tsa_o x-frame-options SAMEORIGIN strict-transport-security max-age=0 content-type image/gif;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash 87eee1c997e9899b9ea91b46b2c4196fde78e60a1f937f3c9ec417bc87e6791e x-transaction 54cf7e356e7aad6e expires Tue, 31 Mar 1981 05:00:00 GMT
GET H2	200	collect px.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1634353262654&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1634353262654%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fblog... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1634353262654&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&liSync=true	0 81 B	136ms 136ms	Image application/javascript	108.174.11.69 LINKEDIN
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1634353262654&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&liSync=true Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.174.11.69 , United States, ASN14413 (LINKEDIN, US), Reverse DNS 108-174-11-69.fwd.linkedin.com Software Play / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:03 GMT server Play linkedin-action 1 x-li-fabric prod-ltx1 x-li-proto http/2 x-li-pop prod-eda6 content-type application/javascript content-length 0 x-li-uuid Od7dQKJjrhYwdKEYjisAAA== Redirect headers strict-transport-security max-age=31536000 x-content-type-options nosniff linkedin-action 1 x-cache CONFIG_NOCACHE content-length 0 x-li-uuid AAXOb4Wv+gNXkyYDD5yi1A== pragma no-cache x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 54256DA873BC4A39AE0323B40EDF1065 Ref B: PRG01EDGE0805 Ref C: 2021-10-16T03:01:03Z date Sat, 16 Oct 2021 03:01:03 GMT expect-ct max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct" x-frame-options sameorigin x-li-fabric prod-ltx1 location https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1634353262654&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&liSync=true cache-control no-cache, no-store content-security-policy default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri /security/csp?f=l x-li-proto http/2 expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	200	rp.gif alb.reddit.com/	42 B 125 B	138ms 118ms	Image image/gif	151.101.1.140 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://alb.reddit.com/rp.gif?ts=1634353262658&id=t2_5kac730w&event=PageVisit&m.itemCount=&m.value=&m.currency=&m.transactionId=&m.customEventName=&uuid=ea000cb0-7453-41bd-9b1d-11e1205a04f4&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_a797b96e Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.1.140 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT via 1.1 varnish server Varnish accept-ranges bytes content-length 42 retry-after 0 content-type image/gif
GET H2	200	ga-audiences www.google.com/ads/ Redirect Chain https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=849207035&utmhn=redcanary.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=It%E2%8... https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-52702906-1&cid=196332420.1634353263&jid=1773262821&_v=5.7.2&z=849207035 https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-52702906-1&cid=196332420.1634353263&jid=1773262821&_v=5.7.2&z=849207035	42 B 522 B	40ms 18ms	Image image/gif	216.58.212.164 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-52702906-1&cid=196332420.1634353263&jid=1773262821&_v=5.7.2&z=849207035 Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.212.164 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS ams15s22-in-f164.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Sat, 16 Oct 2021 03:01:02 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Sat, 16 Oct 2021 03:01:02 GMT location https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-52702906-1&cid=196332420.1634353263&jid=1773262821&_v=5.7.2&z=849207035 content-type text/html; charset=UTF-8 access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 367 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	sf5.js Show response sfc.leadspace.com/	193 KB 194 KB	8ms 8ms	Script application/javascript	35.190.114.154 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://sfc.leadspace.com/sf5.js Requested by Host: sfc.leadspace.com URL: https://sfc.leadspace.com/SmartForms.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.190.114.154 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 154.114.190.35.bc.googleusercontent.com Software UploadServer / Resource Hash cc94e55155661db6998eab90f7aff21dbfdc5ea25a4e0b397f31ce9ad48dceda Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 02:32:19 GMT age 1723 x-guploader-uploadid ADPycdt_YQebdZ-Py1qSvES2uLzFeLwVIOYAa15AjxHtEEmQ4o4OiPetpjSBZEGOrgmB_kHhyNiBkmPMlMDzI24e_YEKilZSyQ x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity alt-svc clear content-length 198138 last-modified Sun, 30 May 2021 06:36:45 GMT server UploadServer etag "5fdbd3e7c66bb82260a9333ec336418b" strict-transport-security max-age=31536000 x-goog-hash crc32c=US8pvA==, md5=X9vT58ZruCJgqTM+wzZBiw== x-goog-generation 1622356605283226 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=3600 x-goog-stored-content-length 198138 accept-ranges bytes content-type application/javascript expires Sat, 16 Oct 2021 03:32:19 GMT
GET H3	200	1042590016249604 Show response connect.facebook.net/signals/config/	490 KB 143 KB	70ms 63ms	Script application/x-javascript	157.240.20.19 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/1042590016249604?v=2.9.47&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.20.19 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS xx-fbcdn-shv-02-frt3.fbcdn.net Software / Resource Hash ad59862ba52fa92d60029ed5400dde0e26dfe7b4f3ea37ea395aa0730f1d0937 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 x-xss-protection 0 pragma public x-fb-debug d4fWheguBws8PbVsxOG+qb8eUWwJ/t9Euh9dptEmzs2ro6JvhMCqZG93TceoMSlHRFB3ymHhoT8mqLyxdzigcQ== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Sat, 16 Oct 2021 03:01:02 GMT strict-transport-security max-age=31536000; preload; includeSubDomains report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-fb-rlafr 0 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	ipv cdn.bizible.com/m/	43 B 203 B	8ms 7ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=4d37cf7d42174c3eeca41e9ba4c84084&_biz_s=571098&_biz_l=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&_biz_t=1634353262216&_biz_i=null&_biz_n=0&a=redcanary.com&rnd=534195&cdn_o=a&_biz_z=1634353262691 Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6739) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Sat, 16 Oct 2021 03:01:02 GMT last-modified Thu, 14 Oct 2021 01:06:59 GMT server ECS (frb/6739) age 179643 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" cache-control no-cache, no-store accept-ranges bytes content-type Image/GIF content-length 43 expires -1
GET H2	200	u cdn.bizibly.com/	43 B 303 B	7ms 6ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizibly.com/u?_biz_u=4d37cf7d42174c3eeca41e9ba4c84084&_biz_s=571098&_biz_l=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&_biz_t=1634353262693&_biz_i=It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies&a=redcanary.com&rnd=547840&cdn_o=a&_biz_z=1634353262693 Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67C2) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Sat, 16 Oct 2021 03:01:02 GMT last-modified Thu, 14 Oct 2021 23:57:07 GMT server ECS (frb/67C2) age 97436 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" cache-control no-cache, no-store accept-ranges bytes content-type Image/GIF content-length 43 expires -1
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/	2 KB 2 KB	64ms 27ms	Script text/javascript	142.250.186.162 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/?random=1634353262697&cv=9&fst=1634353262697&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgad0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&tiba=It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.162 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f2.1e100.net Software cafe / Resource Hash 84f3d571d03a5982c81f0750414938e366495de8768ea8c2670a57de51752ac2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Sat, 16 Oct 2021 03:01:02 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1052 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	x.svg redcanary.com/wp-content/themes/redcanary/assets/img/	548 B 646 B	125ms 125ms	Image image/svg+xml	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/x.svg Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash fa88de55ea55bea66f8f19898817e50b08ed956d9c288f9b52f90df76ab655d3 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers :path /wp-content/themes/redcanary/assets/img/x.svg pragma no-cache cookie _biz_uid=4d37cf7d42174c3eeca41e9ba4c84084; _biz_sid=571098; _mkto_trk=id:003-YRU-314&token:_mch-redcanary.com-1634353262571-98975; _ga_T3K4MTNQJN=GS1.1.1634353262.1.0.1634353262.0; _ga=GA1.1.196332420.1634353263; _gcl_au=1.1.788086203.1634353263; _gd_svisitor=64bb1002ce1e00006e406a61fc01000085a73c00; _rdt_uuid=1634353262658.ea000cb0-7453-41bd-9b1d-11e1205a04f4; __utma=111991431.196332420.1634353263.1634353263.1634353263.1; __utmc=111991431; __utmz=111991431.1634353263.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt_UA-52702906-1=1; __utmb=111991431.1.10.1634353263; _an_uid=0; _biz_nA=2; _biz_pendingA=%5B%22m%2Fipv%3F_biz_r%3D%26_biz_h%3D-1906410348%26_biz_u%3D4d37cf7d42174c3eeca41e9ba4c84084%26_biz_s%3D571098%26_biz_l%3Dhttps%253A%252F%252Fredcanary.com%252Fblog%252Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%252F%26_biz_t%3D1634353262216%26_biz_i%3Dnull%26_biz_n%3D0%26a%3Dredcanary.com%26rnd%3D534195%22%2C%22m%2Fu%3FmapType%3Dmkto%26mapValue%3Did%253A003-YRU-314%2526token%253A_mch-redcanary.com-1634353262571-98975%26_biz_u%3D4d37cf7d42174c3eeca41e9ba4c84084%26_biz_s%3D571098%26_biz_l%3Dhttps%253A%252F%252Fredcanary.com%252Fblog%252Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%252F%26_biz_t%3D1634353262694%26_biz_i%3DIt%25E2%2580%2599s%2520all%2520fun%2520and%2520games%2520until%2520ransomware%2520deletes%2520the%2520shadow%2520copies%26_biz_n%3D1%26a%3Dredcanary.com%26rnd%3D857025%22%5D; _biz_flagsA=%7B%22Version%22%3A1%2C%22Mkto%22%3A%221%22%7D accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority redcanary.com referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT content-encoding br last-modified Mon, 23 Aug 2021 16:46:07 GMT server nginx etag W/"6123d0cf-224" vary Accept-Encoding Accept-Encoding Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000
GET H2	200	cta-background.jpg redcanary.com/wp-content/uploads/2018/12/	7 KB 7 KB	122ms 120ms	Image image/jpeg	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2018/12/cta-background.jpg Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash ecf6782eee74878f85da64d073a0707c4965f712d7eec6926ea4c9151228e100 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers :path /wp-content/uploads/2018/12/cta-background.jpg pragma no-cache cookie _biz_uid=4d37cf7d42174c3eeca41e9ba4c84084; _biz_sid=571098; _mkto_trk=id:003-YRU-314&token:_mch-redcanary.com-1634353262571-98975; _ga_T3K4MTNQJN=GS1.1.1634353262.1.0.1634353262.0; _ga=GA1.1.196332420.1634353263; _gcl_au=1.1.788086203.1634353263; _gd_svisitor=64bb1002ce1e00006e406a61fc01000085a73c00; _rdt_uuid=1634353262658.ea000cb0-7453-41bd-9b1d-11e1205a04f4; __utma=111991431.196332420.1634353263.1634353263.1634353263.1; __utmc=111991431; __utmz=111991431.1634353263.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt_UA-52702906-1=1; __utmb=111991431.1.10.1634353263; _an_uid=0; _biz_nA=2; _biz_pendingA=%5B%22m%2Fipv%3F_biz_r%3D%26_biz_h%3D-1906410348%26_biz_u%3D4d37cf7d42174c3eeca41e9ba4c84084%26_biz_s%3D571098%26_biz_l%3Dhttps%253A%252F%252Fredcanary.com%252Fblog%252Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%252F%26_biz_t%3D1634353262216%26_biz_i%3Dnull%26_biz_n%3D0%26a%3Dredcanary.com%26rnd%3D534195%22%2C%22m%2Fu%3FmapType%3Dmkto%26mapValue%3Did%253A003-YRU-314%2526token%253A_mch-redcanary.com-1634353262571-98975%26_biz_u%3D4d37cf7d42174c3eeca41e9ba4c84084%26_biz_s%3D571098%26_biz_l%3Dhttps%253A%252F%252Fredcanary.com%252Fblog%252Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%252F%26_biz_t%3D1634353262694%26_biz_i%3DIt%25E2%2580%2599s%2520all%2520fun%2520and%2520games%2520until%2520ransomware%2520deletes%2520the%2520shadow%2520copies%26_biz_n%3D1%26a%3Dredcanary.com%26rnd%3D857025%22%5D; _biz_flagsA=%7B%22Version%22%3A1%2C%22Mkto%22%3A%221%22%7D; cookielawinfo-checkbox-necessary=yes; cookielawinfo-checkbox-non-necessary=yes accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority redcanary.com referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT last-modified Mon, 09 Nov 2020 21:51:33 GMT server nginx etag "5fa9b9e5-1a18" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000 accept-ranges bytes content-length 6680
GET H2	200	Forrester-Wave-Featured-Nav-13.jpg redcanary.com/wp-content/uploads/2021/04/	72 KB 72 KB	122ms 120ms	Image image/jpeg	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2021/04/Forrester-Wave-Featured-Nav-13.jpg Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash a91510843d20a6601374a6ccf9285f945f081c40b32326a46e0e42aaac29cc4f Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers :path /wp-content/uploads/2021/04/Forrester-Wave-Featured-Nav-13.jpg pragma no-cache cookie _biz_uid=4d37cf7d42174c3eeca41e9ba4c84084; _biz_sid=571098; _mkto_trk=id:003-YRU-314&token:_mch-redcanary.com-1634353262571-98975; _ga_T3K4MTNQJN=GS1.1.1634353262.1.0.1634353262.0; _ga=GA1.1.196332420.1634353263; _gcl_au=1.1.788086203.1634353263; _gd_svisitor=64bb1002ce1e00006e406a61fc01000085a73c00; _rdt_uuid=1634353262658.ea000cb0-7453-41bd-9b1d-11e1205a04f4; __utma=111991431.196332420.1634353263.1634353263.1634353263.1; __utmc=111991431; __utmz=111991431.1634353263.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt_UA-52702906-1=1; __utmb=111991431.1.10.1634353263; _an_uid=0; _biz_nA=2; _biz_pendingA=%5B%22m%2Fipv%3F_biz_r%3D%26_biz_h%3D-1906410348%26_biz_u%3D4d37cf7d42174c3eeca41e9ba4c84084%26_biz_s%3D571098%26_biz_l%3Dhttps%253A%252F%252Fredcanary.com%252Fblog%252Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%252F%26_biz_t%3D1634353262216%26_biz_i%3Dnull%26_biz_n%3D0%26a%3Dredcanary.com%26rnd%3D534195%22%2C%22m%2Fu%3FmapType%3Dmkto%26mapValue%3Did%253A003-YRU-314%2526token%253A_mch-redcanary.com-1634353262571-98975%26_biz_u%3D4d37cf7d42174c3eeca41e9ba4c84084%26_biz_s%3D571098%26_biz_l%3Dhttps%253A%252F%252Fredcanary.com%252Fblog%252Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%252F%26_biz_t%3D1634353262694%26_biz_i%3DIt%25E2%2580%2599s%2520all%2520fun%2520and%2520games%2520until%2520ransomware%2520deletes%2520the%2520shadow%2520copies%26_biz_n%3D1%26a%3Dredcanary.com%26rnd%3D857025%22%5D; _biz_flagsA=%7B%22Version%22%3A1%2C%22Mkto%22%3A%221%22%7D; cookielawinfo-checkbox-necessary=yes; cookielawinfo-checkbox-non-necessary=yes accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority redcanary.com referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT last-modified Wed, 14 Apr 2021 01:25:14 GMT server nginx etag "6076447a-11ffd" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000 accept-ranges bytes content-length 73725
GET H2	200	Threat-Detection-Square-1954-975x975.jpg redcanary.com/wp-content/uploads/2019/08/	47 KB 47 KB	147ms 146ms	Image image/jpeg	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2019/08/Threat-Detection-Square-1954-975x975.jpg Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 8aecb83292d56a0084fbb59b72a4706c59a65f90ed786db2544403cb93066ba8 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers :path /wp-content/uploads/2019/08/Threat-Detection-Square-1954-975x975.jpg pragma no-cache cookie _biz_uid=4d37cf7d42174c3eeca41e9ba4c84084; _biz_sid=571098; _mkto_trk=id:003-YRU-314&token:_mch-redcanary.com-1634353262571-98975; _ga_T3K4MTNQJN=GS1.1.1634353262.1.0.1634353262.0; _ga=GA1.1.196332420.1634353263; _gcl_au=1.1.788086203.1634353263; _gd_svisitor=64bb1002ce1e00006e406a61fc01000085a73c00; _rdt_uuid=1634353262658.ea000cb0-7453-41bd-9b1d-11e1205a04f4; __utma=111991431.196332420.1634353263.1634353263.1634353263.1; __utmc=111991431; __utmz=111991431.1634353263.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt_UA-52702906-1=1; __utmb=111991431.1.10.1634353263; _an_uid=0; _biz_nA=2; _biz_pendingA=%5B%22m%2Fipv%3F_biz_r%3D%26_biz_h%3D-1906410348%26_biz_u%3D4d37cf7d42174c3eeca41e9ba4c84084%26_biz_s%3D571098%26_biz_l%3Dhttps%253A%252F%252Fredcanary.com%252Fblog%252Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%252F%26_biz_t%3D1634353262216%26_biz_i%3Dnull%26_biz_n%3D0%26a%3Dredcanary.com%26rnd%3D534195%22%2C%22m%2Fu%3FmapType%3Dmkto%26mapValue%3Did%253A003-YRU-314%2526token%253A_mch-redcanary.com-1634353262571-98975%26_biz_u%3D4d37cf7d42174c3eeca41e9ba4c84084%26_biz_s%3D571098%26_biz_l%3Dhttps%253A%252F%252Fredcanary.com%252Fblog%252Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%252F%26_biz_t%3D1634353262694%26_biz_i%3DIt%25E2%2580%2599s%2520all%2520fun%2520and%2520games%2520until%2520ransomware%2520deletes%2520the%2520shadow%2520copies%26_biz_n%3D1%26a%3Dredcanary.com%26rnd%3D857025%22%5D; _biz_flagsA=%7B%22Version%22%3A1%2C%22Mkto%22%3A%221%22%7D; cookielawinfo-checkbox-necessary=yes; cookielawinfo-checkbox-non-necessary=yes accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority redcanary.com referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT last-modified Mon, 09 Nov 2020 21:33:18 GMT server nginx etag "5fa9b59e-bad0" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000 accept-ranges bytes content-length 47824
GET H2	200	Tony-500x500.jpg redcanary.com/wp-content/uploads/2019/06/	38 KB 38 KB	147ms 146ms	Image image/jpeg	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2019/06/Tony-500x500.jpg Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 4932426c8682c7d9546d24e9d6b4b2d61168a70baecb158c983ca05b7a67523c Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers :path /wp-content/uploads/2019/06/Tony-500x500.jpg pragma no-cache cookie _biz_uid=4d37cf7d42174c3eeca41e9ba4c84084; _biz_sid=571098; _mkto_trk=id:003-YRU-314&token:_mch-redcanary.com-1634353262571-98975; _ga_T3K4MTNQJN=GS1.1.1634353262.1.0.1634353262.0; _ga=GA1.1.196332420.1634353263; _gcl_au=1.1.788086203.1634353263; _gd_svisitor=64bb1002ce1e00006e406a61fc01000085a73c00; _rdt_uuid=1634353262658.ea000cb0-7453-41bd-9b1d-11e1205a04f4; __utma=111991431.196332420.1634353263.1634353263.1634353263.1; __utmc=111991431; __utmz=111991431.1634353263.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt_UA-52702906-1=1; __utmb=111991431.1.10.1634353263; _an_uid=0; _biz_nA=2; _biz_pendingA=%5B%22m%2Fipv%3F_biz_r%3D%26_biz_h%3D-1906410348%26_biz_u%3D4d37cf7d42174c3eeca41e9ba4c84084%26_biz_s%3D571098%26_biz_l%3Dhttps%253A%252F%252Fredcanary.com%252Fblog%252Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%252F%26_biz_t%3D1634353262216%26_biz_i%3Dnull%26_biz_n%3D0%26a%3Dredcanary.com%26rnd%3D534195%22%2C%22m%2Fu%3FmapType%3Dmkto%26mapValue%3Did%253A003-YRU-314%2526token%253A_mch-redcanary.com-1634353262571-98975%26_biz_u%3D4d37cf7d42174c3eeca41e9ba4c84084%26_biz_s%3D571098%26_biz_l%3Dhttps%253A%252F%252Fredcanary.com%252Fblog%252Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%252F%26_biz_t%3D1634353262694%26_biz_i%3DIt%25E2%2580%2599s%2520all%2520fun%2520and%2520games%2520until%2520ransomware%2520deletes%2520the%2520shadow%2520copies%26_biz_n%3D1%26a%3Dredcanary.com%26rnd%3D857025%22%5D; _biz_flagsA=%7B%22Version%22%3A1%2C%22Mkto%22%3A%221%22%7D; cookielawinfo-checkbox-necessary=yes; cookielawinfo-checkbox-non-necessary=yes accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority redcanary.com referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT last-modified Mon, 09 Nov 2020 21:36:01 GMT server nginx etag "5fa9b641-9775" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000 accept-ranges bytes content-length 38773
GET H2	200	Brian-Donohue.jpg redcanary.com/wp-content/uploads/2019/02/	19 KB 19 KB	147ms 146ms	Image image/jpeg	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2019/02/Brian-Donohue.jpg Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 819a9261cf87ff4ca13e08fbbb3e84e7827ea409869fc3d87b75bd8224bbd41d Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers :path /wp-content/uploads/2019/02/Brian-Donohue.jpg pragma no-cache cookie _biz_uid=4d37cf7d42174c3eeca41e9ba4c84084; _biz_sid=571098; _mkto_trk=id:003-YRU-314&token:_mch-redcanary.com-1634353262571-98975; _ga_T3K4MTNQJN=GS1.1.1634353262.1.0.1634353262.0; _ga=GA1.1.196332420.1634353263; _gcl_au=1.1.788086203.1634353263; _gd_svisitor=64bb1002ce1e00006e406a61fc01000085a73c00; _rdt_uuid=1634353262658.ea000cb0-7453-41bd-9b1d-11e1205a04f4; __utma=111991431.196332420.1634353263.1634353263.1634353263.1; __utmc=111991431; __utmz=111991431.1634353263.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt_UA-52702906-1=1; __utmb=111991431.1.10.1634353263; _an_uid=0; _biz_nA=2; _biz_pendingA=%5B%22m%2Fipv%3F_biz_r%3D%26_biz_h%3D-1906410348%26_biz_u%3D4d37cf7d42174c3eeca41e9ba4c84084%26_biz_s%3D571098%26_biz_l%3Dhttps%253A%252F%252Fredcanary.com%252Fblog%252Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%252F%26_biz_t%3D1634353262216%26_biz_i%3Dnull%26_biz_n%3D0%26a%3Dredcanary.com%26rnd%3D534195%22%2C%22m%2Fu%3FmapType%3Dmkto%26mapValue%3Did%253A003-YRU-314%2526token%253A_mch-redcanary.com-1634353262571-98975%26_biz_u%3D4d37cf7d42174c3eeca41e9ba4c84084%26_biz_s%3D571098%26_biz_l%3Dhttps%253A%252F%252Fredcanary.com%252Fblog%252Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%252F%26_biz_t%3D1634353262694%26_biz_i%3DIt%25E2%2580%2599s%2520all%2520fun%2520and%2520games%2520until%2520ransomware%2520deletes%2520the%2520shadow%2520copies%26_biz_n%3D1%26a%3Dredcanary.com%26rnd%3D857025%22%5D; _biz_flagsA=%7B%22Version%22%3A1%2C%22Mkto%22%3A%221%22%7D; cookielawinfo-checkbox-necessary=yes; cookielawinfo-checkbox-non-necessary=yes accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority redcanary.com referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT last-modified Mon, 09 Nov 2020 21:47:50 GMT server nginx etag "5fa9b906-4ad4" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000 accept-ranges bytes content-length 19156
GET H2	200	xdc.js Show response cdn.bizible.com/	116 B 522 B	118ms 117ms	Script text/javascript	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/xdc.js?_biz_u=4d37cf7d42174c3eeca41e9ba4c84084&_biz_h=-1906410348&cdn_o=a&jsVer=4.21.06.25&a=redcanary.com Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6711) / Resource Hash 221d29a2b9d46d0b5b8a279484845f44ebdeb1c784ec10e7f17fc0f01d6208cd Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT content-encoding gzip server ECS (frb/6711) etag DF32F722 vary Accept-Encoding p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" cache-control private, must-revalidate, max-age=21600 content-type text/javascript; charset=utf-8 content-length 217
GET H3	200	css fonts.googleapis.com/	2 KB 520 B	16ms 16ms	Stylesheet text/css	142.250.186.42 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Raleway Requested by Host: client URL: about:client Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.42 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s04-in-f10.1e100.net Software ESF / Resource Hash f2961ef025e9598bbc17229d642d373a9eb7feaa927ac1149a1bfc546d31caed Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Sat, 16 Oct 2021 01:39:54 GMT server ESF date Sat, 16 Oct 2021 03:01:02 GMT x-frame-options SAMEORIGIN report-to {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin cross-origin-opener-policy-report-only same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU" expires Sat, 16 Oct 2021 03:01:02 GMT
POST H/1.1	200 OK	match Show response sfgw.leadspace.com/ip/	132 B 1 KB	162ms 162ms	XHR application/json	34.74.199.185 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://sfgw.leadspace.com/ip/match Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 34.74.199.185 North Charleston, United States, ASN15169 (GOOGLE, US), Reverse DNS 185.199.74.34.bc.googleusercontent.com Software Prod / Resource Hash 1abe33ee98f4114acdff83c295bc9cfa8ed069cc386243d2115701dbe8506bbb Security Headers Name Value Content-Security-Policy default-src 'self'; script-src 'unsafe-inline' https://*.leadspace.com https://www.gstatic.com https://www.googletagmanager.com https://www.google-analytics.com https://*.aptrinsic.com; img-src www.google-analytics.com https://*.leadspace.com https://*.aptrinsic.com; connect-src https://*.leadspace.com wss://*.leadspace.com https://*.aptrinsic.com; frame-src https://*.leadspace.com; style-src 'unsafe-inline' https://*.leadspace.com https://fonts.googleapis.com; style-src-elem 'unsafe-inline' https://*.leadspace.com https://*.aptrinsic.com; frame-ancestors https://*.leadspace.com Strict-Transport-Security max-age=31530000; includeSubdomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept application/json Referer https://redcanary.com/ Authorization 360de60f-3edb-4ca3-a55f-a3762adf8653 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type application/json Response headers date Sat, 16 Oct 2021 03:01:03 GMT referrer-policy no-referrer server Prod vary Origin,Access-Control-Request-Method,Access-Control-Request-Headers,Origin content-type application/json access-control-allow-origin https://redcanary.com x-xss-protection 1; mode=block access-control-allow-credentials true content-security-policy default-src 'self'; script-src 'unsafe-inline' https://*.leadspace.com https://www.gstatic.com https://www.googletagmanager.com https://www.google-analytics.com https://*.aptrinsic.com; img-src www.google-analytics.com https://*.leadspace.com https://*.aptrinsic.com; connect-src https://*.leadspace.com wss://*.leadspace.com https://*.aptrinsic.com; frame-src https://*.leadspace.com; style-src 'unsafe-inline' https://*.leadspace.com https://fonts.googleapis.com; style-src-elem 'unsafe-inline' https://*.leadspace.com https://*.aptrinsic.com; frame-ancestors https://*.leadspace.com strict-transport-security max-age=31530000; includeSubdomains content-length 132 x-content-type-options nosniff
OPTIONS H/1.1	200 OK	match sfgw.leadspace.com/ip/ Frame	0 0	647ms 209ms	Preflight	34.74.199.185 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://sfgw.leadspace.com/ip/match Protocol HTTP/1.1 Server 34.74.199.185 North Charleston, United States, ASN15169 (GOOGLE, US), Reverse DNS 185.199.74.34.bc.googleusercontent.com Software Prod / Resource Hash Security Headers Name Value Content-Security-Policy default-src 'self'; script-src 'unsafe-inline' https://*.leadspace.com https://www.gstatic.com https://www.googletagmanager.com https://www.google-analytics.com https://*.aptrinsic.com; img-src www.google-analytics.com https://*.leadspace.com https://*.aptrinsic.com; connect-src https://*.leadspace.com wss://*.leadspace.com https://*.aptrinsic.com; frame-src https://*.leadspace.com; style-src 'unsafe-inline' https://*.leadspace.com https://fonts.googleapis.com; style-src-elem 'unsafe-inline' https://*.leadspace.com https://*.aptrinsic.com; frame-ancestors https://*.leadspace.com Strict-Transport-Security max-age=31530000; includeSubdomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://redcanary.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode cors Response headers vary Origin,Access-Control-Request-Method,Access-Control-Request-Headers access-control-allow-origin https://redcanary.com access-control-allow-methods POST access-control-allow-headers authorization, content-type access-control-allow-credentials true access-control-max-age 1800 allow GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH content-length 0 date Sat, 16 Oct 2021 03:01:03 GMT server Prod content-security-policy default-src 'self'; script-src 'unsafe-inline' https://*.leadspace.com https://www.gstatic.com https://www.googletagmanager.com https://www.google-analytics.com https://*.aptrinsic.com; img-src www.google-analytics.com https://*.leadspace.com https://*.aptrinsic.com; connect-src https://*.leadspace.com wss://*.leadspace.com https://*.aptrinsic.com; frame-src https://*.leadspace.com; style-src 'unsafe-inline' https://*.leadspace.com https://fonts.googleapis.com; style-src-elem 'unsafe-inline' https://*.leadspace.com https://*.aptrinsic.com; frame-ancestors https://*.leadspace.com x-xss-protection 1; mode=block x-content-type-options nosniff referrer-policy no-referrer strict-transport-security max-age=31530000; includeSubdomains
GET H2	204	56383426.js Show response bat.bing.com/p/action/	0 128 B	51ms 51ms	Script text/plain	204.79.197.200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/56383426.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 204.79.197.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS a-0001.a-msedge.net Software / ARR/3.0 Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers access-control-allow-origin * date Sat, 16 Oct 2021 03:01:02 GMT cache-control private,max-age=86400 x-msedge-ref Ref A: 932EADDBE7F24645B3E96920ACEE9860 Ref B: PRG01EDGE0821 Ref C: 2021-10-16T03:01:02Z x-powered-by ARR/3.0 x-cache CONFIG_NOCACHE
GET H2	204	0 bat.bing.com/action/	0 149 B	51ms 50ms	Image text/plain	204.79.197.200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=56383426&tm=gtm002&Ver=2&mid=7c3ba0c1-66e5-48f9-b42b-017afa90f12b&sid=4c2da4702e2d11ec8bba535575d303cb&vid=4c2dc9402e2d11ecb773471e87147a02&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies&p=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&r=&lt=1168&evt=pageLoad&msclkid=N&sv=1&rn=489851 Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 204.79.197.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS a-0001.a-msedge.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers access-control-allow-origin * pragma no-cache date Sat, 16 Oct 2021 03:01:02 GMT cache-control no-cache, must-revalidate x-msedge-ref Ref A: 3467993474454282B39721656D5C3836 Ref B: PRG01EDGE0821 Ref C: 2021-10-16T03:01:02Z x-cache CONFIG_NOCACHE expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	u cdn.bizible.com/m/	43 B 120 B	6ms 6ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/m/u?mapType=mkto&mapValue=id%3A003-YRU-314%26token%3A_mch-redcanary.com-1634353262571-98975&_biz_u=4d37cf7d42174c3eeca41e9ba4c84084&_biz_s=571098&_biz_l=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&_biz_t=1634353262694&_biz_i=It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies&_biz_n=1&a=redcanary.com&rnd=857025&cdn_o=a&_biz_z=1634353262828 Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6776) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Sat, 16 Oct 2021 03:01:02 GMT last-modified Thu, 14 Oct 2021 23:58:36 GMT server ECS (frb/6776) age 97346 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" cache-control no-cache, no-store accept-ranges bytes content-type Image/GIF content-length 43 expires -1
GET H2	200	/ www.google.com/pagead/1p-user-list/759876114/	42 B 154 B	39ms 19ms	Image image/gif	216.58.212.164 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/759876114/?random=1634353262697&cv=9&fst=1634353200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgad0&sendb=1&frm=0&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&tiba=It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies&async=1&fmt=3&is_vtc=1&random=909059007&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.212.164 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS ams15s22-in-f164.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Sat, 16 Oct 2021 03:01:02 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	44 B 313 B	23ms 6ms	Image image/gif	157.240.20.35 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=1042590016249604&ev=PageView&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&rl=&if=false&ts=1634353262852&sw=1600&sh=1200&v=2.9.47&r=stable&ec=0&o=30&fbp=fb.1.1634353262851.1334049541&it=1634353262676&coo=false&rqm=GET Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 157.240.20.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS edge-star-mini-shv-02-frt3.facebook.com Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 44 expires Sat, 16 Oct 2021 03:01:02 GMT
GET H2	200	select-arrow-dark.svg redcanary.com/wp-content/themes/redcanary/assets/img/	513 B 625 B	145ms 145ms	Image image/svg+xml	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/select-arrow-dark.svg Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 3f91c89509ab3616612e079305566ea04991f4c63e5899192df1820407aaf0a7 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers :path /wp-content/themes/redcanary/assets/img/select-arrow-dark.svg pragma no-cache cookie _biz_uid=4d37cf7d42174c3eeca41e9ba4c84084; _biz_sid=571098; _mkto_trk=id:003-YRU-314&token:_mch-redcanary.com-1634353262571-98975; _ga_T3K4MTNQJN=GS1.1.1634353262.1.0.1634353262.0; _ga=GA1.1.196332420.1634353263; _gcl_au=1.1.788086203.1634353263; _gd_svisitor=64bb1002ce1e00006e406a61fc01000085a73c00; _rdt_uuid=1634353262658.ea000cb0-7453-41bd-9b1d-11e1205a04f4; __utma=111991431.196332420.1634353263.1634353263.1634353263.1; __utmc=111991431; __utmz=111991431.1634353263.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt_UA-52702906-1=1; __utmb=111991431.1.10.1634353263; _an_uid=0; _biz_nA=2; cookielawinfo-checkbox-necessary=yes; cookielawinfo-checkbox-non-necessary=yes; _uetsid=4c2da4702e2d11ec8bba535575d303cb; _uetvid=4c2dc9402e2d11ecb773471e87147a02; _fbp=fb.1.1634353262851.1334049541; _biz_pendingA=%5B%5D; _biz_flagsA=%7B%22Version%22%3A1%2C%22Mkto%22%3A%221%22%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%7D accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority redcanary.com referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT content-encoding br last-modified Mon, 15 Mar 2021 14:30:44 GMT server nginx etag W/"604f6f94-201" vary Accept-Encoding Accept-Encoding Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000
GET H2	200	form_checkbox_normal.svg redcanary.com/wp-content/themes/redcanary/assets/img/	477 B 591 B	141ms 140ms	Image image/svg+xml	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/form_checkbox_normal.svg Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 814134e04a63caad8feeaeb95b36ba945aa3c200fa309efc4076e476ff267b98 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers :path /wp-content/themes/redcanary/assets/img/form_checkbox_normal.svg pragma no-cache cookie _biz_uid=4d37cf7d42174c3eeca41e9ba4c84084; _biz_sid=571098; _mkto_trk=id:003-YRU-314&token:_mch-redcanary.com-1634353262571-98975; _ga_T3K4MTNQJN=GS1.1.1634353262.1.0.1634353262.0; _ga=GA1.1.196332420.1634353263; _gcl_au=1.1.788086203.1634353263; _gd_svisitor=64bb1002ce1e00006e406a61fc01000085a73c00; _rdt_uuid=1634353262658.ea000cb0-7453-41bd-9b1d-11e1205a04f4; __utma=111991431.196332420.1634353263.1634353263.1634353263.1; __utmc=111991431; __utmz=111991431.1634353263.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt_UA-52702906-1=1; __utmb=111991431.1.10.1634353263; _an_uid=0; _biz_nA=2; cookielawinfo-checkbox-necessary=yes; cookielawinfo-checkbox-non-necessary=yes; _uetsid=4c2da4702e2d11ec8bba535575d303cb; _uetvid=4c2dc9402e2d11ecb773471e87147a02; _fbp=fb.1.1634353262851.1334049541; _biz_pendingA=%5B%5D; _biz_flagsA=%7B%22Version%22%3A1%2C%22Mkto%22%3A%221%22%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%7D accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority redcanary.com referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT content-encoding br last-modified Mon, 19 Apr 2021 23:05:04 GMT server nginx etag W/"607e0ca0-1dd" vary Accept-Encoding Accept-Encoding Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000
GET H2	200	button-right-arrow-white.svg redcanary.com/wp-content/themes/redcanary/assets/img/	350 B 539 B	202ms 202ms	Image image/svg+xml	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/button-right-arrow-white.svg Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 8edbf02936f4bbda931a228bd84f7b668522af07f3dfc33b5caee429e7febb85 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers :path /wp-content/themes/redcanary/assets/img/button-right-arrow-white.svg pragma no-cache cookie _biz_uid=4d37cf7d42174c3eeca41e9ba4c84084; _biz_sid=571098; _mkto_trk=id:003-YRU-314&token:_mch-redcanary.com-1634353262571-98975; _ga_T3K4MTNQJN=GS1.1.1634353262.1.0.1634353262.0; _ga=GA1.1.196332420.1634353263; _gcl_au=1.1.788086203.1634353263; _gd_svisitor=64bb1002ce1e00006e406a61fc01000085a73c00; _rdt_uuid=1634353262658.ea000cb0-7453-41bd-9b1d-11e1205a04f4; __utma=111991431.196332420.1634353263.1634353263.1634353263.1; __utmc=111991431; __utmz=111991431.1634353263.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt_UA-52702906-1=1; __utmb=111991431.1.10.1634353263; _an_uid=0; _biz_nA=2; cookielawinfo-checkbox-necessary=yes; cookielawinfo-checkbox-non-necessary=yes; _uetsid=4c2da4702e2d11ec8bba535575d303cb; _uetvid=4c2dc9402e2d11ecb773471e87147a02; _fbp=fb.1.1634353262851.1334049541; _biz_pendingA=%5B%5D; _biz_flagsA=%7B%22Version%22%3A1%2C%22Mkto%22%3A%221%22%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%7D accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority redcanary.com referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:02 GMT content-encoding br last-modified Wed, 27 Feb 2019 15:51:05 GMT server nginx etag W/"5c76b1e9-15e" vary Accept-Encoding Accept-Encoding Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000
GET H2	200	XDFrame Show response resource.redcanary.com/index.php/form/ Frame CABD	2 KB 856 B	180ms 180ms	Document text/html	104.17.72.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/index.php/form/XDFrame Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1b12ee272c79786bc266207f27c98ed219d2090d0d605e9c7a9e71f2add176fa Security Headers Name Value X-Content-Type-Options nosniff Request headers :method GET :authority resource.redcanary.com :scheme https :path /index.php/form/XDFrame pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site same-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://redcanary.com/ accept-encoding gzip, deflate, br cookie _biz_uid=4d37cf7d42174c3eeca41e9ba4c84084; _biz_sid=571098; __cf_bm=q9UMryvmsl4FEe9FclJwlBjAeJExVCUxSnJ1.5kXrP8-1634353262-0-AXvY/Q3j1PORZbRcHhFTLpBIuOsYxT8j6VI8R01SB3RoWQQwm1m9pyOBZaL29TB+CJwXRhr/1jj7+pCDzKgkBUc=; _mkto_trk=id:003-YRU-314&token:_mch-redcanary.com-1634353262571-98975; _ga_T3K4MTNQJN=GS1.1.1634353262.1.0.1634353262.0; _ga=GA1.1.196332420.1634353263; _gcl_au=1.1.788086203.1634353263; _rdt_uuid=1634353262658.ea000cb0-7453-41bd-9b1d-11e1205a04f4; __utma=111991431.196332420.1634353263.1634353263.1634353263.1; __utmc=111991431; __utmz=111991431.1634353263.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt_UA-52702906-1=1; __utmb=111991431.1.10.1634353263; _biz_nA=2; _uetsid=4c2da4702e2d11ec8bba535575d303cb; _uetvid=4c2dc9402e2d11ecb773471e87147a02; _fbp=fb.1.1634353262851.1334049541; _biz_pendingA=%5B%5D; _biz_flagsA=%7B%22Version%22%3A1%2C%22Mkto%22%3A%221%22%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%7D Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ Response headers date Sat, 16 Oct 2021 03:01:03 GMT content-type text/html; charset=utf-8 cache-control max-age=3600 x-content-type-options nosniff vary Accept-Encoding set-cookie BIGipServersj28web-nginx-app_https=!a4TuZ5OcqW5eUpG7iv4ewrP5TPDRs80CaGwjy4OId0waYoKpGwp/2UZF8cPRJem2EeeId96ngexlCQ==;Path=/;Version=1;Secure;Httponly cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 69ee0a555be0f9e2-PRG content-encoding gzip
POST H2	200	admin-ajax.php Show response redcanary.com/wp-admin/	0 638 B	938ms 938ms	XHR text/html	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-admin/admin-ajax.php Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / WP Engine Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests upgrade-insecure-requests Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN deny X-Xss-Protection 1; mode=block Request headers sec-fetch-mode cors origin https://redcanary.com accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 sec-fetch-dest empty x-requested-with XMLHttpRequest cookie _biz_uid=4d37cf7d42174c3eeca41e9ba4c84084; _biz_sid=571098; _mkto_trk=id:003-YRU-314&token:_mch-redcanary.com-1634353262571-98975; _ga_T3K4MTNQJN=GS1.1.1634353262.1.0.1634353262.0; _ga=GA1.1.196332420.1634353263; _gcl_au=1.1.788086203.1634353263; _gd_svisitor=64bb1002ce1e00006e406a61fc01000085a73c00; _rdt_uuid=1634353262658.ea000cb0-7453-41bd-9b1d-11e1205a04f4; __utma=111991431.196332420.1634353263.1634353263.1634353263.1; __utmc=111991431; __utmz=111991431.1634353263.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt_UA-52702906-1=1; __utmb=111991431.1.10.1634353263; _an_uid=0; _biz_nA=2; cookielawinfo-checkbox-necessary=yes; cookielawinfo-checkbox-non-necessary=yes; _uetsid=4c2da4702e2d11ec8bba535575d303cb; _uetvid=4c2dc9402e2d11ecb773471e87147a02; _fbp=fb.1.1634353262851.1334049541; _biz_pendingA=%5B%5D; _biz_flagsA=%7B%22Version%22%3A1%2C%22Mkto%22%3A%221%22%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%7D content-length 90 :path /wp-admin/admin-ajax.php pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 content-type application/x-www-form-urlencoded; charset=UTF-8 accept */* cache-control no-cache :authority redcanary.com referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ :scheme https sec-fetch-site same-origin :method POST Accept */* Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ X-Requested-With XMLHttpRequest Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers content-security-policy upgrade-insecure-requests upgrade-insecure-requests x-content-type-options nosniff nosniff x-permitted-cross-domain-policies master-only x-powered-by WP Engine vary X-NR-SAMPLE-PERCENT,User-Agent content-length 0 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin strict-origin-when-cross-origin server nginx x-frame-options SAMEORIGIN deny date Sat, 16 Oct 2021 03:01:03 GMT strict-transport-security max-age=63072000 content-type text/html; charset=UTF-8 access-control-allow-origin https://redcanary.com cache-control no-cache, must-revalidate, max-age=0, no-store feature-policy microphone 'none'; geolocation 'none' access-control-allow-credentials true x-robots-tag noindex expires Wed, 11 Jan 1984 05:00:00 GMT
GET H2	200	9416.json Show response script.crazyegg.com/pages/data-scripts/0096/ Frame F79B	15 KB 2 KB	185ms 159ms	XHR application/json	104.19.147.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/data-scripts/0096/9416.json?t=1 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0096/9416.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 347b46aa15dd285183952da4dcca5601d178cc5e8b3a182048e42a55f94e32b5 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:03 GMT content-encoding gzip cf-cache-status MISS cf-ray 69ee0a559a37277c-PRG ce-version 11.1.351 content-length 2170 last-modified Sat, 16 Oct 2021 03:01:03 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/json access-control-allow-origin * access-control-expose-headers CE-Version cache-control public, max-age=300, s-maxage=1209600 accept-ranges bytes timing-allow-origin *
POST H2	200	admin-ajax.php Show response redcanary.com/wp-admin/	0 638 B	590ms 590ms	XHR text/html	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-admin/admin-ajax.php Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / WP Engine Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests upgrade-insecure-requests Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN deny X-Xss-Protection 1; mode=block Request headers sec-fetch-mode cors origin https://redcanary.com accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 sec-fetch-dest empty x-requested-with XMLHttpRequest cookie _biz_uid=4d37cf7d42174c3eeca41e9ba4c84084; _biz_sid=571098; _mkto_trk=id:003-YRU-314&token:_mch-redcanary.com-1634353262571-98975; _ga_T3K4MTNQJN=GS1.1.1634353262.1.0.1634353262.0; _ga=GA1.1.196332420.1634353263; _gcl_au=1.1.788086203.1634353263; _gd_svisitor=64bb1002ce1e00006e406a61fc01000085a73c00; _rdt_uuid=1634353262658.ea000cb0-7453-41bd-9b1d-11e1205a04f4; __utma=111991431.196332420.1634353263.1634353263.1634353263.1; __utmc=111991431; __utmz=111991431.1634353263.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt_UA-52702906-1=1; __utmb=111991431.1.10.1634353263; _an_uid=0; _biz_nA=2; cookielawinfo-checkbox-necessary=yes; cookielawinfo-checkbox-non-necessary=yes; _uetsid=4c2da4702e2d11ec8bba535575d303cb; _uetvid=4c2dc9402e2d11ecb773471e87147a02; _fbp=fb.1.1634353262851.1334049541; _biz_pendingA=%5B%5D; _biz_flagsA=%7B%22Version%22%3A1%2C%22Mkto%22%3A%221%22%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%7D content-length 90 :path /wp-admin/admin-ajax.php pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 content-type application/x-www-form-urlencoded; charset=UTF-8 accept */* cache-control no-cache :authority redcanary.com referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ :scheme https sec-fetch-site same-origin :method POST Accept */* Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ X-Requested-With XMLHttpRequest Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers content-security-policy upgrade-insecure-requests upgrade-insecure-requests x-content-type-options nosniff nosniff x-permitted-cross-domain-policies master-only x-powered-by WP Engine vary X-NR-SAMPLE-PERCENT,User-Agent content-length 0 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin strict-origin-when-cross-origin server nginx x-frame-options SAMEORIGIN deny date Sat, 16 Oct 2021 03:01:03 GMT strict-transport-security max-age=63072000 content-type text/html; charset=UTF-8 access-control-allow-origin https://redcanary.com cache-control no-cache, must-revalidate, max-age=0, no-store feature-policy microphone 'none'; geolocation 'none' access-control-allow-credentials true x-robots-tag noindex expires Wed, 11 Jan 1984 05:00:00 GMT
GET H2	200	forms2.min.js Show response resource.redcanary.com/js/forms2/js/ Frame CABD	205 KB 68 KB	26ms 26ms	Script application/x-javascript	104.17.72.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/js/forms2.min.js Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/index.php/form/XDFrame Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2689a0237a95cfd8135f8da3ac79c430e903f3c542f8b862f68141c84c348c43 Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://resource.redcanary.com/index.php/form/XDFrame User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:03 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT last-modified Tue, 10 Aug 2021 17:41:08 GMT server cloudflare age 1 etag "3080753-33210-5c93801bbf500" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=14400 cf-ray 69ee0a568c5cf9e2-PRG expires Sat, 16 Oct 2021 07:01:03 GMT
GET H2	200	11.1.351.js Show response script.crazyegg.com/pages/versioned/common-scripts/	67 KB 22 KB	20ms 20ms	Script text/javascript	104.19.147.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/versioned/common-scripts/11.1.351.js Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0096/9416.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash daab314890951d408604603cdd77b31b63ae2ca9cc3c313673ce259c1575f695 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers timing-allow-origin * date Sat, 16 Oct 2021 03:01:03 GMT content-encoding gzip cf-cache-status HIT last-modified Mon, 04 Oct 2021 04:51:34 GMT server cloudflare age 133293 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000, s-maxage=31536000 accept-ranges bytes cf-ray 69ee0a569f1c4137-PRG content-length 22342
GET H2	200	9416.json Show response script.crazyegg.com/pages/sampling-data-scripts/0096/ Frame F79B	160 B 211 B	143ms 143ms	XHR application/json	104.19.147.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/sampling-data-scripts/0096/9416.json?t=453987 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/11.1.351.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 46cd6dc51e00812ddb27f88989b651da1c44e0f016efd1fd0894a71bc9d5d6c1 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:03 GMT content-encoding gzip cf-cache-status MISS cf-ray 69ee0a56eae9277c-PRG ce-version 11.1.351 content-length 146 last-modified Sat, 16 Oct 2021 03:01:03 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/json access-control-allow-origin * access-control-expose-headers CE-Version cache-control public, max-age=300, s-maxage=1209600 accept-ranges bytes timing-allow-origin *
GET H2	200	clock Show response tracking.crazyegg.com/ Frame F79B	28 B 135 B	101ms 40ms	XHR text/plain	34.255.166.68 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tracking.crazyegg.com/clock?t=1634353263350 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/11.1.351.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.255.166.68 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-255-166-68.eu-west-1.compute.amazonaws.com Software awselb/2.0 / Resource Hash 0b1393a0442677666962148fa870ae682ae7f0297960d1b12f8e0a2bcb7f5f96 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers access-control-allow-origin * date Sat, 16 Oct 2021 03:01:03 GMT cache-control no-store server awselb/2.0 content-length 28 content-type text/plain
POST H3	200	/ Show response www.facebook.com/tr/ Frame 89C9	0 18 B	15ms 7ms	Document text/plain	157.240.20.35 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.20.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS edge-star-mini-shv-02-frt3.facebook.com Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers :method POST :authority www.facebook.com :scheme https :path /tr/ content-length 4961 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 origin https://redcanary.com content-type application/x-www-form-urlencoded user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://redcanary.com/ accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 Origin https://redcanary.com Content-Type application/x-www-form-urlencoded User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ Response headers content-type text/plain access-control-allow-origin https://redcanary.com access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin content-length 0 server proxygen-bolt alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 priority u=3,i date Sat, 16 Oct 2021 03:01:03 GMT
GET H2	200	core Show response js.driftt.com/ Frame 3154	2 KB 1 KB	112ms 111ms	Document text/html	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false Requested by Host: js.driftt.com URL: https://js.driftt.com/include/1634353500000/65zait4t5ws7.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 521921926a04902dc83bc64c8851a7ddefb7c0f8088cadded8539c5542236ad6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers :method GET :authority js.driftt.com :scheme https :path /core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://redcanary.com/ accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ Response headers content-type text/html; charset=utf-8 server nginx last-modified Fri, 15 Oct 2021 18:24:26 GMT x-amz-server-side-encryption AES256 x-amz-version-id B2S9DPOosWRsN4L9K3Q6ryjGnsZ1JHWQ access-control-allow-origin * access-control-allow-credentials true access-control-allow-methods GET, POST, OPTIONS access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip date Sat, 16 Oct 2021 03:01:03 GMT cache-control no-cache etag W/"72068842206cbcbd353397a8966303bd" vary Accept-Encoding x-cache RefreshHit from cloudfront via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) x-amz-cf-pop FRA53-C1 x-amz-cf-id eclJrzy75Hq_guLxpJ-5-251jZT4joaZYkOCsKJnCL_joY28XFp8Lg==
GET H2	200	chat Show response js.driftt.com/core/ Frame 4074	2 KB 1 KB	111ms 111ms	Document text/html	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 Requested by Host: js.driftt.com URL: https://js.driftt.com/include/1634353500000/65zait4t5ws7.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 521921926a04902dc83bc64c8851a7ddefb7c0f8088cadded8539c5542236ad6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers :method GET :authority js.driftt.com :scheme https :path /core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://redcanary.com/ accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ Response headers content-type text/html; charset=utf-8 server nginx last-modified Fri, 15 Oct 2021 18:24:26 GMT x-amz-server-side-encryption AES256 x-amz-version-id B2S9DPOosWRsN4L9K3Q6ryjGnsZ1JHWQ access-control-allow-origin * access-control-allow-credentials true access-control-allow-methods GET, POST, OPTIONS access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip date Sat, 16 Oct 2021 03:01:03 GMT cache-control no-cache etag W/"72068842206cbcbd353397a8966303bd" vary Accept-Encoding x-cache RefreshHit from cloudfront via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) x-amz-cf-pop FRA53-C1 x-amz-cf-id Rk7wwlU3E3hmKVWCPyRIrh_CX7z1hosMr33rhuXaadwV-IcWnaT1Rw==
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	217ms 178ms	Image image/gif	104.111.233.140 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=64bb1002ce1e00006e406a61fc01000085a73c00&session=a1d74e68-3aa8-4b27-8dde-f4c3bf304c82&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Sat%2C%2016%20Oct%202021%2003%3A01%3A02%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Adversaries%20used%20Vssadmin%20to%20delete%20shadow%20copies%20during%20a%202019%20ransomware%20incident%20involving%20Kaseya%20IT%20management%20software.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&pageViewId=d798da08-e9cd-4a33-8822-2b2895620754&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-140.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sat, 16 Oct 2021 03:01:03 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H3	200	analytics.js Show response www.google-analytics.com/	48 KB 19 KB	40ms 16ms	Script text/javascript	142.250.185.142 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.142 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s50-in-f14.1e100.net Software Golfe2 / Resource Hash fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Wed, 13 Oct 2021 16:38:54 GMT server Golfe2 age 846 date Sat, 16 Oct 2021 02:46:57 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 19747 expires Sat, 16 Oct 2021 04:46:57 GMT
GET H3	200	js Show response www.google-analytics.com/gtm/	102 KB 40 KB	40ms 40ms	Script application/javascript	142.250.185.142 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/gtm/js?id=GTM-KJTKFT3&t=gtm13&cid=196332420.1634353263 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.142 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s50-in-f14.1e100.net Software Google Tag Manager / Resource Hash db288cfcdd29e9a66db30f455b95ab18f670cd70ba54fd297fe5c73b11136163 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:03 GMT content-encoding br server Google Tag Manager access-control-allow-headers Cache-Control vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 40435 x-xss-protection 0 expires Sat, 16 Oct 2021 03:01:03 GMT
GET BLOB	200 OK	1c1e5af8-0431-4efe-883b-b189fb3ca165 https://redcanary.com/	218 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://redcanary.com/1c1e5af8-0431-4efe-883b-b189fb3ca165 Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash d5916e8ec7e52ac38c27502c20b1faf6303c163776ad63cc89543a56b03dbedc Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Length 218 Content-Type text/javascript
GET H2	200	runtime~main.4be7cc23.js Show response js.driftt.com/core/assets/js/ Frame 3154	6 KB 3 KB	8ms 7ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash c4de16b24a9c5c4843db67c3ddb161c1186e1772d6578928acf5eea34acea62d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false Origin https://js.driftt.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 15 Oct 2021 18:24:25 GMT content-encoding gzip age 30998 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 15 Oct 2021 18:19:52 GMT server nginx etag W/"3257e97b9ac90aa8112cc2c4d3236507" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id E4WXL8WAmYfZnFr.YD2NpOaPrjwXH3xx via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id eyrzkXef65NfKcBPQS___5FHku43r8m-4DmNMZRZ4DiApBLPjP32Kg==
GET H2	200	4.a93e53d9.chunk.js Show response js.driftt.com/core/assets/js/ Frame 3154	58 KB 20 KB	8ms 8ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/4.a93e53d9.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 58332a4cc75a697eafeb1b4d9cb66326d6a29acb2f98afc1de3f1ef2401be056 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false Origin https://js.driftt.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 06 Aug 2021 19:32:17 GMT content-encoding gzip age 6074926 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 06 Aug 2021 18:47:25 GMT server nginx etag W/"fce0b3daf28dfa888be2818f43b06ef0" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id imvxQz4ZQnCekVetyHrX84xCYV8ndGWZ via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id drDUiFb8ecCBqv6hImm2erHYQYmuV24XctoLAmfkYX4G6UJN1SOAbg==
GET H2	200	main~493df0b3.8459dd93.chunk.js Show response js.driftt.com/core/assets/js/ Frame 3154	6 KB 3 KB	9ms 8ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/main~493df0b3.8459dd93.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash dfe651af123c80d7afd3a8243cf537acde9992a349ba62cb56206608d14deb17 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false Origin https://js.driftt.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 11 Oct 2021 21:49:43 GMT content-encoding gzip age 364280 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 11 Oct 2021 21:20:02 GMT server nginx etag W/"3f2ae370e919f40c9c60bbcb707317ec" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id obLHKysmM4NvLnjyvTsb5_7Qf8tTA4ke via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id sLbYa2C4OrNoC1-IyJ15FuFjVhm8HDzlEZkIRcG9u0y7-oxsZaOaGg==
GET H2	200	runtime~main.4be7cc23.js Show response js.driftt.com/core/assets/js/ Frame 4074	6 KB 3 KB	9ms 8ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash c4de16b24a9c5c4843db67c3ddb161c1186e1772d6578928acf5eea34acea62d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 Origin https://js.driftt.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 15 Oct 2021 18:24:25 GMT content-encoding gzip age 30998 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 15 Oct 2021 18:19:52 GMT server nginx etag W/"3257e97b9ac90aa8112cc2c4d3236507" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id E4WXL8WAmYfZnFr.YD2NpOaPrjwXH3xx via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 1dqB1dpkBJqKXud4skio1flewWogk1LrdTcxEnh3MUxCe33LAZVRWg==
GET H2	200	4.a93e53d9.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4074	58 KB 20 KB	9ms 9ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/4.a93e53d9.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 58332a4cc75a697eafeb1b4d9cb66326d6a29acb2f98afc1de3f1ef2401be056 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 Origin https://js.driftt.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 06 Aug 2021 19:32:17 GMT content-encoding gzip age 6074926 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 06 Aug 2021 18:47:25 GMT server nginx etag W/"fce0b3daf28dfa888be2818f43b06ef0" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id imvxQz4ZQnCekVetyHrX84xCYV8ndGWZ via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id GTYuhhnn_pj95307MRN6pgoHInUNNYa9-PCC914olQvVa9SYRN_M3A==
GET H2	200	main~493df0b3.8459dd93.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4074	6 KB 3 KB	9ms 9ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/main~493df0b3.8459dd93.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash dfe651af123c80d7afd3a8243cf537acde9992a349ba62cb56206608d14deb17 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 Origin https://js.driftt.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 11 Oct 2021 21:49:43 GMT content-encoding gzip age 364280 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 11 Oct 2021 21:20:02 GMT server nginx etag W/"3f2ae370e919f40c9c60bbcb707317ec" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id obLHKysmM4NvLnjyvTsb5_7Qf8tTA4ke via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id TnDhG6CvIjRluN80iXGsXUQvkt--4Ab0ousKSHD8v3_ovJiIwNRrKQ==
POST H3	200	collect Show response www.google-analytics.com/j/	2 B 22 B	23ms 23ms	XHR text/plain	142.250.185.142 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j93&a=240183180&t=pageview&_s=1&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&ul=en-us&de=UTF-8&dt=It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&exp=vSjzpu4pRt2MCq0SqZcrow.0&_utma=111991431.196332420.1634353263.1634353263.1634353263.1&_utmz=111991431.1634353263.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)&_utmht=1634353263551&_u=aCDCAEADQAAAAC~&jid=869776149&gjid=188111711&cid=196332420.1634353263&tid=UA-52702906-1&_gid=2062854490.1634353263&_r=1&gtm=2wgad0PXWC8JW&cd18=AUGUST%2021%2C%202019&z=1527676787 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.142 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s50-in-f14.1e100.net Software Golfe2 / Resource Hash de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://redcanary.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Sat, 16 Oct 2021 03:01:03 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://redcanary.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	analytics.js Show response www.google-analytics.com/	48 KB 19 KB	16ms 16ms	Script text/javascript	142.250.185.142 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.142 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s50-in-f14.1e100.net Software Golfe2 / Resource Hash fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Wed, 13 Oct 2021 16:38:54 GMT server Golfe2 age 846 date Sat, 16 Oct 2021 02:46:57 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 19747 expires Sat, 16 Oct 2021 04:46:57 GMT
GET H2	200	details Show response epsilon.6sense.com/v3/company/	834 B 667 B	34ms 17ms	XHR application/json	3.67.149.147 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.67.149.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-67-149-147.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 252f465a8f625e1c105ecb78742e5dce04a9bd6b7088703c42b454a9320c8d34 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Referer https://redcanary.com/ Accept-Language de-DE,de;q=0.9 Authorization Token 5056c3929c3198270386ced81b434006bcef81be EpsilonCookie 64bb1002ce1e00006e406a61fc01000085a73c00 Response headers date Sat, 16 Oct 2021 03:01:03 GMT content-encoding gzip server nginx vary Accept-Encoding content-type application/json access-control-allow-origin https://redcanary.com access-control-allow-credentials true content-length 484
OPTIONS H2	200	details epsilon.6sense.com/v3/company/ Frame	0 0	50ms 7ms	Preflight	3.67.149.147 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Protocol H2 Server 3.67.149.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-67-149-147.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Method GET Access-Control-Request-Headers authorization,epsiloncookie Origin https://redcanary.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode cors Response headers date Sat, 16 Oct 2021 03:01:03 GMT server nginx access-control-allow-origin https://redcanary.com access-control-allow-credentials true access-control-max-age 1800 access-control-allow-methods OPTIONS,GET access-control-allow-headers authorization,epsiloncookie
GET H2	200	42.3b1c2441.chunk.js Show response js.driftt.com/core/assets/js/ Frame 3154	47 KB 14 KB	7ms 7ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 7727399fe5d8441829176e6a661b540efaac1680120a1d7fb1235e258d70770b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 27 Sep 2021 18:05:58 GMT content-encoding gzip age 1587305 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 27 Sep 2021 17:53:30 GMT server nginx etag W/"62fe06940598a98760a9eae46800ff59" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id .VUhmN0wteSIOoD7zf42Fx9jVTzQPjY_ via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id O8Rr-L2ziKAo_aXGy-WKpd7cnAPVfyYuiIoayaWZttSEvh5KjbUqKQ==
GET H2	200	17.cce21c2a.chunk.js Show response js.driftt.com/core/assets/js/ Frame 3154	44 KB 13 KB	11ms 11ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/17.cce21c2a.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash cda9b31d709444e003d3adbfbdec43f093e405b36841fde5c1d187e439585219 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 27 Sep 2021 18:05:58 GMT content-encoding gzip age 1587305 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 27 Sep 2021 17:53:29 GMT server nginx etag W/"565bf690dc82ce7e1f45c9647d892490" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id jEi2sT.oz2dMTnmIGznKkCTerYS6HNwY via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id YFvx1KJBLhePXrN8fvtWmXfQFFW-1Wo1uTaSl3r_0WmstBBlqGpq5g==
GET H2	200	35.3e4eba7e.chunk.js Show response js.driftt.com/core/assets/js/ Frame 3154	25 KB 8 KB	12ms 12ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/35.3e4eba7e.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 41f7afd6088c39cdc0d6f910f7f4b6afbf6a2133533847e960a8ca906fabc1c6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 23 Aug 2021 18:08:17 GMT content-encoding gzip age 4611166 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 23 Aug 2021 17:42:07 GMT server nginx etag W/"b1a0f364c9ad5137b5ab8e5237a825b8" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 1I09NUqlw54C3qTPS3eShOaQpBS5lcLu via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id PQ62Lm_xZMF5YMwHj3mzdQ2-M9-jyC8NjnxnNw6D9dpNH53BFeBdIA==
GET H2	200	15.8065fdbf.chunk.js Show response js.driftt.com/core/assets/js/ Frame 3154	16 KB 5 KB	12ms 12ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/15.8065fdbf.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash f978da291f493e64d4420d2cfab5c2bdc736c53f11c8d61c6da1efdb7df1155d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 06 Sep 2021 06:18:05 GMT content-encoding gzip age 3444178 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 03 Sep 2021 14:38:32 GMT server nginx etag W/"db60664de2c8d54d23e359c94e68f6ce" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id vLMtFICr__AmVbpyC1134yZVvjJr6q0Q via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id MBFcqnsPrDm30LhR3fSV0h_hVypoXC35ZVm8UDXHkB9jw3aZXKucDw==
GET H2	200	19.5937a5b2.chunk.js Show response js.driftt.com/core/assets/js/ Frame 3154	72 KB 22 KB	14ms 13ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/19.5937a5b2.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 2b4d9e531f3302ad49380ce5e5e160925956edb55179c63ee2bac32ab040d1a5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 14:52:30 GMT content-encoding gzip age 734913 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Thu, 07 Oct 2021 14:03:09 GMT server nginx etag W/"08aceb94bd26b0e431ca437d628e3c13" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id PpKcHacqpQIWv5LlWxshj7GW7ctXBTRY via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id LvbsyUo4OPGAdBeO132MSfx1MTBtj-rsVyZgqh6irtgWFa0NgAJmqQ==
GET H2	200	32.04864e7d.chunk.js Show response js.driftt.com/core/assets/js/ Frame 3154	16 KB 6 KB	14ms 13ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/32.04864e7d.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash af0ad47815cfcb0fc8402cf431dd782af68f2ba05752c66d9bb11a4354f65754 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 23 Aug 2021 18:08:17 GMT content-encoding gzip age 4611166 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 23 Aug 2021 17:42:07 GMT server nginx etag W/"3b6707d602c1f7d03c4c8b0bdecb8e4e" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id SPqSo.47y7907Wglh2zWsWSyACYHB_Zc via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id yTeXRy5Xb1Caz_XR_Kb7HqnkPavjE_sziSDrWNES_MPbKj0Y9iwsjg==
GET H2	200	23.a53d721f.chunk.js Show response js.driftt.com/core/assets/js/ Frame 3154	59 KB 19 KB	15ms 12ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/23.a53d721f.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash f48829864ffd155da0360e19be956282b6875173f8990394e93bc7c30c97a3ed Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 14:52:30 GMT content-encoding gzip age 734913 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Thu, 07 Oct 2021 14:03:10 GMT server nginx etag W/"fe96cb8c4c390342c29d3c8cb0a4ca14" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id v0Q3sUg3fAcXKBWqoZodUDobSoc9.NX8 via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id kaCFOxwvqxKFVznPxfMOMUp4RjiMaJSNYbk8hhLW9R-ODtR4UY_fUg==
GET H2	200	10.704ab67c.chunk.js Show response js.driftt.com/core/assets/js/ Frame 3154	91 KB 28 KB	19ms 14ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/10.704ab67c.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 1612e3d01a9389defe81c28b91ee18b7b1f97b54f39dd8aa651667c25bce28e2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 01 Oct 2021 20:47:44 GMT content-encoding gzip age 1231998 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 01 Oct 2021 18:06:47 GMT server nginx etag W/"50dcb170ca1ae1f4a09fe8f23065f2a8" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 8SLWCghXfnMEQiqJuVzEB4mWFfFgTeMA via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id Pm-X_cJwgagImMRrxvA6vz7V5uynTRZkWIHAnrr176lqJ32cc6UJAg==
GET H2	200	9.a48906f3.chunk.js Show response js.driftt.com/core/assets/js/ Frame 3154	23 KB 7 KB	19ms 14ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/9.a48906f3.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 5059bfed12587f496894f97319682ccb715e7748ae93dd2cafd6310e914f3870 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 04 Oct 2021 23:46:40 GMT content-encoding gzip age 962063 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 04 Oct 2021 13:21:54 GMT server nginx etag W/"60e5547ed381473c15e63274bcd796b6" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id cLY_oJezEuNHBH6Dj5RzDB2u5ynjzlwV via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id RFkY_Jl4s5KiTF-XNxh5o6QUx1G7Sg6kgUzvuIncFgOZw0mDuqi86w==
GET H2	200	13.c2156fc2.chunk.js Show response js.driftt.com/core/assets/js/ Frame 3154	62 KB 20 KB	20ms 17ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/13.c2156fc2.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash f94ce8666bf003756c16b56edad5a0121b3516222d4f093bdb771afabfb2cc5f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 11 Oct 2021 21:49:43 GMT content-encoding gzip age 364280 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 11 Oct 2021 21:20:00 GMT server nginx etag W/"b94404e76324bd4454531b2e0a54f7bb" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id dduSgTmTEeX.c1xrsh3Cd4WUJFtbN06M via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id EQRfMqkqUZI1w_ka09XDY4xmaIWSiW2zHqseuMzno64Xg0Jsk9VMVQ==
GET H2	200	40.01f4f7b3.chunk.js Show response js.driftt.com/core/assets/js/ Frame 3154	105 KB 34 KB	21ms 17ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/40.01f4f7b3.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 71f918c131027703d4692c7e7cc9d46fc09554fc2b211e60f12e8fea8360deb7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 23 Aug 2021 18:08:17 GMT content-encoding gzip age 4611166 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 23 Aug 2021 17:42:08 GMT server nginx etag W/"7dd9b27f83583b6d43567ed4b21eff8c" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 9jXV8w0bWzHPQtgsCAjrFrN9PLNAN.Ap via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id Eld5PqRwIkbD0_ZljMUCEzl-hIRMMxYoIepHvK65R_ktYdYwXNLSQA==
GET H2	200	33.c1910d43.chunk.js Show response js.driftt.com/core/assets/js/ Frame 3154	12 KB 4 KB	22ms 13ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/33.c1910d43.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash c2d8b5ed5baf711d51629607797e32e5ff638637a0091598427eac4908dbae47 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 23 Aug 2021 18:08:17 GMT content-encoding gzip age 4611166 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 23 Aug 2021 17:42:07 GMT server nginx etag W/"0e451f1cf9656229ccd33dfa3ad0638d" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id ocjv..MVaCaOGNo5kiC5l3ewWVKjMwbS via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id cZ95uob_FaHuRz_i2ubTsaQAsybFd9XaEawXoCrZG9KlpFED1vMb_g==
GET H2	200	25.b7a0bf53.chunk.js Show response js.driftt.com/core/assets/js/ Frame 3154	12 KB 5 KB	23ms 14ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/25.b7a0bf53.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash c87e0e31334c6998b90c83d48eff6252a248120d32b376414965e1421203c901 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 14:52:30 GMT content-encoding gzip age 734913 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Thu, 07 Oct 2021 14:03:10 GMT server nginx etag W/"808f7c7829001881a39cef6846a36ce0" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id _ix5iBb64na.L1JY7ymqDewgFGceFL7s via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id n0eg4rziqqe68qVXEcxeBFSn1B3AiDO1isTebt9P8qeJXlEZ0Gn50Q==
GET H2	200	16.fab21cf4.chunk.js Show response js.driftt.com/core/assets/js/ Frame 3154	17 KB 7 KB	23ms 14ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/16.fab21cf4.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash fa110ac06915e913fea0ad440e557cd75b95101504acc6a865efb5d7f0f34d95 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 23 Aug 2021 18:08:17 GMT content-encoding gzip age 4611166 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 23 Aug 2021 17:42:07 GMT server nginx etag W/"b451093ecfaa012f364641010ed13346" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id mlbxReFt8YmdLvOZ4ChXgFfj8NP88809 via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id kx_7HUo-sExqf2YL5YXmqxJSStbz3yzmU4TGuX2WS5Y7avzW7pcOKg==
GET H2	200	7.38935f56.chunk.css js.driftt.com/core/assets/css/ Frame 3154	11 KB 3 KB	21ms 13ms	Stylesheet text/css	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/7.38935f56.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash f26c0c1b5c55945acc42f4005ae66cffa78a4efea9bb8c70cdac7b7ac47bcdfa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 14:52:30 GMT content-encoding gzip age 734913 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Thu, 07 Oct 2021 14:03:08 GMT server nginx etag W/"7a6a7594668eccfb02737897caf09023" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id F91xsNgZaccVv_sq2ZDhhPCusQtrocgc via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id MJAdDc_xGSQcq8Ne4si8olrk1I8c0uNPu-ddKxpR4R-Ol3SWorhaWQ==
GET H2	200	7.1d6e970f.chunk.js Show response js.driftt.com/core/assets/js/ Frame 3154	68 KB 21 KB	23ms 15ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/7.1d6e970f.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 5ea8a248ef99b55232fbb5e0cfd96c94502ec5b9c5ddef1e1799054a1fc7c926 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 15 Oct 2021 16:40:38 GMT content-encoding gzip age 37225 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 15 Oct 2021 16:24:35 GMT server nginx etag W/"eb3dcdfae00cf40d131b3359b6770e1d" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id CcsJrUq_IW4ieYyH..76HAoFLGjY3L4g via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 3E4WkOJihACeR1U0sw9NvrBvvxjlkrNAjsvTQYVEVsOgCXvmjlbCzQ==
GET H2	200	14.22abfce0.chunk.css js.driftt.com/core/assets/css/ Frame 3154	24 B 666 B	21ms 13ms	Stylesheet text/css	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/14.22abfce0.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 06 Aug 2021 19:32:17 GMT via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) age 6074925 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront content-length 24 last-modified Fri, 06 Aug 2021 18:47:22 GMT server nginx etag "0c5dad92482d9a7c7c253510f5082465" strict-transport-security max-age=31536000; includeSubDomains access-control-allow-methods GET, POST, OPTIONS x-amz-version-id TvxaskXeU1vX5QWjGFtspdoYt.ZZ_9cE access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 accept-ranges bytes content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id scxTtfpfoikskhYuRIVj0ddwQNlRYe89TgUlFyZToN5FE7yEnDMlFQ==
GET H2	200	14.538f7310.chunk.js Show response js.driftt.com/core/assets/js/ Frame 3154	71 KB 18 KB	24ms 15ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/14.538f7310.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 7731f4935a743becf5d0a01fb484362fdfc72f35d5959142f53c7edc51bbb6f8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 12 Oct 2021 15:20:47 GMT content-encoding gzip age 301216 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Tue, 12 Oct 2021 14:38:56 GMT server nginx etag W/"603a25325c8ecf73649c10273ff4d5ad" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id DLOtQokwZHSeMsMXJnpSZFBLwcL5zPiu via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id _xAYJLPoSuoTYFXI_L3IZRNZAWvBwf80-8GDWNC3zV1zd2_gw95Uhw==
GET H2	200	21.188a4637.chunk.js Show response js.driftt.com/core/assets/js/ Frame 3154	45 KB 12 KB	25ms 15ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/21.188a4637.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 669de46e469afe01509c7a1c4617d9f9b18493f5d9fd4e223e7d4a77f33ee04a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 11 Oct 2021 21:49:43 GMT content-encoding gzip age 364280 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 11 Oct 2021 21:20:00 GMT server nginx etag W/"89864d7e7e83e490f8d177fc877db0b6" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id mEFZ.7KGjKJgHBdw1qzrwuHPzOKDa5X7 via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id XMQlOyuBpEZsjv_Lz8GFER8CF53bVIkwuq3xG5jdwqGBzR9ij_41zg==
GET H2	200	12.d9f9eea7.chunk.js Show response js.driftt.com/core/assets/js/ Frame 3154	39 KB 13 KB	26ms 17ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/12.d9f9eea7.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 82ba91330ac3adfe7e37b3aec1ca399fb99fb551933734389f9eee47861a1c0e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 15 Oct 2021 18:24:25 GMT content-encoding gzip age 30997 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 15 Oct 2021 18:19:49 GMT server nginx etag W/"5a3e29fe4d52bbda1cb7daac2aabbe86" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id HuEovIzn_.6nzdPmbislfC37xNdoUpnr via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 6Ee4jasr2pGU9ZahzuO26eB59d3g6aVxb32IHPLYS7m34AfIvAtf4A==
GET H2	200	42.3b1c2441.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4074	47 KB 14 KB	19ms 5ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 7727399fe5d8441829176e6a661b540efaac1680120a1d7fb1235e258d70770b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 27 Sep 2021 18:05:58 GMT content-encoding gzip age 1587305 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 27 Sep 2021 17:53:30 GMT server nginx etag W/"62fe06940598a98760a9eae46800ff59" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id .VUhmN0wteSIOoD7zf42Fx9jVTzQPjY_ via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 9xAdbenNDjNxImbUu4JJHB4jutBIT-ssRnUF7hww6jgST930vuwoRQ==
GET H2	200	17.cce21c2a.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4074	44 KB 13 KB	22ms 6ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/17.cce21c2a.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash cda9b31d709444e003d3adbfbdec43f093e405b36841fde5c1d187e439585219 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 27 Sep 2021 18:05:58 GMT content-encoding gzip age 1587305 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 27 Sep 2021 17:53:29 GMT server nginx etag W/"565bf690dc82ce7e1f45c9647d892490" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id jEi2sT.oz2dMTnmIGznKkCTerYS6HNwY via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id XbDPhx1NhzhVeMo2OSwYTVebegqOZ5FCQTdSyaums7HdEuaE3-IC9A==
GET H2	200	35.3e4eba7e.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4074	25 KB 8 KB	22ms 7ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/35.3e4eba7e.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 41f7afd6088c39cdc0d6f910f7f4b6afbf6a2133533847e960a8ca906fabc1c6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 23 Aug 2021 18:08:17 GMT content-encoding gzip age 4611166 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 23 Aug 2021 17:42:07 GMT server nginx etag W/"b1a0f364c9ad5137b5ab8e5237a825b8" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 1I09NUqlw54C3qTPS3eShOaQpBS5lcLu via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id IYjElJMmGpAziFD8YSoj5rb5Mq2doq4NQE6kXdeVySg6RxmXKLvETg==
GET H2	200	15.8065fdbf.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4074	16 KB 5 KB	22ms 7ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/15.8065fdbf.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash f978da291f493e64d4420d2cfab5c2bdc736c53f11c8d61c6da1efdb7df1155d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 06 Sep 2021 06:18:05 GMT content-encoding gzip age 3444178 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 03 Sep 2021 14:38:32 GMT server nginx etag W/"db60664de2c8d54d23e359c94e68f6ce" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id vLMtFICr__AmVbpyC1134yZVvjJr6q0Q via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id tDAR2ZrZGjGWA4R9tD1AYd-CjUOmWDa3XxErGXFQJAdP1HkGaQ-URg==
GET H2	200	19.5937a5b2.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4074	72 KB 22 KB	23ms 8ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/19.5937a5b2.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 2b4d9e531f3302ad49380ce5e5e160925956edb55179c63ee2bac32ab040d1a5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 14:52:30 GMT content-encoding gzip age 734913 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Thu, 07 Oct 2021 14:03:09 GMT server nginx etag W/"08aceb94bd26b0e431ca437d628e3c13" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id PpKcHacqpQIWv5LlWxshj7GW7ctXBTRY via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id GLzo9GOi-oDAv6kff_XtWQC9zuSbT59x59fYUYyTJ6FqmGQs00Io4w==
GET H2	200	32.04864e7d.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4074	16 KB 6 KB	23ms 8ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/32.04864e7d.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash af0ad47815cfcb0fc8402cf431dd782af68f2ba05752c66d9bb11a4354f65754 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 23 Aug 2021 18:08:17 GMT content-encoding gzip age 4611166 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 23 Aug 2021 17:42:07 GMT server nginx etag W/"3b6707d602c1f7d03c4c8b0bdecb8e4e" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id SPqSo.47y7907Wglh2zWsWSyACYHB_Zc via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id DnHkj_xzMZi3Y97kH4X7T-aUIKTWkWB3GK_mNn0RorIJQ39AEHjcGA==
GET H2	200	23.a53d721f.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4074	59 KB 19 KB	24ms 9ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/23.a53d721f.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash f48829864ffd155da0360e19be956282b6875173f8990394e93bc7c30c97a3ed Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 14:52:30 GMT content-encoding gzip age 734913 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Thu, 07 Oct 2021 14:03:10 GMT server nginx etag W/"fe96cb8c4c390342c29d3c8cb0a4ca14" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id v0Q3sUg3fAcXKBWqoZodUDobSoc9.NX8 via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id JDiLWaH-Y_09n_t8jgXi2xIP37eam87q0dXG5Vawhgk8teeKU8H-Tg==
GET H2	200	10.704ab67c.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4074	91 KB 28 KB	25ms 11ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/10.704ab67c.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 1612e3d01a9389defe81c28b91ee18b7b1f97b54f39dd8aa651667c25bce28e2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 01 Oct 2021 20:47:44 GMT content-encoding gzip age 1231998 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 01 Oct 2021 18:06:47 GMT server nginx etag W/"50dcb170ca1ae1f4a09fe8f23065f2a8" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 8SLWCghXfnMEQiqJuVzEB4mWFfFgTeMA via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id ZET7mrOIm5xl3d4jQJQlkdG2yGqR6Jw9YtgmcC2w8eHLMQniUCGFQQ==
GET H2	200	9.a48906f3.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4074	23 KB 7 KB	26ms 11ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/9.a48906f3.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 5059bfed12587f496894f97319682ccb715e7748ae93dd2cafd6310e914f3870 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 04 Oct 2021 23:46:40 GMT content-encoding gzip age 962063 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 04 Oct 2021 13:21:54 GMT server nginx etag W/"60e5547ed381473c15e63274bcd796b6" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id cLY_oJezEuNHBH6Dj5RzDB2u5ynjzlwV via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id tZiHINV07Vc2r-4GqbPI70xYUBCLzW3OJ5_e2IeUhspJYoR0biZMtQ==
GET H2	200	13.c2156fc2.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4074	62 KB 20 KB	27ms 13ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/13.c2156fc2.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash f94ce8666bf003756c16b56edad5a0121b3516222d4f093bdb771afabfb2cc5f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 11 Oct 2021 21:49:43 GMT content-encoding gzip age 364280 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 11 Oct 2021 21:20:00 GMT server nginx etag W/"b94404e76324bd4454531b2e0a54f7bb" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id dduSgTmTEeX.c1xrsh3Cd4WUJFtbN06M via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id T357N57Ydx6joiGS2CqoW99mRSA9MFyBd0XnOy_-thMEuPDby1YF4w==
GET H2	200	40.01f4f7b3.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4074	105 KB 34 KB	28ms 13ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/40.01f4f7b3.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 71f918c131027703d4692c7e7cc9d46fc09554fc2b211e60f12e8fea8360deb7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 23 Aug 2021 18:08:17 GMT content-encoding gzip age 4611166 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 23 Aug 2021 17:42:08 GMT server nginx etag W/"7dd9b27f83583b6d43567ed4b21eff8c" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 9jXV8w0bWzHPQtgsCAjrFrN9PLNAN.Ap via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id QVOqiFfv--d7p6-B-JFlqDZMTveobq_jQ8fGfO2xkKZaq_tfxQIGpw==
GET H2	200	33.c1910d43.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4074	12 KB 4 KB	29ms 14ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/33.c1910d43.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash c2d8b5ed5baf711d51629607797e32e5ff638637a0091598427eac4908dbae47 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 23 Aug 2021 18:08:17 GMT content-encoding gzip age 4611166 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 23 Aug 2021 17:42:07 GMT server nginx etag W/"0e451f1cf9656229ccd33dfa3ad0638d" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id ocjv..MVaCaOGNo5kiC5l3ewWVKjMwbS via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 2pGOyCwWyCp_S1hTrhZHbyeeu7dpxIdjQJxkbDKy4domdy-M4DRL5Q==
GET H2	200	25.b7a0bf53.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4074	12 KB 5 KB	29ms 15ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/25.b7a0bf53.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash c87e0e31334c6998b90c83d48eff6252a248120d32b376414965e1421203c901 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 14:52:30 GMT content-encoding gzip age 734913 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Thu, 07 Oct 2021 14:03:10 GMT server nginx etag W/"808f7c7829001881a39cef6846a36ce0" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id _ix5iBb64na.L1JY7ymqDewgFGceFL7s via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id Y4evB0mBj-ze0hrqLgTGSjt0T5BoErsMI0Hgu-OUZQJ5GxrlyqGnAA==
GET H2	200	16.fab21cf4.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4074	17 KB 7 KB	29ms 15ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/16.fab21cf4.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash fa110ac06915e913fea0ad440e557cd75b95101504acc6a865efb5d7f0f34d95 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 23 Aug 2021 18:08:17 GMT content-encoding gzip age 4611166 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 23 Aug 2021 17:42:07 GMT server nginx etag W/"b451093ecfaa012f364641010ed13346" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id mlbxReFt8YmdLvOZ4ChXgFfj8NP88809 via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id PMoIyBDKQRcCWFKRzgS4KPVHqHCU-6wM5gg6-PIR2cH2mTM2BQzr0Q==
GET H2	200	7.38935f56.chunk.css js.driftt.com/core/assets/css/ Frame 4074	11 KB 3 KB	18ms 4ms	Stylesheet text/css	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/7.38935f56.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash f26c0c1b5c55945acc42f4005ae66cffa78a4efea9bb8c70cdac7b7ac47bcdfa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 14:52:30 GMT content-encoding gzip age 734913 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Thu, 07 Oct 2021 14:03:08 GMT server nginx etag W/"7a6a7594668eccfb02737897caf09023" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id F91xsNgZaccVv_sq2ZDhhPCusQtrocgc via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id -12ouupAa4kK_d8kCZ_fSdYyE5UA4VZq4la_jiYgH9TPZSCjQvQFnA==
GET H2	200	7.1d6e970f.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4074	68 KB 21 KB	29ms 15ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/7.1d6e970f.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 5ea8a248ef99b55232fbb5e0cfd96c94502ec5b9c5ddef1e1799054a1fc7c926 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 15 Oct 2021 16:40:38 GMT content-encoding gzip age 37225 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 15 Oct 2021 16:24:35 GMT server nginx etag W/"eb3dcdfae00cf40d131b3359b6770e1d" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id CcsJrUq_IW4ieYyH..76HAoFLGjY3L4g via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id oVKcPMj6dHKRLvh215WPfeZC9LxnhtJOFPs6TEOv4fnbfXm3ci1hUQ==
GET H2	200	14.22abfce0.chunk.css js.driftt.com/core/assets/css/ Frame 4074	24 B 667 B	19ms 5ms	Stylesheet text/css	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/14.22abfce0.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 06 Aug 2021 19:32:17 GMT via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) age 6074925 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront content-length 24 last-modified Fri, 06 Aug 2021 18:47:22 GMT server nginx etag "0c5dad92482d9a7c7c253510f5082465" strict-transport-security max-age=31536000; includeSubDomains access-control-allow-methods GET, POST, OPTIONS x-amz-version-id TvxaskXeU1vX5QWjGFtspdoYt.ZZ_9cE access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 accept-ranges bytes content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 33KhFvfwvCCL0xDSeWYJv21cklD5q5m9UpTwE1BQSdwI7EC75GIH8Q==
GET H2	200	14.538f7310.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4074	71 KB 18 KB	30ms 16ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/14.538f7310.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 7731f4935a743becf5d0a01fb484362fdfc72f35d5959142f53c7edc51bbb6f8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 12 Oct 2021 15:20:47 GMT content-encoding gzip age 301216 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Tue, 12 Oct 2021 14:38:56 GMT server nginx etag W/"603a25325c8ecf73649c10273ff4d5ad" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id DLOtQokwZHSeMsMXJnpSZFBLwcL5zPiu via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 0NZUjm5lSalniqWd8W--4SNWKxysP1c0VPFlUieNVbzeVwvCOAmvGw==
GET H2	200	21.188a4637.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4074	45 KB 12 KB	30ms 17ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/21.188a4637.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 669de46e469afe01509c7a1c4617d9f9b18493f5d9fd4e223e7d4a77f33ee04a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 11 Oct 2021 21:49:43 GMT content-encoding gzip age 364280 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 11 Oct 2021 21:20:00 GMT server nginx etag W/"89864d7e7e83e490f8d177fc877db0b6" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id mEFZ.7KGjKJgHBdw1qzrwuHPzOKDa5X7 via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id wTLlDJfdPELzLyswJZelGbaJ_fgd0QjklOEo0VwH5ASoBD2d9UIKuw==
GET H2	200	12.d9f9eea7.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4074	39 KB 13 KB	31ms 18ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/12.d9f9eea7.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 82ba91330ac3adfe7e37b3aec1ca399fb99fb551933734389f9eee47861a1c0e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 15 Oct 2021 18:24:25 GMT content-encoding gzip age 30997 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 15 Oct 2021 18:19:49 GMT server nginx etag W/"5a3e29fe4d52bbda1cb7daac2aabbe86" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id HuEovIzn_.6nzdPmbislfC37xNdoUpnr via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id fkpiaGaPj-KIUsWe9xR7X0Q6NRqFaNf0CIAUNIWkxoWZuyMpEYTiuA==
POST H3	200	collect Show response stats.g.doubleclick.net/j/	2 B 23 B	33ms 14ms	XHR text/plain	74.125.206.157 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j93&tid=UA-52702906-1&cid=196332420.1634353263&jid=869776149&gjid=188111711&_gid=2062854490.1634353263&_u=aCDCAEACQAAAAC~&z=750905384 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H3 Security QUIC, , AES_128_GCM Server 74.125.206.157 , United States, ASN15169 (GOOGLE, US), Reverse DNS wk-in-f157.1e100.net Software Golfe2 / Resource Hash 6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://redcanary.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Sat, 16 Oct 2021 03:01:03 GMT content-type text/plain access-control-allow-origin https://redcanary.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	22.e10510b6.chunk.js Show response js.driftt.com/core/assets/js/ Frame 3154	42 KB 12 KB	8ms 7ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/22.e10510b6.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash b0257060098cdc51166f35b62e7dd8f0c5f8d6cfa319901c0c51a629537e02fd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 15 Oct 2021 01:13:23 GMT content-encoding gzip age 92860 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Thu, 14 Oct 2021 21:28:22 GMT server nginx etag W/"a99459752bee496e4af7c45277fd9c26" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id T8L5krx2cqygd71cKnQ.RlFky1lNaO_x via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id Zt6l_9_a_stHygWeeby8oFGt7BvtkUGRPPtDyplLR0aQPclQ2RF2VQ==
GET H2	200	24.49c6961c.chunk.css js.driftt.com/core/assets/css/ Frame 3154	8 KB 2 KB	8ms 8ms	Stylesheet text/css	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/24.49c6961c.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 578cda2391db4e4d761ae5c4f05c03614d0ea8fec0b260edc036cc0bbdfcdd93 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 07 Oct 2021 14:52:31 GMT content-encoding gzip age 734912 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Thu, 07 Oct 2021 14:03:07 GMT server nginx etag W/"f80cd64e339375567091159cb077b941" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id Jae8JqW663dCPtKcAWnt.q.y_JeyJDGP via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id oc9CtkFpOKKB0eNFU6dWLEFXY_Eqn5nxNMrcQ2n7ouUl-9iP7z6EcA==
GET H2	200	24.a9379333.chunk.js Show response js.driftt.com/core/assets/js/ Frame 3154	11 KB 5 KB	9ms 8ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/24.a9379333.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 43ca52a6dae03a846c3de3aec093f4a148196fe8a0b374c27f5f341d159f3c72 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 15 Oct 2021 01:13:23 GMT content-encoding gzip age 92860 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Thu, 14 Oct 2021 21:28:22 GMT server nginx etag W/"6a074223651839a67992b6b9430a98ba" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 9OGaQkg3P7WM5pa_pvTSTovxqZdJ4Jfg via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id BiH-CdOMNpE0Dhz4EeZ5ORMHs7k2HF_uFoWLNG89SonAW1GCOFOA2Q==
GET H2	200	18.c695453b.chunk.css js.driftt.com/core/assets/css/ Frame 3154	365 B 1008 B	9ms 8ms	Stylesheet text/css	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/18.c695453b.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 27 Sep 2021 18:05:58 GMT via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) age 1587305 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront content-length 365 last-modified Mon, 27 Sep 2021 17:53:27 GMT server nginx etag "06b2963b029c0824382815165bfea73e" strict-transport-security max-age=31536000; includeSubDomains access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 2nl84_Ynkb7J4eflOi4MBL9RG1iL8udX access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 accept-ranges bytes content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id OCIzLodSy5RRfT8PmCjg6LPCDSu3JqySrd3TWF18_grKeipvBDFQZg==
GET H2	200	18.098354fe.chunk.js Show response js.driftt.com/core/assets/js/ Frame 3154	83 KB 23 KB	9ms 9ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/18.098354fe.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 38bceeb52a0727f191ea5a3bf2faeadd1ab57cd27c489ed87a4d5bcfb37db5ab Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core?embedId=65zait4t5ws7&region=US&forceShow=false&skipCampaigns=false&sessionId=a35517ef-956f-4fd3-9931-cb48d08c4302&sessionStarted=1634353263.392&campaignRefreshToken=39e1415a-96c3-4cb6-8c24-7439e18e99d4&hideController=false&pageLoadStartTime=1634353262399&mode=CHAT&driftEnableLog=false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 11 Oct 2021 21:49:44 GMT content-encoding gzip age 364279 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Mon, 11 Oct 2021 21:20:00 GMT server nginx etag W/"187090f2493456546a87195dcd77b935" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id 3IoLPBd9_4TMGBtqtxwL8yi3STU8fMCL via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 5TL-mqs1a9VlGPlhqEFocnyI84OcwZ89pJ9eSz6LtP5ijdxMxigucw==
GET H3	200	ga-audiences www.google.com/ads/	42 B 63 B	53ms 23ms	Image image/gif	216.58.212.164 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-52702906-1&cid=196332420.1634353263&jid=869776149&_u=aCDCAEACQAAAAC~&z=19768910 Protocol H3 Security QUIC, , AES_128_GCM Server 216.58.212.164 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS ams15s22-in-f164.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Sat, 16 Oct 2021 03:01:03 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	30.e776e5b0.chunk.css js.driftt.com/core/assets/css/ Frame 4074	6 KB 1 KB	7ms 7ms	Stylesheet text/css	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/30.e776e5b0.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash f8e3f110b75b3f1951f50fb7795c6eaf5bee4f07b787a1b535b39e734c7f1723 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 06 Sep 2021 06:18:06 GMT content-encoding gzip age 3444177 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 03 Sep 2021 14:38:30 GMT server nginx etag W/"9f36443a9402e1e03bf8070ddc88b8db" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id tAgW8ISL_lhmF8yDc7EFC6RakUCehknp via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 0j8Fi9rmlMLHJrSpUNuUofEJnJkxUF89rdQKDEjrUILbrTyq8Ta7Xw==
GET H2	200	30.1cba0c50.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4074	2 KB 2 KB	8ms 8ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/30.1cba0c50.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 2337e32bed1dffbceeade3e898616dadd4b6ba320b8201ec767923828a91dbe9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 08 Oct 2021 18:18:43 GMT content-encoding gzip age 636140 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 08 Oct 2021 17:49:20 GMT server nginx etag W/"d54ffcde15f455981e28d3c9524c5a65" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id mpksmuuRXsbc0e.AvyCNzrcsYNrGiRlA via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id du36i1_gW9tbF9nVM-jxp5l4YBEKNTTx2BN5Mks0HmHwfPKFae3wuw==
GET H2	200	1.07aa08a5.chunk.css js.driftt.com/core/assets/css/ Frame 4074	7 KB 2 KB	7ms 7ms	Stylesheet text/css	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/1.07aa08a5.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 06 Sep 2021 07:05:26 GMT content-encoding gzip age 3441337 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 03 Sep 2021 14:38:30 GMT server nginx etag W/"189aeffd571884559dababa22c66d75a" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id H3lCc5pGZRKjCHfgJqwvBl_pDrcMRgYg via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id uetdgiFepxnwJPaU3qSP_SsBO6KP6OTjok2nx1Y7fQ8GY1FZXc88qw==
GET H2	200	1.187c50a5.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4074	54 KB 16 KB	8ms 7ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/1.187c50a5.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash a3075e2c162e41c4962a4221ae035dd607d895bd424e87aa4065a044c43763e4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 04 Oct 2021 01:27:39 GMT content-encoding gzip age 1042404 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 01 Oct 2021 18:06:47 GMT server nginx etag W/"eeccccb655ee3b6bcb8b1a9b1da4fd30" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id Kqvbu6YYADSzpukLsRda19nqjwsCcGyV via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id sLvmK3tca_vDwiNrcvCcpyElxalcMthu83e-IJ_8GoLBA-rQlLIjEg==
GET H2	200	0.2ee65fa2.chunk.css js.driftt.com/core/assets/css/ Frame 4074	42 KB 7 KB	8ms 7ms	Stylesheet text/css	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/0.2ee65fa2.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash fcf891fca4263b4702622c3e48ffe26b4ac24936117ab9f4dff0ecdff1d8d285 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 15 Oct 2021 18:24:26 GMT content-encoding gzip age 30997 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 15 Oct 2021 18:19:47 GMT server nginx etag W/"15fd88fb0b4900790aa2aabd469bd4be" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id SWo7bgvZgax5z9WvBt.Z9dNahsXu0LqP via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 5G3luFCFviPOoHHBIeREaKl8yK_3UEIOKyGxG6TBFfrTvK9CtkzUZQ==
GET H2	200	0.809a002f.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4074	64 KB 21 KB	8ms 8ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/0.809a002f.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash e6c4794711b89caf16d8cb494bb178610f398a666b7daa46b96caa078f186d56 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 15 Oct 2021 16:40:38 GMT content-encoding gzip age 37225 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 15 Oct 2021 16:24:33 GMT server nginx etag W/"ce844e675a7d11a1d091749c18df7b75" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id gh.LuVYopMoxxet7Te7DK1.iRVoJtpJk via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id q0_BSuwcGhT4r6XXQvvu9pMtPk1PeXw8yWhKmT0o1sRuaKkzNVOQng==
GET H2	200	29.a35d8593.chunk.css js.driftt.com/core/assets/css/ Frame 4074	11 KB 3 KB	9ms 8ms	Stylesheet text/css	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/29.a35d8593.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 561b202ea8a3cd9cf4878e88b0607b78016f428087923cc32472d578218d5e3a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 08 Oct 2021 18:18:43 GMT content-encoding gzip age 636140 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 08 Oct 2021 17:49:17 GMT server nginx etag W/"4e87789253b9d2feb20461043b23122f" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id PE93x6EC3eOcloy4TA_iaGfXIj43n6y7 via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type text/css access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id ecf8e8UtV4GuJYE_4Ey7C0HEdR35mayhfrfEzG5DCpdmLrrpeaUf_Q==
GET H2	200	29.55017f49.chunk.js Show response js.driftt.com/core/assets/js/ Frame 4074	11 KB 4 KB	9ms 9ms	Script application/javascript	143.204.209.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/29.55017f49.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.4be7cc23.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-38.fra53.r.cloudfront.net Software nginx / Resource Hash 599a74d28be4e825f1ba0637d55776c921d556f57c98b7748eddef62196ce534 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1634353262399 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 08 Oct 2021 18:18:43 GMT content-encoding gzip age 636140 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Fri, 08 Oct 2021 17:49:20 GMT server nginx etag W/"0da4c595e9a26ab16e61488ee84f0bba" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS x-amz-version-id wyp1a.ltFauHgxQaBSGt4tvTww90m6vt via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control max-age=31536000 access-control-allow-credentials true x-amz-cf-pop FRA53-C1 content-type application/javascript; charset=utf-8 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id SePQ6i3O1KA1iA0e4-e7TxqLEqQ37rYJyni4v7hM-WgEYN3BBl-m3A==
OPTIONS H2	200	v2 metrics.api.drift.com/monitoring/metrics/widget/init/ Frame	0 0	319ms 100ms	Preflight text/plain	50.16.7.188 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://metrics.api.drift.com/monitoring/metrics/widget/init/v2 Protocol H2 Server 50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-50-16-7-188.compute-1.amazonaws.com Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://js.driftt.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode cors Response headers date Sat, 16 Oct 2021 03:01:03 GMT access-control-allow-origin * access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version access-control-allow-credentials true access-control-expose-headers X-Results-Total-Count,X-Page-Info access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH access-control-max-age 1209600 strict-transport-security max-age=31536000; includeSubDomains content-type text/plain allow POST,OPTIONS requestid drift8db3d2a4595bd63f67a346b38e3 content-length 13 x-envoy-upstream-service-time 0 server istio-envoy
POST H2	200	v2 Show response metrics.api.drift.com/monitoring/metrics/widget/init/ Frame 3154	25 B 146 B	109ms 109ms	XHR application/json	50.16.7.188 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://metrics.api.drift.com/monitoring/metrics/widget/init/v2 Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-50-16-7-188.compute-1.amazonaws.com Software istio-envoy / Resource Hash f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ Authorization Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type application/json Response headers date Sat, 16 Oct 2021 03:01:04 GMT server istio-envoy requestid 929106b68c51fbfe vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type application/json;charset=utf-8 access-control-allow-origin * access-control-max-age 1209600 access-control-allow-credentials true x-envoy-upstream-service-time 11 strict-transport-security max-age=31536000; includeSubDomains access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version content-length 25 access-control-expose-headers X-Results-Total-Count,X-Page-Info
POST H2	200	ping Show response bootstrap.api.drift.com/widget_bootstrap/ Frame 3154	103 B 223 B	102ms 102ms	XHR application/json	3.94.218.138 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://bootstrap.api.drift.com/widget_bootstrap/ping Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-94-218-138.compute-1.amazonaws.com Software istio-envoy / Resource Hash 5958c3fe54505c4e42c30060052a1693c6e5762d7787487f46fe557ec8cd6874 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type application/json Response headers date Sat, 16 Oct 2021 03:01:04 GMT server istio-envoy requestid 1d759228cd3e8e58 vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type application/json;charset=utf-8 access-control-allow-origin * access-control-max-age 1209600 access-control-allow-credentials true x-envoy-upstream-service-time 3 strict-transport-security max-age=31536000; includeSubDomains access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version content-length 103 access-control-expose-headers X-Results-Total-Count,X-Page-Info
OPTIONS H2	200	ping bootstrap.api.drift.com/widget_bootstrap/ Frame	0 0	305ms 99ms	Preflight text/plain	3.94.218.138 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://bootstrap.api.drift.com/widget_bootstrap/ping Protocol H2 Server 3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-94-218-138.compute-1.amazonaws.com Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers content-type Origin https://js.driftt.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode cors Response headers date Sat, 16 Oct 2021 03:01:03 GMT access-control-allow-origin * access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version access-control-allow-credentials true access-control-expose-headers X-Results-Total-Count,X-Page-Info access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH access-control-max-age 1209600 strict-transport-security max-age=31536000; includeSubDomains content-type text/plain allow POST,OPTIONS requestid drift4c7153b4e418eaea84ae5d14b48 content-length 13 x-envoy-upstream-service-time 0 server istio-envoy
GET H2	200	65zait4t5ws7.json Show response embeds.driftcdn.com/embeds/ Frame 3154	17 KB 6 KB	428ms 398ms	XHR application/json	143.204.209.100 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://embeds.driftcdn.com/embeds/65zait4t5ws7.json Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.209.100 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-209-100.fra53.r.cloudfront.net Software AmazonS3 / Resource Hash 3cac732722317bfbc4581ffed1eca80c7484e0deab3d61c6c9dfa6755c585d85 Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 16 Oct 2021 03:01:05 GMT content-encoding gzip x-amz-cf-pop FRA53-C1 x-amz-server-side-encryption AES256 x-cache RefreshHit from cloudfront access-control-max-age 3000 access-control-allow-origin * last-modified Thu, 14 Oct 2021 20:56:46 GMT server AmazonS3 etag W/"341144db3d3d84cdea7070955917385c" vary Origin,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-methods GET content-type application/json; charset=UTF-8 via 1.1 12c16baed6578bf50fb0eaa233f2bc84.cloudfront.net (CloudFront) cache-control public, max-age=30 x-amz-cf-id g6Ei8wuMR0Lhvwk_yPYwIAbtQ5bFt8MFdrVrnqYtU1G24H_tsb8nRw==
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	177ms 177ms	Image image/gif	104.111.233.140 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=64bb1002ce1e00006e406a61fc01000085a73c00&session=a1d74e68-3aa8-4b27-8dde-f4c3bf304c82&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2016%20Oct%202021%2003%3A01%3A04%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2016%20Oct%202021%2003%3A01%3A02%20GMT%22%2C%22timeSpent%22%3A%221862%22%2C%22totalTimeSpent%22%3A%221862%22%7D&isIframe=false&m=%7B%22description%22%3A%22Adversaries%20used%20Vssadmin%20to%20delete%20shadow%20copies%20during%20a%202019%20ransomware%20incident%20involving%20Kaseya%20IT%20management%20software.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&pageViewId=d798da08-e9cd-4a33-8822-2b2895620754&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-140.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sat, 16 Oct 2021 03:01:04 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Sat, 05 Jun 2021 07:56:05 GMT Server nginx/1.14.0 (Ubuntu) ETag "60bb2e15-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	177ms 177ms	Image image/gif	104.111.233.140 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=64bb1002ce1e00006e406a61fc01000085a73c00&session=a1d74e68-3aa8-4b27-8dde-f4c3bf304c82&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2016%20Oct%202021%2003%3A01%3A05%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2016%20Oct%202021%2003%3A01%3A04%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222863%22%7D&isIframe=false&m=%7B%22description%22%3A%22Adversaries%20used%20Vssadmin%20to%20delete%20shadow%20copies%20during%20a%202019%20ransomware%20incident%20involving%20Kaseya%20IT%20management%20software.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&pageViewId=d798da08-e9cd-4a33-8822-2b2895620754&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-140.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sat, 16 Oct 2021 03:01:05 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
POST H2	200	bulk Show response metrics.api.drift.com/monitoring/metrics/event2/ Frame 3154	25 B 88 B	111ms 111ms	XHR application/json	50.16.7.188 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://metrics.api.drift.com/monitoring/metrics/event2/bulk Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-50-16-7-188.compute-1.amazonaws.com Software istio-envoy / Resource Hash f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ Authorization Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type application/json Response headers date Sat, 16 Oct 2021 03:01:05 GMT server istio-envoy requestid fa3e8f64ebad9e78 vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type application/json;charset=utf-8 access-control-allow-origin * access-control-max-age 1209600 access-control-allow-credentials true x-envoy-upstream-service-time 12 strict-transport-security max-age=31536000; includeSubDomains access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version content-length 25 access-control-expose-headers X-Results-Total-Count,X-Page-Info
OPTIONS H2	200	bulk metrics.api.drift.com/monitoring/metrics/event2/ Frame	0 0	99ms 98ms	Preflight text/plain	50.16.7.188 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://metrics.api.drift.com/monitoring/metrics/event2/bulk Protocol H2 Server 50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-50-16-7-188.compute-1.amazonaws.com Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://js.driftt.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode cors Response headers date Sat, 16 Oct 2021 03:01:05 GMT access-control-allow-origin * access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version access-control-allow-credentials true access-control-expose-headers X-Results-Total-Count,X-Page-Info access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH access-control-max-age 1209600 strict-transport-security max-age=31536000; includeSubDomains content-type text/plain allow POST,OPTIONS requestid driftb96b2864e5f8b53bc43fe6c8e5b content-length 13 x-envoy-upstream-service-time 0 server istio-envoy
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	177ms 177ms	Image image/gif	104.111.233.140 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=64bb1002ce1e00006e406a61fc01000085a73c00&session=a1d74e68-3aa8-4b27-8dde-f4c3bf304c82&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2016%20Oct%202021%2003%3A01%3A06%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2016%20Oct%202021%2003%3A01%3A05%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%223865%22%7D&isIframe=false&m=%7B%22description%22%3A%22Adversaries%20used%20Vssadmin%20to%20delete%20shadow%20copies%20during%20a%202019%20ransomware%20incident%20involving%20Kaseya%20IT%20management%20software.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&pageViewId=d798da08-e9cd-4a33-8822-2b2895620754&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-140.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sat, 16 Oct 2021 03:01:06 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Tue, 05 Oct 2021 22:17:52 GMT Server nginx/1.14.0 (Ubuntu) ETag "615ccf10-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	219ms 219ms	Image image/gif	104.111.233.140 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=64bb1002ce1e00006e406a61fc01000085a73c00&session=a1d74e68-3aa8-4b27-8dde-f4c3bf304c82&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2016%20Oct%202021%2003%3A01%3A07%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2016%20Oct%202021%2003%3A01%3A06%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224866%22%7D&isIframe=false&m=%7B%22description%22%3A%22Adversaries%20used%20Vssadmin%20to%20delete%20shadow%20copies%20during%20a%202019%20ransomware%20incident%20involving%20Kaseya%20IT%20management%20software.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&pageViewId=d798da08-e9cd-4a33-8822-2b2895620754&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-140.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sat, 16 Oct 2021 03:01:07 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Tue, 05 Oct 2021 22:17:52 GMT Server nginx/1.14.0 (Ubuntu) ETag "615ccf10-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	177ms 177ms	Image image/gif	104.111.233.140 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=64bb1002ce1e00006e406a61fc01000085a73c00&session=a1d74e68-3aa8-4b27-8dde-f4c3bf304c82&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2016%20Oct%202021%2003%3A01%3A08%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2016%20Oct%202021%2003%3A01%3A07%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225867%22%7D&isIframe=false&m=%7B%22description%22%3A%22Adversaries%20used%20Vssadmin%20to%20delete%20shadow%20copies%20during%20a%202019%20ransomware%20incident%20involving%20Kaseya%20IT%20management%20software.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&pageViewId=d798da08-e9cd-4a33-8822-2b2895620754&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-140.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sat, 16 Oct 2021 03:01:08 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Tue, 05 Oct 2021 22:17:52 GMT Server nginx/1.14.0 (Ubuntu) ETag "615ccf10-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
POST H2	200	bulk Show response metrics.api.drift.com/monitoring/metrics/add/ Frame 3154	25 B 87 B	99ms 99ms	XHR application/json	50.16.7.188 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://metrics.api.drift.com/monitoring/metrics/add/bulk Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-50-16-7-188.compute-1.amazonaws.com Software istio-envoy / Resource Hash f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ Authorization Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type application/json Response headers date Sat, 16 Oct 2021 03:01:08 GMT server istio-envoy requestid b377f4400c8af33e vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type application/json;charset=utf-8 access-control-allow-origin * access-control-max-age 1209600 access-control-allow-credentials true x-envoy-upstream-service-time 1 strict-transport-security max-age=31536000; includeSubDomains access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version content-length 25 access-control-expose-headers X-Results-Total-Count,X-Page-Info
OPTIONS H2	200	bulk metrics.api.drift.com/monitoring/metrics/add/ Frame	0 0	98ms 98ms	Preflight text/plain	50.16.7.188 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://metrics.api.drift.com/monitoring/metrics/add/bulk Protocol H2 Server 50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-50-16-7-188.compute-1.amazonaws.com Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://js.driftt.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode cors Response headers date Sat, 16 Oct 2021 03:01:08 GMT access-control-allow-origin * access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version access-control-allow-credentials true access-control-expose-headers X-Results-Total-Count,X-Page-Info access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH access-control-max-age 1209600 strict-transport-security max-age=31536000; includeSubDomains content-type text/plain allow POST,OPTIONS requestid driftf3eca0b4ebcaf31ce6ecf6d187b content-length 13 x-envoy-upstream-service-time 0 server istio-envoy