www.reliaquest.com Open in urlscan Pro
141.193.213.21 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://sl.reliaquest.com/t/101137/c/a36a03c8-7f3f-4137-8711-baea1651786c/NB2HI4DTHIXS653XO4XHEZLMNFQXC5LFON2C4Y3PNUXWE3DP...
Effective URL:
https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
Submission: On February 18 via api (February 18th 2022, 8:57:15 am UTC) from CH — Scanned from DE

Summary HTTP 161 Redirects Links 13 Behaviour Indicators

Summary

This website contacted 40 IPs in 6 countries across 31 domains to perform 161 HTTP transactions. The main IP is 141.193.213.21, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is www.reliaquest.com. The Cisco Umbrella rank of the primary domain is 585583.
TLS certificate: Issued by RapidSSL TLS DV RSA Mixed SHA256 2020... on October 19th 2021. Valid for: a year.

This is the only time www.reliaquest.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	52.206.18.39 52.206.18.39	14618 (AMAZON-AES) (AMAZON-AES)
1 1	18.196.76.175 18.196.76.175	16509 (AMAZON-02) (AMAZON-02)
18	141.193.213.21 141.193.213.21	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
1	108.157.4.128 108.157.4.128	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82a::2008	15169 (GOOGLE) (GOOGLE)
10	104.92.74.202 104.92.74.202	16625 (AKAMAI-AS) (AKAMAI-AS)
1	23.111.9.64 23.111.9.64	33438 (HIGHWINDS2) (HIGHWINDS2)
2	2a03:5f80:a::... 2a03:5f80:a::b212:e7d1	50952 (DATAIX-AS...) (DATAIX-AS Peering Ltd.)
2	104.92.72.193 104.92.72.193	16625 (AKAMAI-AS) (AKAMAI-AS)
4	151.101.128.143 151.101.128.143	54113 (FASTLY) (FASTLY)
1	18.66.248.64 18.66.248.64	16509 (AMAZON-02) (AMAZON-02)
64	143.204.98.111 143.204.98.111	16509 (AMAZON-02) (AMAZON-02)
2	18.195.42.228 18.195.42.228	16509 (AMAZON-02) (AMAZON-02)
1	108.157.4.38 108.157.4.38	16509 (AMAZON-02) (AMAZON-02)
2	185.33.221.91 185.33.221.91	29990 (ASN-APPNEX) (ASN-APPNEX)
4	3.208.158.149 3.208.158.149	14618 (AMAZON-AES) (AMAZON-AES)
2	2606:4700::68... 2606:4700::6812:acf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:830::200a	15169 (GOOGLE) (GOOGLE)
6	3.225.225.252 3.225.225.252	14618 (AMAZON-AES) (AMAZON-AES)
1	108.157.4.53 108.157.4.53	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:810::200e	15169 (GOOGLE) (GOOGLE)
1 4	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	130.211.21.179 130.211.21.179	15169 (GOOGLE) (GOOGLE)
1	2a05:d014:275... 2a05:d014:275:cb00:ce75:162:d945:5f34	16509 (AMAZON-02) (AMAZON-02)
2	35.159.4.142 35.159.4.142	16509 (AMAZON-02) (AMAZON-02)
2	169.48.219.66 169.48.219.66	36351 (SOFTLAYER) (SOFTLAYER)
1	192.28.144.124 192.28.144.124	15224 (OMNITURE) (OMNITURE)
2	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
1	54.171.89.80 54.171.89.80	16509 (AMAZON-02) (AMAZON-02)
2	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	52.210.97.70 52.210.97.70	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:400c:c0c::9b	15169 (GOOGLE) (GOOGLE)
3 3	2620:1ec:22::14 2620:1ec:22::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	108.174.10.24 108.174.10.24	14413 (LINKEDIN) (LINKEDIN)
1	2a00:1450:400... 2a00:1450:4001:810::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
4	3.94.218.138 3.94.218.138	14618 (AMAZON-AES) (AMAZON-AES)
2	54.147.21.139 54.147.21.139	14618 (AMAZON-AES) (AMAZON-AES)
1	18.66.248.77 18.66.248.77	16509 (AMAZON-02) (AMAZON-02)
3	20.62.48.180 20.62.48.180	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	52.142.114.2 52.142.114.2	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
161	40

1 52.206.18.39 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-206-18-39.compute-1.amazonaws.com

sl.reliaquest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.196.76.175 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-76-175.eu-central-1.compute.amazonaws.com

app.salesloft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 141.193.213.21 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

www.reliaquest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.157.4.128 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-157-4-128.dus51.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 104.92.74.202 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-92-74-202.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.111.9.64 (United States)

ASN33438 (HIGHWINDS2, US)

scout-cdn.salesloft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:5f80:a::b212:e7d1 (Russian Federation)

ASN50952 (DATAIX-AS Peering Ltd., RU)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.92.72.193 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-92-72-193.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.128.143 (United States)

ASN54113 (FASTLY, US)

s.swiftypecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.248.64 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-248-64.dus51.r.cloudfront.net

cdn-app.pathfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

64 143.204.98.111 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-111.fra50.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.195.42.228 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.157.4.38 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-157-4-38.dus51.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.33.221.91 (Amsterdam, Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.208.158.149 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-208-158-149.compute-1.amazonaws.com

scout.salesloft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 3.225.225.252 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-225-225-252.compute-1.amazonaws.com

jukebox.pathfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.157.4.53 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-157-4-53.dus51.r.cloudfront.net

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:810::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:c11::200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f02d:12:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 130.211.21.179 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 179.21.211.130.bc.googleusercontent.com

koi-3qn67979n8.marketingautomation.services	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d014:275:cb00:ce75:162:d945:5f34 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

www.fullstory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.159.4.142 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-159-4-142.eu-central-1.compute.amazonaws.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 169.48.219.66 (United States)

ASN36351 (SOFTLAYER, US)
PTR: 42.db.30a9.ip4.static.sl-reverse.com

cc.swiftype.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (United States)

ASN15224 (OMNITURE, US)

438-kyk-786.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.171.89.80 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-171-89-80.eu-west-1.compute.amazonaws.com

in.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f12d:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.210.97.70 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-210-97-70.eu-west-1.compute.amazonaws.com

ws29.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:22::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.174.10.24 (United States)

ASN14413 (LINKEDIN, US)
PTR: 108-174-10-24.fwd.linkedin.com

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.94.218.138 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-94-218-138.compute-1.amazonaws.com

metrics.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.147.21.139 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-147-21-139.compute-1.amazonaws.com

bootstrap.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.248.77 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-248-77.dus51.r.cloudfront.net

embeds.driftcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 20.62.48.180 (Boydton, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

e.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.142.114.2 (Dublin, Ireland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
64	driftt.com js.driftt.com — Cisco Umbrella Rank: 4748	751 KB
19	reliaquest.com 1 redirects sl.reliaquest.com www.reliaquest.com — Cisco Umbrella Rank: 585583	272 KB
10	6sc.co j.6sc.co — Cisco Umbrella Rank: 7147 c.6sc.co — Cisco Umbrella Rank: 10540 b.6sc.co — Cisco Umbrella Rank: 5621	15 KB
7	pathfactory.com cdn-app.pathfactory.com — Cisco Umbrella Rank: 157826 jukebox.pathfactory.com — Cisco Umbrella Rank: 56604	242 KB
6	drift.com metrics.api.drift.com — Cisco Umbrella Rank: 5238 bootstrap.api.drift.com — Cisco Umbrella Rank: 5485	434 B
6	salesloft.com 1 redirects app.salesloft.com — Cisco Umbrella Rank: 32755 scout-cdn.salesloft.com — Cisco Umbrella Rank: 10033 scout.salesloft.com — Cisco Umbrella Rank: 10929	5 KB
5	clarity.ms 1 redirects e.clarity.ms — Cisco Umbrella Rank: 2000 c.clarity.ms — Cisco Umbrella Rank: 693	24 KB
5	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 574 script.hotjar.com — Cisco Umbrella Rank: 726 vars.hotjar.com — Cisco Umbrella Rank: 809 in.hotjar.com — Cisco Umbrella Rank: 1615 ws29.hotjar.com — Cisco Umbrella Rank: 58716	68 KB
4	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 439 www.linkedin.com — Cisco Umbrella Rank: 602 px4.ads.linkedin.com — Cisco Umbrella Rank: 5087	3 KB
4	bing.com 1 redirects bat.bing.com — Cisco Umbrella Rank: 331 c.bing.com — Cisco Umbrella Rank: 212	13 KB
4	swiftypecdn.com s.swiftypecdn.com — Cisco Umbrella Rank: 8302	150 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 31	20 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 97	313 B
2	gstatic.com fonts.gstatic.com	32 KB
2	swiftype.com cc.swiftype.com — Cisco Umbrella Rank: 9030	558 B
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 12137	421 B
2	marketingautomation.services koi-3qn67979n8.marketingautomation.services	6 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 126	114 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 610	77 KB
2	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 350	1 KB
2	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 2554	975 B
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 2821	6 KB
2	licdn.com snap.licdn.com — Cisco Umbrella Rank: 830	3 KB
1	driftcdn.com embeds.driftcdn.com — Cisco Umbrella Rank: 5545	13 KB
1	google.de www.google.de — Cisco Umbrella Rank: 6342	501 B
1	google.com www.google.com — Cisco Umbrella Rank: 2	501 B
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 67	444 B
1	mktoresp.com 438-kyk-786.mktoresp.com	311 B
1	fullstory.com www.fullstory.com — Cisco Umbrella Rank: 16297
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 35	1 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 50	74 KB
161	31

	Domain	Requested by
64	js.driftt.com	www.reliaquest.com js.driftt.com
18	www.reliaquest.com	www.reliaquest.com
6	b.6sc.co	www.reliaquest.com
6	jukebox.pathfactory.com	cdn-app.pathfactory.com
4	metrics.api.drift.com	js.driftt.com
4	scout.salesloft.com	scout-cdn.salesloft.com
4	s.swiftypecdn.com	www.reliaquest.com s.swiftypecdn.com
3	e.clarity.ms	bat.bing.com e.clarity.ms
3	bat.bing.com	www.googletagmanager.com bat.bing.com www.reliaquest.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com www.reliaquest.com
3	c.6sc.co	j.6sc.co
2	c.clarity.ms	1 redirects www.reliaquest.com
2	bootstrap.api.drift.com	js.driftt.com
2	px.ads.linkedin.com	2 redirects
2	www.facebook.com	www.reliaquest.com
2	fonts.gstatic.com	fonts.googleapis.com
2	cc.swiftype.com	www.reliaquest.com
2	epsilon.6sense.com	j.6sc.co
2	koi-3qn67979n8.marketingautomation.services	www.reliaquest.com koi-3qn67979n8.marketingautomation.services
2	connect.facebook.net	www.reliaquest.com connect.facebook.net
2	maxcdn.bootstrapcdn.com	cdn-app.pathfactory.com maxcdn.bootstrapcdn.com
2	secure.adnxs.com	j.6sc.co
2	nexus.ensighten.com	www.reliaquest.com
2	munchkin.marketo.net	www.reliaquest.com munchkin.marketo.net
2	snap.licdn.com	www.reliaquest.com snap.licdn.com
1	c.bing.com	1 redirects
1	embeds.driftcdn.com	js.driftt.com
1	www.google.de	www.reliaquest.com
1	www.google.com	www.reliaquest.com
1	px4.ads.linkedin.com	www.reliaquest.com
1	www.linkedin.com	1 redirects
1	stats.g.doubleclick.net	www.google-analytics.com
1	ws29.hotjar.com	script.hotjar.com
1	in.hotjar.com	script.hotjar.com
1	438-kyk-786.mktoresp.com	munchkin.marketo.net
1	www.fullstory.com	www.reliaquest.com
1	vars.hotjar.com	static.hotjar.com
1	fonts.googleapis.com	cdn-app.pathfactory.com
1	script.hotjar.com	static.hotjar.com
1	cdn-app.pathfactory.com	www.reliaquest.com
1	scout-cdn.salesloft.com	www.reliaquest.com
1	j.6sc.co	www.reliaquest.com
1	www.googletagmanager.com	www.reliaquest.com
1	static.hotjar.com	www.reliaquest.com
1	app.salesloft.com	1 redirects
1	sl.reliaquest.com	1 redirects
161	46

This site contains links to these domains. Also see Links.

Domain
www.youtube.com
github.com
www.ic3.gov
www.trustwave.com
www.linkedin.com
www.bleepingcomputer.com
redcanary.com
twitter.com
www.facebook.com

Subject Issuer	Validity	Valid
reliaquest.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2021-10-19` - `2022-10-19`	a year	crt.sh
*.hotjar.com Amazon	`2021-11-25` - `2022-12-23`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.6sc.co DigiCert SHA2 Secure Server CA	`2021-03-09` - `2022-03-16`	a year	crt.sh
salesloft.com Sectigo RSA Domain Validation Secure Server CA	`2021-12-07` - `2022-04-09`	4 months	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2021-07-15` - `2022-07-20`	a year	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2021-03-29` - `2022-04-06`	a year	crt.sh
s.swiftypecdn.com GlobalSign Atlas R3 DV TLS CA H2 2021	`2021-12-24` - `2023-01-25`	a year	crt.sh
*.pathfactory.com Amazon	`2021-08-10` - `2022-09-08`	a year	crt.sh
drift.com Amazon	`2021-09-08` - `2022-10-07`	a year	crt.sh
nexus.ensighten.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-14` - `2022-10-12`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2022-02-11` - `2023-03-14`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-01-29` - `2023-01-29`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-02-07` - `2022-05-02`	3 months	crt.sh
www.bing.com Microsoft RSA TLS CA 01	`2021-12-22` - `2022-06-22`	6 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-11-27` - `2022-02-25`	3 months	crt.sh
*.marketingautomation.services Sectigo RSA Organization Validation Secure Server CA	`2020-03-12` - `2022-06-10`	2 years	crt.sh
bionic.fullstory.com R3	`2022-01-09` - `2022-04-09`	3 months	crt.sh
*.6sense.com Amazon	`2021-06-30` - `2022-07-29`	a year	crt.sh
*.swiftype.com DigiCert SHA2 Secure Server CA	`2020-06-25` - `2022-06-30`	2 years	crt.sh
*.mktoresp.com DigiCert TLS RSA SHA256 2020 CA1	`2021-11-30` - `2022-11-30`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-02-07` - `2022-05-02`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-02-07` - `2022-05-02`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-02-07` - `2022-05-02`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-02-07` - `2022-05-02`	3 months	crt.sh
*.driftcdn.com Amazon	`2022-02-10` - `2023-03-11`	a year	crt.sh
a.clarity.ms Microsoft RSA TLS CA 01	`2021-07-27` - `2022-07-27`	a year	crt.sh

This page contains 5 frames:

Primary Page: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
Frame ID: F1CC943DD4CEDF840B14A0F9FC72C2A1
Requests: 91 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-acca23410e696f2ca3087d947271c3d0.html
Frame ID: F3318454B6EE10AE5CD80A47F4D74029
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
Frame ID: 1EA358EE3F20A737CE1C704A4B7FFC87
Requests: 34 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
Frame ID: 35C7B98C59E8465EAAC682EDA8B1F731
Requests: 33 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 1B01A11E5F868D20F7EF1A79F7486267
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Threat Advisory: Blackbyte Ransomware - ReliaQuestShare on LinkedInFollow us on TwitterFollow us on FacebookFollow us on YoutubeClose modal window

Page URL History Show full URLs

https://sl.reliaquest.com/t/101137/c/a36a03c8-7f3f-4137-8711-baea1651786c/NB2HI4DTHIXS653XO4XHEZLMNFQX... HTTP 302
https://app.salesloft.com/t/101137/c/a36a03c8-7f3f-4137-8711-baea1651786c/NB2HI4DTHIXS653XO4XHEZLMNFQX... HTTP 302
https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

161
Requests

98 %
HTTPS

33 %
IPv6

31
Domains

46
Subdomains

40
IPs

6
Countries

1888 kB
Transfer

5990 kB
Size

42
Cookies

13 Outgoing links

These are links going to different origins than the main page.

URL: https://www.youtube.com/watch?v=MIcQIlds8Ac
Title: <img width="768" height="513" src="https://www.reliaquest.com/wp-content/uploads/2021/02/why-rq-vid.jpg" class="radius-md" alt="" srcset="https://www.reliaquest.com/wp-content/uploads/2021/02/why-rq-vid.jpg 768w, https://www.reliaquest.com/wp-content/uploads/2021/02/why-rq-vid-300x200.jpg 300w" sizes="(max-width: 768px) 100vw, 768px" />

Search URL Search Domain Scan URL

URL: https://www.youtube.com/embed/S3btclDRfDM?autoplay=1&ab_channel=ReliaQuest
Title: <img width="768" height="513" src="https://www.reliaquest.com/wp-content/uploads/2021/02/gm-explainer-vid.jpg" class="radius-md" alt="" srcset="https://www.reliaquest.com/wp-content/uploads/2021/02/gm-explainer-vid.jpg 768w, https://www.reliaquest.com/wp-content/uploads/2021/02/gm-explainer-vid-300x200.jpg 300w" sizes="(max-width: 768px) 100vw, 768px" />

Search URL Search Domain Scan URL

URL: https://www.youtube.com/embed/SEEzG2ON8pk?autoplay=1&ab_channel=ReliaQuest
Title: <img width="768" height="513" src="https://www.reliaquest.com/wp-content/uploads/2021/02/gm-company-vid.jpg" class="radius-md" alt="" srcset="https://www.reliaquest.com/wp-content/uploads/2021/02/gm-company-vid.jpg 768w, https://www.reliaquest.com/wp-content/uploads/2021/02/gm-company-vid-300x200.jpg 300w" sizes="(max-width: 768px) 100vw, 768px" />

Search URL Search Domain Scan URL

URL: https://github.com/SpiderLabs/BlackByteDecryptor
Title: https://github.com/SpiderLabs/BlackByteDecryptor

Search URL Search Domain Scan URL

URL: https://www.ic3.gov/Media/News/2022/220211.pdf
Title: https://www.ic3.gov/Media/News/2022/220211.pdf

Search URL Search Domain Scan URL

URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/
Title: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/pulse/english-blackbyte-ransomware-misterious-dropper-encoder-fasolo/
Title: https://www.linkedin.com/pulse/english-blackbyte-ransomware-misterious-dropper-encoder-fasolo/

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-blackbyte-ransomware/
Title: https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-blackbyte-ransomware/

Search URL Search Domain Scan URL

URL: https://redcanary.com/blog/blackbyte-ransomware/
Title: https://redcanary.com/blog/blackbyte-ransomware/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/reliaquest/
Title: Share on LinkedIn

Search URL Search Domain Scan URL

URL: https://twitter.com/reliaquest?lang=en
Title: Follow us on Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/ReliaQuest/
Title: Follow us on Facebook

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCdPuTyaN5bU3_GmCNFgzl3Q
Title: Follow us on Youtube

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://sl.reliaquest.com/t/101137/c/a36a03c8-7f3f-4137-8711-baea1651786c/NB2HI4DTHIXS653XO4XHEZLMNFQXC5LFON2C4Y3PNUXWE3DPM4XXI2DSMVQXILLBMR3GS43POJ4S2YTMMFRWWYTZORSS24TBNZZW63LXMFZGKLY=/www-reliaquest-com-blog-threat-advisory-blackbyte-ransomware HTTP 302
https://app.salesloft.com/t/101137/c/a36a03c8-7f3f-4137-8711-baea1651786c/NB2HI4DTHIXS653XO4XHEZLMNFQXC5LFON2C4Y3PNUXWE3DPM4XXI2DSMVQXILLBMR3GS43POJ4S2YTMMFRWWYTZORSS24TBNZZW63LXMFZGKLY=/www-reliaquest-com-blog-threat-advisory-blackbyte-ransomware HTTP 302
https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 86

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3664348&time=1645174630110&url=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3664348%26time%3D1645174630110%26url%3Dhttps%253A%252F%252Fwww.reliaquest.com%252Fblog%252Fthreat-advisory-blackbyte-ransomware%252F%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3664348&time=1645174630110&url=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3664348&time=1645174630110&url=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F&liSync=true&e_ipv6=AQKR8MbKMs0pkQAAAX8MDKjodakiop-L1BBgn3w3OPRqgPd89bgyJ1Ap_cXrx--_cgmAousV

Request Chain 157

https://c.clarity.ms/c.gif HTTP 302
https://c.bing.com/c.gif?CtsSyncId=10196DA412264897B8FFE7103188C80E&RedC=c.clarity.ms&MXFR=02950AFB8BD66B960AFA1BB48FD66571 HTTP 302
https://c.clarity.ms/c.gif?CtsSyncId=10196DA412264897B8FFE7103188C80E&MUID=3AB597792BBC60B205EF86362A6E6177

161 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
Redirect Chain

https://sl.reliaquest.com/t/101137/c/a36a03c8-7f3f-4137-8711-baea1651786c/NB2HI4DTHIXS653XO4XHEZLMNFQXC5LFON2C4Y3PNUXWE3DPM4XXI2DSMVQXILLBMR3GS43POJ4S2YTMMFRWWYTZORSS24TBNZZW63LXMFZGKLY=/www-reliaq...
https://app.salesloft.com/t/101137/c/a36a03c8-7f3f-4137-8711-baea1651786c/NB2HI4DTHIXS653XO4XHEZLMNFQXC5LFON2C4Y3PNUXWE3DPM4XXI2DSMVQXILLBMR3GS43POJ4S2YTMMFRWWYTZORSS24TBNZZW63LXMFZGKLY=/www-reliaq...
https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

114 KB
26 KB

275ms
236ms

Document
text/html

141.193.213.21
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / WP Engine

Resource Hash

28638213bd78babaa122363c6a0f387234d0cc8fd72f26ece553bddf7922bccc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;
X-Frame-Options	ALLOW-FROM https://www.reliaquest.com/

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Fri, 18 Feb 2022 08:57:08 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
link: <https://www.reliaquest.com/wp-json/>; rel="https://api.w.org/" <https://www.reliaquest.com/wp-json/wp/v2/posts/3949>; rel="alternate"; type="application/json" <https://www.reliaquest.com/?p=3949>; rel=shortlink
x-powered-by: WP Engine
x-cacheable: SHORT
cache-control: max-age=600, must-revalidate
x-cache: HIT: 2
x-cache-group: normal
content-security-policy: frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;
x-frame-options: ALLOW-FROM https://www.reliaquest.com/
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6df60bd42ee99060-FRA
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

Cache-Control: no-cache
Content-Type: text/html; charset=utf-8
Date: Fri, 18 Feb 2022 08:57:08 GMT
Location: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
Strict-Transport-Security: max-age=31536000; includeSubDomains max-age=31536000; includeSubDomains
Vary: Origin
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Request-Id: 7ed94f565ffa5fb3ffd2e10f20747ccc
X-Runtime: 0.044457
X-XSS-Protection: 1; mode=block
Content-Length: 135
Connection: keep-alive

GET
H2 200 style.min.css
www.reliaquest.com/wp-includes/css/dist/block-library/ 77 KB
11 KB 83ms
81ms Stylesheet
text/css 141.193.213.21
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reliaquest.com/wp-includes/css/dist/block-library/style.min.css?ver=5.9

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7b6fef0a63424245b31b293b1a3bfd074c9da482e28fb9e920e1cf306e54e8a2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 10 Feb 2022 20:18:56 GMT
server: cloudflare
age: 648840
etag: W/"62057330-1357b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
content-security-policy: frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;
cf-ray: 6df60bd5ca7a9060-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 svgs-attachment.css
www.reliaquest.com/wp-content/cache/min/1/wp-content/plugins/svg-support/css/ 67 B
200 B 34ms
32ms Stylesheet
text/css 141.193.213.21
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reliaquest.com/wp-content/cache/min/1/wp-content/plugins/svg-support/css/svgs-attachment.css?ver=1645137249

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ee5d74390a8a2e80111e61ee050a276c9d2fa2ae2d414c094f6ec9d79ad33f1e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 17 Feb 2022 22:34:09 GMT
server: cloudflare
age: 31804
etag: W/"620ecd61-43"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
content-security-policy: frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;
cf-ray: 6df60bd5ca7d9060-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 facets.css
www.reliaquest.com/wp-content/cache/min/1/wp-content/plugins/swiftype-search/assets/ 305 B
211 B 37ms
34ms Stylesheet
text/css 141.193.213.21
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reliaquest.com/wp-content/cache/min/1/wp-content/plugins/swiftype-search/assets/facets.css?ver=1645137249

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

80e9a2d87b73f4a48d5456f281e3378031b56348211878938f40c00cb90a263b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 17 Feb 2022 22:34:09 GMT
server: cloudflare
age: 31804
etag: W/"620ecd61-131"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
content-security-policy: frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;
cf-ray: 6df60bd5ca7f9060-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 style.css
www.reliaquest.com/wp-content/cache/min/1/wp-content/themes/reliaqv1/assets/css/ 273 KB
36 KB 39ms
37ms Stylesheet
text/css 141.193.213.21
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reliaquest.com/wp-content/cache/min/1/wp-content/themes/reliaqv1/assets/css/style.css?ver=1645137249

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

844732f4b71575f9a7c457209abc12cacc8fe7650d6c55bcf49e3c6eb853386a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 17 Feb 2022 22:34:09 GMT
server: cloudflare
age: 31804
etag: W/"620ecd61-443a1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
content-security-policy: frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;
cf-ray: 6df60bd5ca829060-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 front.min.css
www.reliaquest.com/wp-content/plugins/cookie-notice/css/ 5 KB
1 KB 37ms
35ms Stylesheet
text/css 141.193.213.21
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reliaquest.com/wp-content/plugins/cookie-notice/css/front.min.css?ver=5.9

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

840711eaa754b000831567752cc1f5e460bd0f0097be8cb273230834a1a3a7a2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 11 Feb 2022 20:51:14 GMT
server: cloudflare
age: 417812
etag: W/"6206cc42-1495"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
content-security-policy: frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;
cf-ray: 6df60bd5ca859060-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 autocomplete.css
www.reliaquest.com/wp-content/cache/min/1/wp-content/plugins/swiftype-search/assets/ 3 KB
1 KB 41ms
39ms Stylesheet
text/css 141.193.213.21
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reliaquest.com/wp-content/cache/min/1/wp-content/plugins/swiftype-search/assets/autocomplete.css?ver=1645137249

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c8f3094bd58170e9a6cbecb11bba6a925ae7423d31ecff5271f191acfa1f3e8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 17 Feb 2022 22:34:09 GMT
server: cloudflare
age: 31804
etag: W/"620ecd61-d97"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
content-security-policy: frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;
cf-ray: 6df60bd5ca889060-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 easy-notification-bar.css
www.reliaquest.com/wp-content/cache/min/1/wp-content/plugins/easy-notification-bar/assets/css/ 3 KB
791 B 40ms
39ms Stylesheet
text/css 141.193.213.21
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reliaquest.com/wp-content/cache/min/1/wp-content/plugins/easy-notification-bar/assets/css/easy-notification-bar.css?ver=1645137249

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

80d6e0449b911b2fa17ed729b9981f123c4e21d6fe186e454f20c32a13ac6845

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 17 Feb 2022 22:34:09 GMT
server: cloudflare
age: 31804
etag: W/"620ecd61-a0c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
content-security-policy: frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;
cf-ray: 6df60bd5ca899060-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 front.min.js Show response
www.reliaquest.com/wp-content/plugins/cookie-notice/js/ 8 KB
2 KB 209ms
209ms Script
application/javascript 141.193.213.21
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reliaquest.com/wp-content/plugins/cookie-notice/js/front.min.js?ver=2.2.1

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

53c088f65c77c6b7af2804face3e267d4c1bf148177798a30fa3a15aa693c36f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:09 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 17 Feb 2022 22:34:05 GMT
server: cloudflare
etag: W/"620ecd5d-20b3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
content-security-policy: frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;
cf-ray: 6df60bd65eb18fc8-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 install_swiftype.min.js Show response
www.reliaquest.com/wp-content/plugins/swiftype-search/assets/ 102 KB
37 KB 80ms
79ms Script
application/javascript 141.193.213.21
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reliaquest.com/wp-content/plugins/swiftype-search/assets/install_swiftype.min.js?ver=5.9

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f667ce53487e412daa30b3351d678699e9f6997f88b0963e5fc37045adcae97a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 15 Feb 2022 20:00:01 GMT
server: cloudflare
age: 213659
etag: W/"620c0641-197f2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
content-security-policy: frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;
cf-ray: 6df60bd5ca8c9060-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 Bootstrap.js Show response
www.reliaquest.com/wp-content/cache/min/1/choozle/15024/ 28 KB
9 KB 84ms
83ms Script
application/javascript 141.193.213.21
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reliaquest.com/wp-content/cache/min/1/choozle/15024/Bootstrap.js?ver=1645137249

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

6c182493f60207d3b84f1ff7a91ddcea57cfaa8e35ccc759c702d268d96a266e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 17 Feb 2022 22:34:09 GMT
server: cloudflare
age: 31804
etag: W/"620ecd61-6f7f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
content-security-policy: frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;
cf-ray: 6df60bd5ca8f9060-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 jquery-3.6.0.min.js Show response
www.reliaquest.com/wp-content/cache/min/1/ 87 KB
31 KB 47ms
46ms Script
application/javascript 141.193.213.21
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reliaquest.com/wp-content/cache/min/1/jquery-3.6.0.min.js?ver=1645137249

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

37da17e676b0298cd88c1835b00618318df670f9ed4c199274546d4555248dab

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;

Request headers

Referer: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
Origin: https://www.reliaquest.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 17 Feb 2022 22:34:09 GMT
server: cloudflare
age: 31804
etag: W/"620ecd61-15d9b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
content-security-policy: frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;
cf-ray: 6df60bd5ca919060-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 email-decode.min.js Show response
www.reliaquest.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
824 B 56ms
56ms Script
application/javascript 141.193.213.21
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reliaquest.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 16 Feb 2022 13:46:32 GMT
server: cloudflare
etag: W/"620d0038-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 6df60bd5daaa9060-FRA
vary: Accept-Encoding
expires: Sun, 20 Feb 2022 08:57:08 GMT

GET
H2 200 scripts.min.js Show response
www.reliaquest.com/wp-content/themes/reliaqv1/assets/js/ 102 KB
24 KB 44ms
44ms Script
application/javascript 141.193.213.21
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reliaquest.com/wp-content/themes/reliaqv1/assets/js/scripts.min.js?ver=1.0.2

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

6e12019db287290647a1cd911f274d1556cc30c2ec7434064403a667dcbbe8f6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 10 Feb 2022 20:51:50 GMT
server: cloudflare
age: 613656
etag: W/"62057ae6-19782"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
content-security-policy: frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;
cf-ray: 6df60bd5daae9060-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 lazyload.min.js Show response
www.reliaquest.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.5/ 8 KB
3 KB 39ms
39ms Script
application/javascript 141.193.213.21
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reliaquest.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.5/lazyload.min.js

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

8ceb3992861ed1fda25855c2e500e76842ae0d788405e50e3a9f45df36499cf6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 04 Feb 2022 22:05:27 GMT
server: cloudflare
age: 980042
etag: W/"61fda327-2063"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
content-security-policy: frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;
cf-ray: 6df60bd65eb88fc8-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 hotjar-2441060.js Show response
static.hotjar.com/c/ 13 KB
4 KB 97ms
44ms Script
application/javascript 108.157.4.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-2441060.js?sv=5

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.157.4.128 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-157-4-128.dus51.r.cloudfront.net

Software

Resource Hash

96b4484567f62578827735526911d063a73fe35de3e13cc04af8f137dd40d379

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:08 GMT
content-encoding: br
x-content-type-options: nosniff
cache-control: max-age=60
x-amz-cf-pop: DUS51-P2
etag: W/d6e6265d188e1c3323ce2e55b0f83d64
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
cross-origin-resource-policy: cross-origin
x-amz-cf-id: fSedTTfPQT3IMBfkHneGctFUfRNZIqgdbjMxknskPo4nVmrCb8KkAw==
via: 1.1 fa544a973edca8926f95609301f23b66.cloudfront.net (CloudFront)

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 212 KB
74 KB 160ms
72ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NPQTDR

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

755b968a3f16f088eb890f8c555cc54be07862c94454a0f9fe2747c7f1ac0d2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:08 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 74902
x-xss-protection: 0
last-modified: Fri, 18 Feb 2022 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 18 Feb 2022 08:57:08 GMT

GET
H/1.1 200
OK 6si.min.js Show response
j.6sc.co/ 27 KB
9 KB 60ms
7ms Script
application/javascript 104.92.74.202
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-92-74-202.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

2707e48726a3f7ec48a1d1aec9738f20b36bac1535cfa9de2e4d92310c4e7e7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 08:57:08 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 8575
Pragma: no-cache
Last-Modified: Thu, 07 Oct 2021 17:17:43 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "615f2bb7-6a5f"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: application/javascript
Access-Control-Allow-Origin
Cache-Control: private, no-cache, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Fri, 18 Feb 2022 08:57:08 GMT

GET
H2 200 sl.js Show response
scout-cdn.salesloft.com/ 6 KB
3 KB 22ms
6ms Script
application/javascript 23.111.9.64
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://scout-cdn.salesloft.com/sl.js
Requested by: Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.64 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 4a007af67f716c30c8848ab0ad0bfaab8a5fcf3e36dedf918b59c9429d522440

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:08 GMT
content-encoding: gzip
last-modified: Mon, 13 Dec 2021 16:28:37 GMT
server: NetDNA-cache/2.2
x-amz-request-id: EGPQDPK4XKHG34TV
etag: W/"d74cc4825c8e333b2116da3fcc649db1"
x-cache: HIT
x-amz-version-id: 6anzvBQcvmaBDc8BSO9zI6Th.IIiwArc
content-type: application/javascript
x-amz-id-2: Ir6qFRspTWtRK4Ct/Zt6aS40khHTyEcshWuo5GMpirENSMpzxAQQ2+CsAA3FXOtyyR4n9CYk/Hs=

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 1006 B
792 B 962ms
67ms Script
application/x-javascript 2a03:5f80:a::b212:e7d1
DATAIX-AS Peering...

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:5f80:a::b212:e7d1 , Russian Federation, ASN50952 (DATAIX-AS Peering Ltd., RU),
Reverse DNS
Software: /
Resource Hash: 0055b9d0429e9c194b4aa6b5f49cbc2ec31a7220ee7c8c186a9ee951feabd482

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 08:57:09 GMT
Content-Encoding: gzip
Last-Modified: Thu, 17 Feb 2022 18:48:07 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=35469
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 479

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 108ms
6ms Script
application/x-javascript 104.92.72.193
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.92.72.193 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-92-72-193.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 08:57:08 GMT
Content-Encoding: gzip
Last-Modified: Fri, 29 Oct 2021 01:24:07 GMT
Server: AkamaiNetStorage
ETag: "461ce1cffaadfebf2e7659745618ba8e:1635470647.434977"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 753

GET
H/1.1 200
OK st.js Show response
s.swiftypecdn.com/install/v2/ 414 KB
110 KB 48ms
6ms Script
text/javascript 151.101.128.143
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://s.swiftypecdn.com/install/v2/st.js
Requested by: Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.128.143 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 86a76f2db4ea268a8ddfee33ad3a7ab05becfdef07b5ea781d8245a63f397878

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 08:57:08 GMT
Content-Encoding: gzip
Age: 108
X-Cache: HIT
Connection: keep-alive
Content-Length: 112082
X-Served-By: cache-hhn4076-HHN
Access-Control-Allow-Origin: *
X-Timer: S1645174629.914936,VS0,VE0
ETag: "618cf153-1b5d2"
Vary: Accept-Encoding
Content-Type: text/javascript
Via: 1.1 varnish
Cache-Control: max-age=300, public, max-age=300, public
Accept-Ranges: bytes
X-Cache-Hits: 10

GET
H2 200 jukebox.js Show response
cdn-app.pathfactory.com/production/jukebox/current/ 875 KB
239 KB 53ms
11ms Script
text/javascript 18.66.248.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-app.pathfactory.com/production/jukebox/current/jukebox.js
Requested by: Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-64.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cbd99f2690682eb26f975f14d4125e7ab101a307d83d00ad05758f045f15835b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
last-modified: Wed, 16 Feb 2022 02:09:13 GMT
server: AmazonS3
age: 24290
etag: W/"2ea2ea051556bcedc842382dfffe5fb5"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
via: 1.1 a6848167f38570c4e775e8ba04d1f1d0.cloudfront.net (CloudFront)
cache-control: max-age=43200
date: Fri, 18 Feb 2022 02:12:18 GMT
x-amz-cf-pop: DUS51-P1
x-amz-cf-id: h8AnRUD9CaX_-is-DWwc_2KqibHV96kB31IJqajSAF8pKwV71n1ypw==

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2c7dbfca232b557ed75833405c3c8f92ffb224f014aab602a75c7d17328c4a82

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e70ab20a03bb158184806ee4989b61ea50eeda103d9e4592df89bf0b89416ee9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 81804537c91508bd247771532aac07a03a73524343a61bb6ff596caa2c07d524

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 64 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 95eeb8cfd9a50c5f43ea5afbf75c1e458570410b2bddbab2a81abd1afb12ef7e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 65 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cd30193bf4f2348717c45237d14c680540841cbfb00ea48615785bc13e8205f1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 Bliss-Heavy.woff
www.reliaquest.com/wp-content/themes/reliaqv1/assets/fonts/ 24 KB
24 KB 33ms
33ms Font
font/woff 141.193.213.21
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reliaquest.com/wp-content/themes/reliaqv1/assets/fonts/Bliss-Heavy.woff

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/wp-content/cache/min/1/wp-content/themes/reliaqv1/assets/css/style.css?ver=1645137249

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

08dba73430a831aefc84bff275109c401e50dc97fcc27ae6d3ae710edf9c0836

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;

Request headers

Referer: https://www.reliaquest.com/wp-content/cache/min/1/wp-content/themes/reliaqv1/assets/css/style.css?ver=1645137249
Origin: https://www.reliaquest.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:08 GMT
cf-cache-status: HIT
age: 25451
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 24428
last-modified: Thu, 17 Feb 2022 22:34:02 GMT
server: cloudflare
etag: "620ecd5a-5f6c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
content-security-policy: frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;
accept-ranges: bytes
cf-ray: 6df60bd6af378fc8-FRA

GET
H2 200 uvut6nv3vzk9.js Show response
js.driftt.com/include/1645174800000/ 228 KB
65 KB 190ms
142ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1645174800000/uvut6nv3vzk9.js

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

26d1f8df59f501200b5889d69c5e0f20a0e21f72a59526d2b298a2b41aecfa1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:09 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 15 Feb 2022 17:02:23 GMT
server: nginx
etag: W/"1436a50ba1566b47e5386f13b5f845cc"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: u9qbIyi92TsskY9JfPefqUI9Ka_oo6Jd
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: no-cache
access-control-allow-credentials: true
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: N7GMMum4hvBFlUpQmzGVdO3vWNyofwewJ4RQX2CRyZ933vhG6-AmlA==

GET
H/1.1 200
OK cc.js Show response
s.swiftypecdn.com/ 376 B
1 KB 8ms
8ms Script
text/javascript 151.101.128.143
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://s.swiftypecdn.com/cc.js

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/wp-content/plugins/swiftype-search/assets/install_swiftype.min.js?ver=5.9

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.128.143 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6abefb6d09cc0305793204985ae74596668f40336404367e0c8be080729df9a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

X-Swiftype-Backend-Region: dal
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Age: 16
X-Cache: HIT
Status: 200 OK
Connection: keep-alive
Content-Length: 237
X-XSS-Protection: 1; mode=block
X-Request-Id: 36b5577d1d0a40faf315b65af3e0f50b
X-Swiftype-Backend-Datacenter: dal12
X-Runtime: 0.009012
Access-Control-Allow-Origin: *
X-Content-Digest: a94b15c49e5474a41aa0c5ce25d6c9f9f895130a
X-Swiftype-Backend-Node: app-website02b.dal12
X-Timer: S1645174629.037981,VS0,VE1
X-Frame-Options: SAMEORIGIN
Date: Fri, 18 Feb 2022 08:57:09 GMT
X-Served-By: cache-hhn4076-HHN
Vary: Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Via: 1.1 varnish
Cache-Control: max-age=300, public
ETag: W/"192fe5870872ee2e3bb957d8397f250a"
Accept-Ranges: bytes
X-Rack-Cache: fresh
X-Cache-Hits: 1

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/choozle/15024/ 274 B
417 B 774ms
48ms Script
text/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/15024/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/choozle/15024/code/&publishedOn=Tue%20Aug%2024%2016:53:04%20GMT%202021&ClientID=923&PageID=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F
Requested by: Host: www.reliaquest.com
URL: https://www.reliaquest.com/wp-content/cache/min/1/choozle/15024/Bootstrap.js?ver=1645137249
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 7f9fb733d97f062a88ca692d057cf4e1b4d2c35ae2b08ee2f05f9e0bcaf7686c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:09 GMT
cache-control: no-cache, no-store
server: nginx
content-type: text/javascript
content-length: 274
expires: Fri, 18 Feb 2022 08:57:08 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/161/ 11 KB
5 KB 7ms
7ms Script
application/x-javascript 104.92.72.193
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/161/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.92.72.193 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-92-72-193.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 08:57:09 GMT
Content-Encoding: gzip
Last-Modified: Wed, 08 Sep 2021 00:38:21 GMT
Server: AkamaiNetStorage
ETag: "0e0eefac8daf874e8b1aa34aeb160c52:1631061501.737429"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4681
Expires: Sun, 29 May 2022 08:57:09 GMT

GET
H2 200 modules.7d6d0311dc6eb2c0bc38.js Show response
script.hotjar.com/ 235 KB
62 KB 736ms
9ms Script
application/javascript 108.157.4.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.7d6d0311dc6eb2c0bc38.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2441060.js?sv=5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.157.4.38 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-157-4-38.dus51.r.cloudfront.net

Software

Resource Hash

01dfdc130cd3e3b7ed01572613ea6552ab9819ca803c688076f850d06aa627a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 14:12:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 67503
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 62769
access-control-allow-origin: *
last-modified: Thu, 17 Feb 2022 14:12:00 GMT
etag: "fb6a0182102480f4b418874ee97e7e39"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 8080d8bfc581f6befaaa7736f6d0003e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-P2
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: Vzgw0wMLROE8YV1yX6qnHdlua9cljT8ZvPLnZTeOvYCEDBrTvWOaNA==

GET
H/1.1 200
OK getuidj Show response
secure.adnxs.com/ 11 B
696 B 737ms
13ms XHR
application/json 185.33.221.91
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.91 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Feb 2022 08:57:09 GMT
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 721.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 1056c694-1211-4ed4-b4eb-6d2ec13ee913
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.reliaquest.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 11
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK / Show response
c.6sc.co/ 47 B
374 B 730ms
6ms XHR
text/plain 104.92.74.202
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-92-74-202.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7bf24330f3489cc5a7b43f8cc020f5ba15c92dea9721bc52f11defe9d8f542a0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 08:57:09 GMT
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: text/plain
Access-Control-Allow-Origin: https://www.reliaquest.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 47

GET
H2 200 r Show response
scout.salesloft.com/ 41 B
405 B 819ms
96ms XHR
application/json 3.208.158.149
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://scout.salesloft.com/r?tid=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0IjoxMDExMzd9.jbjhYTjr5EtKJiZNcg3fApVy8OrVLI90V1gxGsVoF9E

Requested by

Host: scout-cdn.salesloft.com
URL: https://scout-cdn.salesloft.com/sl.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.208.158.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-208-158-149.compute-1.amazonaws.com

Software

Resource Hash

aa011ed383cb780028a85caaa0dda67dce19b0f4bc596f4f708d1857015c1362

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:09 GMT
strict-transport-security: max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.reliaquest.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
content-length: 41
x-request-id: 6dbc84c928697bc11b8cc7a86f0e3ec2

GET
H2 200 r Show response
scout.salesloft.com/ 41 B
403 B 820ms
97ms XHR
application/json 3.208.158.149
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://scout.salesloft.com/r?tid=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0IjoxMDExMzd9.jbjhYTjr5EtKJiZNcg3fApVy8OrVLI90V1gxGsVoF9E

Requested by

Host: scout-cdn.salesloft.com
URL: https://scout-cdn.salesloft.com/sl.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.208.158.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-208-158-149.compute-1.amazonaws.com

Software

Resource Hash

aa011ed383cb780028a85caaa0dda67dce19b0f4bc596f4f708d1857015c1362

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:09 GMT
strict-transport-security: max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.reliaquest.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
content-length: 41
x-request-id: 70cc26211557609faecc7607d65c8baa

GET
H3 200 Matt-Bredahl.jpg
www.reliaquest.com/wp-content/uploads/2021/02/ 27 KB
28 KB 185ms
185ms Image
image/jpeg 141.193.213.21
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reliaquest.com/wp-content/uploads/2021/02/Matt-Bredahl.jpg

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

9fa46f4bbcad04d753344ce78ff778a6f9af9c021c7bbb17332db3e33a52f0b8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:09 GMT
cf-cache-status: MISS
last-modified: Thu, 17 Feb 2022 22:34:01 GMT
server: cloudflare
etag: "620ecd59-6d7d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
content-security-policy: frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;
accept-ranges: bytes
cf-ray: 6df60bd798788fc8-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 28029

GET
H/1.1 200
OK W3r1x7CGjkjWf2hotQLu.json Show response
s.swiftypecdn.com/install/v2/config/ 19 KB
5 KB 591ms
576ms XHR
application/json 151.101.128.143
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://s.swiftypecdn.com/install/v2/config/W3r1x7CGjkjWf2hotQLu.json

Requested by

Host: s.swiftypecdn.com
URL: https://s.swiftypecdn.com/install/v2/st.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.128.143 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

e101c64b7f06dd0b5a7e8392c75dd3577f688c4c69b2c73b9180046a21ad2711

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://www.reliaquest.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

X-Swiftype-Backend-Region: dal
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Age: 0
X-Cache: MISS
Status: 200 OK
Connection: keep-alive
Vary: Accept-Encoding, Origin
Content-Length: 4094
X-XSS-Protection: 1; mode=block
X-Request-Id: 0495c512cba4adffd2aafa1907d9ac0b
X-Swiftype-Backend-Datacenter: dal12
X-Runtime: 0.184887
Access-Control-Allow-Origin: *
Last-Modified: Wed, 17 Nov 2021 16:32:39 GMT
X-Swiftype-Backend-Node: app-website02b.dal12
X-Timer: S1645174629.096813,VS0,VE570
X-Frame-Options: SAMEORIGIN
Date: Fri, 18 Feb 2022 08:57:09 GMT
X-Served-By: cache-hhn4025-HHN
Access-Control-Max-Age: 7200
Access-Control-Allow-Methods: GET, POST
Content-Type: application/json; charset=utf-8
Via: 1.1 varnish
Access-Control-Expose-Headers
Cache-Control: max-age=300, public
Access-Control-Allow-Credentials: true
ETag: W/"6eb8fcc0691f3147a1cb059d8a7ba966"
Accept-Ranges: bytes
X-Rack-Cache: pass
X-Cache-Hits: 0

GET
H3 200 threat-advisory-blackbyte-ransomware.jpg
www.reliaquest.com/wp-content/uploads/ 35 KB
35 KB 225ms
224ms Image
image/jpeg 141.193.213.21
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reliaquest.com/wp-content/uploads/threat-advisory-blackbyte-ransomware.jpg

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

47bd861a92545ae4f694449a925f8d0b7044a4021bf34f748d472487ce23e3fa

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:09 GMT
cf-cache-status: MISS
last-modified: Thu, 17 Feb 2022 22:34:00 GMT
server: cloudflare
etag: "620ecd58-8afa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
content-security-policy: frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;
accept-ranges: bytes
cf-ray: 6df60bd7c8b78fc8-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 35578

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/ 28 KB
7 KB 658ms
21ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css

Requested by

Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox/current/jukebox.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:09 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 617, 617
age: 2077319
cdn-cachedat: 2021-06-03 22:46:19
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:54 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: b43941af4bb8e32ed6d04a6a37617f28
cf-ray: 6df60bdc1b558ff4-FRA
cdn-requestcountrycode: US
cdn-requestpullsuccess: True

GET
H2 200 css
fonts.googleapis.com/ 4 KB
1 KB 685ms
47ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700

Requested by

Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox/current/jukebox.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8aed12b8b95a1d49011f3e134dc8e71804a3576818d1d1334145aaa96d71aa5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 18 Feb 2022 08:50:58 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 18 Feb 2022 08:57:09 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 18 Feb 2022 08:57:09 GMT

GET
H2 200 init Show response
jukebox.pathfactory.com/api/public/v1/ 3 KB
2 KB 339ms
144ms XHR
application/json 3.225.225.252
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v1/init?clientId=LB-97DF08AC-10844&image=&title=&url=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F

Requested by

Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox/current/jukebox.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.225.225.252 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-225-225-252.compute-1.amazonaws.com

Software

Resource Hash

462cdaa288f102690c2b8e9ae934ce582a9d9ddd7bd909c562506d45a66662e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://www.reliaquest.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 18 Feb 2022 08:57:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
access-control-max-age: 7200
vary: Accept, Origin, Accept-Encoding
x-request-id: d8ed30f0-821c-4d10-b946-53fc2965bdc2
x-runtime: 0.039318
referrer-policy: no-referrer-when-downgrade
etag: W/"462cdaa288f102690c2b8e9ae934ce58"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.reliaquest.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true

GET
H2 200 box-acca23410e696f2ca3087d947271c3d0.html Show response
vars.hotjar.com/ Frame F331 2 KB
1 KB 37ms
10ms Document
text/html 108.157.4.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-acca23410e696f2ca3087d947271c3d0.html
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2441060.js?sv=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-53.dus51.r.cloudfront.net
Software: /
Resource Hash: e0f23d16bb40b894855d19e097cc0b9f4695b98a7db1fed18625cfb1ce8bda35

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/

Response headers

content-type: text/html
content-length: 1044
date: Fri, 04 Feb 2022 08:52:06 GMT
accept-ranges: bytes
cache-control: max-age=31536000
content-encoding: br
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
etag: "6f65fac4e8efe167ff5132c0c54c5729"
last-modified: Fri, 04 Feb 2022 08:51:39 GMT
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 fa544a973edca8926f95609301f23b66.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-P2
x-amz-cf-id: pQWaNb2CZCKmZb4qMVaLX-SBSZtQHXK03k8qV2VY5ScgvOomZ61H_Q==
age: 1209903

GET
H/1.1 200
OK / Show response
c.6sc.co/ 47 B
374 B 630ms
7ms XHR
text/plain 104.92.74.202
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-92-74-202.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7bf24330f3489cc5a7b43f8cc020f5ba15c92dea9721bc52f11defe9d8f542a0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 08:57:09 GMT
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: text/plain
Access-Control-Allow-Origin: https://www.reliaquest.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 47

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 660ms
38ms Script
text/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NPQTDR

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 4936
date: Fri, 18 Feb 2022 07:34:53 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Fri, 18 Feb 2022 09:34:53 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 38 KB
12 KB 648ms
28ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NPQTDR
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 8540c5e2d2e85cc6c5d46b1b06b7f6642dce39e0314299a08976cfe6053c7c52

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:09 GMT
content-encoding: gzip
last-modified: Wed, 09 Feb 2022 23:54:49 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 58170ECA621547899D1ADAD7C62E58B8 Ref B: FRAEDGE1216 Ref C: 2022-02-18T08:57:09Z
etag: "806a236c101ed81:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 11333

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 99 KB
27 KB 626ms
7ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

27bcdc67e32fef9bdd86b785b1bafadd7f6915c49f6b49bed86bfbddf414b2f8

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 26236
x-xss-protection: 0
pragma: public
x-fb-debug: BiVIDloRvaNFeRNG3L8x9cF3TFhWy+HCbQwJTTRgdUm2tH2gyr9spmcEjaWJRoI9EGNKtaY65FlOD6vkv8bkgg==
x-fb-trip-id: 917726464
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Fri, 18 Feb 2022 08:57:09 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 ss.js Show response
koi-3qn67979n8.marketingautomation.services/client/ 12 KB
5 KB 728ms
109ms Script
application/javascript 130.211.21.179
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://koi-3qn67979n8.marketingautomation.services/client/ss.js?ver=1.1.1
Requested by: Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.21.179 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 179.21.211.130.bc.googleusercontent.com
Software: openresty /
Resource Hash: 926f767fec2a5ed3a610735fde7861c24c9c15fa136d9a85d111c2b9ec4a0fa0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:09 GMT
content-encoding: gzip
last-modified: Wed, 16 Feb 2022 16:02:15 GMT
server: openresty
etag: W/"620d2007-2fc8"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 google
cache-control: max-age=604800, public
alt-svc: clear
expires: Fri, 25 Feb 2022 08:57:09 GMT

GET
H2 404 fs.js
www.fullstory.com/s/ 0
0 626ms
8ms Script
text/html 2a05:d014:275:cb00:ce75:162:d945:5f34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fullstory.com/s/fs.js
Requested by: Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a05:d014:275:cb00:ce75:162:d945:5f34 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H/1.1 200
OK getuidj Show response
secure.adnxs.com/ 11 B
696 B 676ms
66ms XHR
application/json 185.33.221.91
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.91 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Feb 2022 08:57:09 GMT
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 721.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 5a9a20a8-d0d3-421f-8105-12cf50ecdd5a
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.reliaquest.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 11
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK / Show response
c.6sc.co/ 47 B
374 B 617ms
7ms XHR
text/plain 104.92.74.202
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-92-74-202.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7bf24330f3489cc5a7b43f8cc020f5ba15c92dea9721bc52f11defe9d8f542a0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 08:57:09 GMT
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: text/plain
Access-Control-Allow-Origin: https://www.reliaquest.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 47

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 718ms
195ms Image
image/gif 104.92.74.202
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=cdfe02635f87832f7fb37442e2a57166&svisitor=null&session=c667406e-9d9c-4a2a-8b25-b5636097865c&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Fri%2C%2018%20Feb%202022%2008%3A57%3A09%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Blackbyte%20is%20a%20newly%20identified%20ransomware-as-a-Service%20operation%20configured%20to%20use%20%27double-extortion%27%20techniques%20based%20on%20an%20available%20%27leaks%27%20website.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Threat%20Advisory%3A%20Blackbyte%20Ransomware%20-%20ReliaQuest%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F&pageViewId=f4a65550-d461-4a54-85f3-238a716f87d7

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-92-74-202.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 08:57:09 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Tue, 05 Oct 2021 22:17:52 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "615ccf10-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 431 B
421 B 25ms
10ms XHR
application/json 35.159.4.142
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.159.4.142 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-159-4-142.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 43b21a37ead752a35feeeb473aecb119bc2b63800594adc825bcb903b81f23da

Request headers

Authorization: Token 9d9682d9d7358cc3cb8a55dfb8b3412e24d01fad
Referer: https://www.reliaquest.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:09 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.reliaquest.com
access-control-allow-credentials: true
content-length: 234

GET
H2 200 core Show response
js.driftt.com/ Frame 1EA3 2 KB
1 KB 115ms
115ms Document
text/html 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1645174800000/uvut6nv3vzk9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

c7ce9129d72ef25d747bb326a8c890c9c0bd660cfff4acb7ce7882466eafd9f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/

Response headers

content-type: text/html; charset=utf-8
server: nginx
last-modified: Tue, 15 Feb 2022 17:02:15 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: YgXu6fP05x6x0lIk4qfWH69bfIprEZaM
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
date: Fri, 18 Feb 2022 08:57:09 GMT
cache-control: no-cache
etag: W/"9ad51941690debd31237e07886c4a820"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: 0gGx8JdA5RLzH3veenxkm3iJY53X-4qWyV95exFgv_16YhBCxE0UHQ==

GET
H2 200 chat Show response
js.driftt.com/core/ Frame 35C7 2 KB
1 KB 116ms
116ms Document
text/html 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1645174800000/uvut6nv3vzk9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

c7ce9129d72ef25d747bb326a8c890c9c0bd660cfff4acb7ce7882466eafd9f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/

Response headers

content-type: text/html; charset=utf-8
server: nginx
last-modified: Tue, 15 Feb 2022 17:02:15 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: YgXu6fP05x6x0lIk4qfWH69bfIprEZaM
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
date: Fri, 18 Feb 2022 08:57:09 GMT
cache-control: no-cache
etag: W/"9ad51941690debd31237e07886c4a820"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: tmvp3Mowjpw2OqBe0sztPW23IhkQDyuBSmCHzuxIQeUZX-oj8yH1YA==

GET
H/1.1 200
OK cc
cc.swiftype.com/ 43 B
279 B 404ms
130ms Image
image/gif 169.48.219.66
SOFTLAYER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.swiftype.com/cc?url=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F&engine_key=mem9FyxrXEYGGiK8QqW8
Requested by: Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 169.48.219.66 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: 42.db.30a9.ip4.static.sl-reverse.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 08:57:10 GMT
Cache-Control: no-cache
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 18 Feb 2022 08:57:09 GMT

OPTIONS
H2 200 init
jukebox.pathfactory.com/api/public/v1/ Frame 0
0 737ms
100ms Preflight 3.225.225.252
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jukebox.pathfactory.com/api/public/v1/init?clientId=LB-97DF08AC-10844&image=&title=&url=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.225.225.252 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-225-225-252.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: https://www.reliaquest.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Fri, 18 Feb 2022 08:57:09 GMT
access-control-allow-origin: https://www.reliaquest.com
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-expose-headers
access-control-max-age: 7200
access-control-allow-credentials: true
access-control-allow-headers: content-type

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 482ms
9ms Preflight 35.159.4.142
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.159.4.142 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-159-4-142.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization
Origin: https://www.reliaquest.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Fri, 18 Feb 2022 08:57:09 GMT
server: nginx
access-control-allow-origin: https://www.reliaquest.com
access-control-allow-credentials: true
access-control-max-age: 1800
access-control-allow-methods: OPTIONS,GET
access-control-allow-headers: authorization

GET
H/1.1 200
OK new_embed-20cee04df5c6e7e2687598f076a0147d.css
s.swiftypecdn.com/assets/ 89 KB
34 KB 7ms
6ms Stylesheet
text/css 151.101.128.143
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://s.swiftypecdn.com/assets/new_embed-20cee04df5c6e7e2687598f076a0147d.css
Requested by: Host: s.swiftypecdn.com
URL: https://s.swiftypecdn.com/install/v2/st.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.128.143 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 291b8f746f5fb8ef8dff392fee9cfabc7921aec0335fc4e15cd2633aeb383db2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 08:57:09 GMT
Content-Encoding: gzip
Age: 127549
X-Cache: HIT
X-Cache-Hits: 2649
Connection: keep-alive
Content-Length: 33977
X-Served-By: cache-hhn4076-HHN
Access-Control-Allow-Origin: *
X-Timer: S1645174630.763632,VS0,VE0
ETag: "5d5f00b8-84b9"
Vary: Accept-Encoding
Content-Type: text/css
Via: 1.1 varnish
Cache-Control: max-age=31536000, public
Accept-Ranges: bytes
Expires: Thu, 16 Feb 2023 21:31:20 GMT

POST
H/1.1 200
OK visitWebPage
438-kyk-786.mktoresp.com/webevents/ 2 B
311 B 705ms
104ms Ping
text/plain 192.28.144.124
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://438-kyk-786.mktoresp.com/webevents/visitWebPage?_mchNc=1645174629764&_mchCn=&_mchId=438-KYK-786&_mchTk=_mch-reliaquest.com-1645174629763-42459&_mchHo=www.reliaquest.com&_mchPo=&_mchRu=%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F&_mchPc=https%3A&_mchVr=161&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/161/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 08:57:10 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: 753a9a10-f4b9-44a0-8dd9-9f8bd154caa1

GET
H3 200 1812519255633519 Show response
connect.facebook.net/signals/config/ 307 KB
87 KB 68ms
59ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1812519255633519?v=2.9.52&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

10942ce68f3786755833e291b8c0e806cd381d73a57f9666e5494e3bb533eb64

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: BvneKYktrcIi3Af93Vs2xHdUsmhWcXurCUk0SyuPSts5K7hKaktg5LAmpX0k+sxi3vyLsvybZu+HxImpJAbmkg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Fri, 18 Feb 2022 08:57:09 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 fontawesome-webfont.woff2
maxcdn.bootstrapcdn.com/font-awesome/4.6.1/fonts/ 69 KB
70 KB 31ms
21ms Font
font/woff2 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/fonts/fontawesome-webfont.woff2?v=4.6.1

Requested by

Host: maxcdn.bootstrapcdn.com
URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d3ebb498192527b985939ae62cc4e5eb5c108efc1896184126b45d866868e73d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css
Origin: https://www.reliaquest.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:09 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 617, 617
age: 957276
cdn-cachedat: 2021-06-08 14:28:36
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 70728
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: font/woff2
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 62262b48614672f0e8c18799d09ac1af
accept-ranges: bytes
cf-ray: 6df60bdc79b69159-FRA
cdn-requestcountrycode: US
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 7e3bcccbe9be6061a65a6eb142929580.js Show response
nexus.ensighten.com/choozle/15024/code/ 2 KB
558 B 8ms
8ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/15024/code/7e3bcccbe9be6061a65a6eb142929580.js?conditionId0=421905
Requested by: Host: www.reliaquest.com
URL: https://www.reliaquest.com/wp-content/cache/min/1/choozle/15024/Bootstrap.js?ver=1645137249
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 9186ad0839410bf3d20f3c5b242b36027562baac85ffb8cba18b50b6e4d7945d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:09 GMT
content-encoding: gzip
last-modified: Tue, 24 Aug 2021 16:51:06 GMT
server: nginx
etag: W/"6125237a-746"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
16 KB 128ms
40ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.reliaquest.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 16 Feb 2022 17:56:19 GMT
x-content-type-options: nosniff
age: 140450
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 16 Feb 2023 17:56:19 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
15 KB 135ms
49ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.reliaquest.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 11 Feb 2022 09:48:03 GMT
x-content-type-options: nosniff
age: 601746
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 11 Feb 2023 09:48:03 GMT

GET
H2 200 134470029.js Show response
bat.bing.com/p/action/ 686 B
783 B 1761ms
1761ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/p/action/134470029.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ARR/3.0
Resource Hash: 61949f8baab66ddadf9a8c14424b78715b9b9654ef3b882bc0ce3888a64632d9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Feb 2022 08:57:10 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CEE657C8CEAF498792995DD42FD3A6F8 Ref B: FRAEDGE1216 Ref C: 2022-02-18T08:57:09Z
x-powered-by: ARR/3.0
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-store,no-cache
content-length: 590

GET
H2 204 0
bat.bing.com/action/ 0
150 B 30ms
30ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=134470029&tm=gtm002&Ver=2&mid=6b7c6010-e677-4879-b9e1-908241dcf147&sid=c1975de0909811ecaceb8315a23737fc&vid=c1976300909811ec9dcee93cd7afe0ab&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Threat%20Advisory%3A%20Blackbyte%20Ransomware%20-%20ReliaQuest&p=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F&r=&lt=1334&evt=pageLoad&msclkid=N&sv=1&rn=619154
Requested by: Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Feb 2022 08:57:09 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: AE2EAB8DF9E74BC19B554716E0C5B4A0 Ref B: FRAEDGE1216 Ref C: 2022-02-18T08:57:09Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK insight.old.min.js Show response
snap.licdn.com/li.lms-analytics/ 5 KB
2 KB 67ms
67ms Script
application/x-javascript 2a03:5f80:a::b212:e7d1
DATAIX-AS Peering...

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:5f80:a::b212:e7d1 , Russian Federation, ASN50952 (DATAIX-AS Peering Ltd., RU),
Reverse DNS
Software: /
Resource Hash: fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 08:57:09 GMT
Content-Encoding: gzip
Last-Modified: Wed, 16 Feb 2022 23:50:54 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=47752
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2036

GET
H2 200 i Show response
scout.salesloft.com/ 48 B
513 B 98ms
97ms XHR
application/json 3.208.158.149
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://scout.salesloft.com/i

Requested by

Host: scout-cdn.salesloft.com
URL: https://scout-cdn.salesloft.com/sl.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.208.158.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-208-158-149.compute-1.amazonaws.com

Software

Resource Hash

d872b4fb8c3c09ef3e1d75ddd63ec0e93260ab406ebc57079d8c85f9f38ce06e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:09 GMT
strict-transport-security: max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.reliaquest.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
content-length: 48
x-request-id: 8d0e499f2a249284427266a8370004e9

GET
H2 200 i Show response
scout.salesloft.com/ 48 B
512 B 97ms
97ms XHR
application/json 3.208.158.149
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://scout.salesloft.com/i

Requested by

Host: scout-cdn.salesloft.com
URL: https://scout-cdn.salesloft.com/sl.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.208.158.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-208-158-149.compute-1.amazonaws.com

Software

Resource Hash

857a56d6b671208c542d51f78d02ff88e586c6996d186cb4b6517acd6b5d2a36

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:09 GMT
strict-transport-security: max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.reliaquest.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
content-length: 48
x-request-id: d5b436ac8fef3a8da85e2e6dac708d99

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 93ms
46ms XHR
text/plain 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1381230931&t=pageview&_s=1&dl=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F&ul=en-us&de=UTF-8&dt=Threat%20Advisory%3A%20Blackbyte%20Ransomware%20-%20ReliaQuest&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBACAABBAAAAC~&jid=1463785018&gjid=976344702&cid=1617449117.1645174630&tid=UA-10904891-3&_gid=405862885.1645174630&_r=1&gtm=2wg2g0NPQTDR&z=372811422

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.reliaquest.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 18 Feb 2022 08:57:09 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reliaquest.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 83ms
40ms Image
image/gif 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1381230931&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F&ul=en-us&de=UTF-8&dt=Threat%20Advisory%3A%20Blackbyte%20Ransomware%20-%20ReliaQuest&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=YGDACAABBAAAAC~&jid=&gjid=&cid=1617449117.1645174630&tid=UA-10904891-3&_gid=405862885.1645174630&gtm=2wg2g0NPQTDR&cd1=&cd2=&cd3=Sweden&cd5=&cd7=&z=1714610339

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Feb 2022 13:01:58 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 71711
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 200 visit-data Show response
in.hotjar.com/api/v2/client/sites/2441060/ 146 B
323 B 111ms
36ms XHR
application/json 54.171.89.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://in.hotjar.com/api/v2/client/sites/2441060/visit-data?sv=5
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.7d6d0311dc6eb2c0bc38.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.171.89.80 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-171-89-80.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: bd50219667293fd4ee2c24ca0ab2140a609854fc6b1facb507cbf1d5d1a5effd

Request headers

Referer: https://www.reliaquest.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Fri, 18 Feb 2022 08:57:10 GMT
content-encoding: br
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store
access-control-allow-credentials: true

GET
H/1.1 200
OK cc.js
cc.swiftype.com/ 43 B
279 B 275ms
126ms Image
image/gif 169.48.219.66
SOFTLAYER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.swiftype.com/cc.js?engine_key=Qva3WYi531y42RW9Z42q&url=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F
Requested by: Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 169.48.219.66 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: 42.db.30a9.ip4.static.sl-reverse.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 08:57:10 GMT
Cache-Control: no-cache
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 18 Feb 2022 08:57:09 GMT

GET
H2 200 runtime~main.97f2beae.js Show response
js.driftt.com/core/assets/js/ Frame 1EA3 6 KB
3 KB 8ms
7ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

85e7661a2ff868a598b2bf29ce05049c4e8fb2ee5568225336ab0905eda3c1c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 15 Feb 2022 17:02:15 GMT
content-encoding: gzip
age: 230095
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 15 Feb 2022 16:32:51 GMT
server: nginx
etag: W/"e98d07fcdf7d8417fe82a7abe72d5a81"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 268DsMAV4jIZyDLIp96l6zy67R3wv6qm
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 6iwvjTPRCvpaABBK1V5F6WMpWXqYDAeA6x9buJM4qTMchTPiDpwtZA==

GET
H2 200 5.b4ccdd57.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 1EA3 58 KB
20 KB 9ms
8ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/5.b4ccdd57.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

9d8f8c89a5f7c90adc5196d1c10fe3e8c46d16cb8d24de13ade83de53183027d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:18 GMT
server: nginx
etag: W/"bf2b7dc96b40587d388df8918a276f1d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: rlqnQvHWjB4kDZlydkAKa7LRajgzy9Gl
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: FAbVSoUHb5xHcChaR3FPR1rH5x-EI09grA_Z_DPWv7-GDBJLILuRxw==

GET
H2 200 main~493df0b3.91d188cd.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 1EA3 6 KB
3 KB 9ms
9ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~493df0b3.91d188cd.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

dcfc540946183ee12e6ccb43e706ad1a30b4f0205c25adcfa316829075f94a31

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:19 GMT
server: nginx
etag: W/"364091b90499473799e7470f551ae597"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 1JY.0LVfNng8iNIWI44BrilEq.Gn8MTC
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 4cRj54ka0sGMFIajHv7VeUIYLwNKPwtvRoW29abFpLnX2MT0G8Vvug==

GET
H2 200 /
www.facebook.com/tr/ 44 B
295 B 24ms
8ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1812519255633519&ev=PageView&dl=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F&rl=&if=false&ts=1645174630070&sw=1600&sh=1200&v=2.9.52&r=stable&ec=0&o=30&fbp=fb.1.1645174630069.1308828824&it=1645174629794&coo=false&exp=p1&rqm=GET

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:10 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length: 44
expires: Fri, 18 Feb 2022 08:57:10 GMT

GET
H2 200 runtime~main.97f2beae.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 6 KB
3 KB 8ms
7ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

85e7661a2ff868a598b2bf29ce05049c4e8fb2ee5568225336ab0905eda3c1c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 15 Feb 2022 17:02:15 GMT
content-encoding: gzip
age: 230095
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 15 Feb 2022 16:32:51 GMT
server: nginx
etag: W/"e98d07fcdf7d8417fe82a7abe72d5a81"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 268DsMAV4jIZyDLIp96l6zy67R3wv6qm
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: bRHDNc9kYJgX7kKYpSP4hBbE9dnSGnYsdPU9W-Yu_SRNnjKxcz57Og==

GET
H2 200 5.b4ccdd57.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 58 KB
20 KB 9ms
8ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/5.b4ccdd57.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

9d8f8c89a5f7c90adc5196d1c10fe3e8c46d16cb8d24de13ade83de53183027d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:18 GMT
server: nginx
etag: W/"bf2b7dc96b40587d388df8918a276f1d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: rlqnQvHWjB4kDZlydkAKa7LRajgzy9Gl
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: SIoL1pOBAqd_1hutlATa-FpPb4zN2bzocg5FKUYwjkvaf7GcanDnWg==

GET
H2 200 main~493df0b3.91d188cd.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 6 KB
3 KB 10ms
9ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~493df0b3.91d188cd.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

dcfc540946183ee12e6ccb43e706ad1a30b4f0205c25adcfa316829075f94a31

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:19 GMT
server: nginx
etag: W/"364091b90499473799e7470f551ae597"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 1JY.0LVfNng8iNIWI44BrilEq.Gn8MTC
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: zrd7VPcLEjrlzo3azwNMGga6CHzFs0oSCWKYgdLJ6SqHAFR-LBBaDw==

POST
H2 200 content Show response
ws29.hotjar.com/api/v2/sites/2441060/recordings/ 66 B
258 B 352ms
78ms XHR
application/json 52.210.97.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ws29.hotjar.com/api/v2/sites/2441060/recordings/content
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.7d6d0311dc6eb2c0bc38.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.97.70 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-97-70.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: b368fa48f6ea18e7727db43df597fce82a998eab83ef5b0bccd8a0b4ba203710

Request headers

Referer: https://www.reliaquest.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Fri, 18 Feb 2022 08:57:10 GMT
content-encoding: br
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store
access-control-allow-credentials: true

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 194ms
194ms Image
image/gif 104.92.74.202
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=cdfe02635f87832f7fb37442e2a57166&svisitor=0f58655f5f5e0000645f0f629e030000537e0300&session=c667406e-9d9c-4a2a-8b25-b5636097865c&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2018%20Feb%202022%2008%3A57%3A10%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2018%20Feb%202022%2008%3A57%3A09%20GMT%22%2C%22timeSpent%22%3A%221053%22%2C%22totalTimeSpent%22%3A%221053%22%7D&isIframe=false&m=%7B%22description%22%3A%22Blackbyte%20is%20a%20newly%20identified%20ransomware-as-a-Service%20operation%20configured%20to%20use%20%27double-extortion%27%20techniques%20based%20on%20an%20available%20%27leaks%27%20website.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Threat%20Advisory%3A%20Blackbyte%20Ransomware%20-%20ReliaQuest%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F&pageViewId=f4a65550-d461-4a54-85f3-238a716f87d7&an_uid=0

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-92-74-202.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 08:57:10 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Tue, 05 Oct 2021 22:17:52 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "615ccf10-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
444 B 70ms
16ms XHR
text/plain 2a00:1450:400c:c0c::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-10904891-3&cid=1617449117.1645174630&jid=1463785018&gjid=976344702&_gid=405862885.1645174630&_u=YGBACAAABAAAAC~&z=293176057

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.reliaquest.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Fri, 18 Feb 2022 08:57:10 GMT
content-type: text/plain
access-control-allow-origin: https://www.reliaquest.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3664348&time=1645174630110&url=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3664348%26time%3D1645174630110%26url%3Dhttps%253A%252F%252Fwww.reliaquest.com%252...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3664348&time=1645174630110&url=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F&liSync=true
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3664348&time=1645174630110&url=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F&liSync=true&e_ipv6=AQKR8MbKMs0pk...

0
277 B

293ms
104ms

Image
application/javascript

108.174.10.24
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3664348&time=1645174630110&url=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F&liSync=true&e_ipv6=AQKR8MbKMs0pkQAAAX8MDKjodakiop-L1BBgn3w3OPRqgPd89bgyJ1Ap_cXrx--_cgmAousV
Requested by: Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
Protocol: HTTP/1.1
Server: 108.174.10.24 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS: 108-174-10-24.fwd.linkedin.com
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 08:57:10 GMT
Server: Play
LinkedIn-Action: 1
Content-Type: application/javascript
X-LI-Proto: http/1.1
Connection: keep-alive
X-Li-Pop: prod-lva1-x
content-length: 0
X-LI-UUID: AAXYRxF4UFDqux0LUO9OEw==
X-Li-Fabric: prod-lva1

Redirect headers

date: Fri, 18 Feb 2022 08:57:10 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 0924E4B1F5AC4A9DB6A7F748D5DAF5F8 Ref B: VIEEDGE2914 Ref C: 2022-02-18T08:57:10Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3664348&time=1645174630110&url=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F&liSync=true&e_ipv6=AQKR8MbKMs0pkQAAAX8MDKjodakiop-L1BBgn3w3OPRqgPd89bgyJ1Ap_cXrx--_cgmAousV
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXYRxFzlMQxKJA81gzB1A==

GET
H2 200 43.bf52ab96.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 1EA3 47 KB
14 KB 8ms
7ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/43.bf52ab96.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

bd713db29fb234eb7584927050df71683e11b7b72bda4fcf72a88f8a7ff2f56d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"4ab965f0d26a973cf1be72a39d537999"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: SIJLtOk7PXIgJIf54NBJQngGjZ1AQW3g
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: hDmcK6z_TUvcqxHL-BwEf6Mn-4L95x_o72Win9FP9QuS_sevETZb3A==

GET
H2 200 18.8ef42267.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 1EA3 44 KB
13 KB 9ms
8ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/18.8ef42267.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

49c6f7925a020059af53cab3baa5d2ea485e6807744ba07f1b2e90ee47266a44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"0c6f51f22b2a4bddd966a92b56c18e29"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Zug6jTznDFRyogFlBOnxjireRPUkSHKT
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 3WH2XV6Q6VAMK2UWeEBdWKHRzUh32wgIZLBjVdNdXx7JS030aaH0-A==

GET
H2 200 37.dc112dfd.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 1EA3 25 KB
8 KB 9ms
9ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/37.dc112dfd.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

9cd7629d2e66537eb15542646bfd16cd461aaf18592c35f19ce7d67ada586635

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"391f6f28819c5b154653979d5154c888"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: A01_.TOyslfHN6C7mHM2iYp5F_NuODuW
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Um1JPDX91vVeQ-gSIGk67epq-0XHcs6eyG4m8WcqRfxpgjFH7VY1Tw==

GET
H2 200 16.10d76686.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 1EA3 16 KB
5 KB 10ms
9ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/16.10d76686.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

1cbf80f7d71564dc48af2c5d6bb5d15fc2aec0d541101c5eedf84bad1b908cab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
content-encoding: gzip
age: 3863008
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"c16e855d0a26bf91ae3cc32cdbfa3ad6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: mzB2ul0u_48ftIGEd6phwcoTfextzATL
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ve3NBui49r-O_gy7IKaaMPel5vWuFyocKHs01Mlq6zdBguPYNS5PIw==

GET
H2 200 21.8ac5d777.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 1EA3 72 KB
22 KB 11ms
11ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/21.8ac5d777.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

4038a666dfd5af607a0374ad6e934cf1007e78da69329dbc341eaf757bb38beb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:43 GMT
content-encoding: gzip
age: 3863007
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"c39414a669b98ba4a25856ccdc1c1c1b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: PmO9yEa8J.DEQa9FEB2tMN_1Ccd5vo_f
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: EG61LIhDLkryQ1S7IFMW90rB8faEgN3t8Y5MtLLVghT_ZZ9IlwYk5A==

GET
H2 200 34.801d3c89.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 1EA3 16 KB
6 KB 12ms
11ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/34.801d3c89.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

e41e2b5c9df3073d6f7da0080ad2f3eca4994ab372d2f65fa76b14f8868663ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"fa218b0849860dbc5ceda153316c9c38"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: VLd3KMbDPd6s2pCiJkiLNxZPlKywvnnH
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: -mC3CAYTbTUJ6mdNxLFSvbqeXNYDVBzZ8la7ER6LzghnR6a3w0ktjw==

GET
H2 200 23.a53d721f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 1EA3 59 KB
19 KB 14ms
14ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/23.a53d721f.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

f48829864ffd155da0360e19be956282b6875173f8990394e93bc7c30c97a3ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 28 Dec 2021 01:13:03 GMT
content-encoding: gzip
age: 4520647
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 23 Dec 2021 18:12:25 GMT
server: nginx
etag: W/"fe96cb8c4c390342c29d3c8cb0a4ca14"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: a7WvmR.vwHMPBFEqQ8riDzB0H8J4vers
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 2wwu0d6c4NklSczY-v2DgQwT_vXp4xCKX9CZ47DgiIj_UahseU8QMQ==

GET
H2 200 11.8d62d6c4.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 1EA3 91 KB
28 KB 15ms
15ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/11.8d62d6c4.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

1cf451d2d8d425375505bd10c5540e8e5cce3cbbd5932be038285d8b6a650e63

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:16 GMT
server: nginx
etag: W/"8199a8634768214fc6204b18351f842d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: p_YagIEBvf.Qgp7hIJy74.J4YIszefj5
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: cI2VAYPCWwE9cwbHFktZfj8Y3vPo1E3yKyoNAI7WKkNk7kdSWl1_sw==

GET
H2 200 10.937b0755.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 1EA3 24 KB
7 KB 16ms
16ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/10.937b0755.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

e868d39bbb74d42dffcee0cb1a50ecd105e1a1737d9080246dbdd54a8206d8f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
content-encoding: gzip
age: 3863008
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:16 GMT
server: nginx
etag: W/"e9243456e8ca8af97d77d525d5367d6b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 1OI8MdaO_2Zet9LQGrgpik7z8k_2AhIl
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: PvD1ciHYTq6axsBpqHLgOu5Lay1XGqRzfnwvv6SHOetYAeeD6ovvPg==

GET
H2 200 14.2a01ddd6.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 1EA3 62 KB
20 KB 16ms
16ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/14.2a01ddd6.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

ef593584d9432b51ed1cec6f58f844bfa6f81ef0fe27fd9404e400e1346fa09b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"6f457384188c98017d8d27281f3df6ad"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: KpoEpDmO7G9TLWLfSTzA1dytLAyREIfM
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 1lOXBUC7FB47xCEekmZFa_mt5zHnxHrCELmeCLyMOXrlud1GfjhnGQ==

GET
H2 200 41.ef07ba02.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 1EA3 105 KB
34 KB 17ms
16ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/41.ef07ba02.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

160371118ad2e4d470bc6801bb253ec18332e7b6fb7225bb6d365a99bdb99d22

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"da03c1012cb0aaeb2041fa677a272d14"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 6OpxVYvZjRVHdu0KjdhZlusmExqFlB4E
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: IqO_rqlBGJ1ro0VuFmLLiYj2LrrTbukZSpxAXDRC5mitoyv0PUGfrw==

GET
H2 200 35.0810b4b3.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 1EA3 12 KB
4 KB 18ms
18ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/35.0810b4b3.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

05c1b18ed199fea9af5168c7769dff2cd69f02706fa2568ab2e305be8dfb9c52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"4a61646db5420cc31cb60b9287d9f544"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: wDOiuCZSfZ.KHqNETPwI3S2a9GU0lEIR
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: DjCJTFsjeAWDIqYHqhL6JTzjdw5qrqBj6FoOKb0QhW8nJN2Rryr9bA==

GET
H2 200 26.d9eb886e.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 1EA3 12 KB
5 KB 18ms
18ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/26.d9eb886e.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

b9ddcbc73a2a42b603661b51028d38aba3374f67385f3307e1cfcebdee2f4838

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"44c7301d8127e805fcdfcc1b00ddf2ea"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: EjkJtX0HE9ajSK4icA5a46UNajNAQcku
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 6Ad1STWm82_TMzEsn6WiJrF3UqTjVg1Qh9oD7A4MXfeNhu0b3MasZg==

GET
H2 200 17.6c3c965c.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 1EA3 17 KB
7 KB 19ms
19ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/17.6c3c965c.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

a5ad436c025c2a03ccc5672aed9469ac98d22b73df5b1d20ed2adb46c0c4daf9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"b0b166b8ed88c90ea3dc07661d0dcff4"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: HHiN6wsTfDikx0BfRvhzq1f1VEBLDIa4
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 1_rt6Rw0qagFDjDdh3IyNE5DmgkdtL-E4CD9TAMlrzx3Q03vE_cnCw==

GET
H2 200 8.5b0bb1c3.chunk.css
js.driftt.com/core/assets/css/ Frame 1EA3 11 KB
3 KB 19ms
19ms Stylesheet
text/css 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/8.5b0bb1c3.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

d36d8a76a8b7d7fe8655db34eb54e4a4b6d422cdd1a67810d3dd5c014edb14e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:15 GMT
server: nginx
etag: W/"a123c5b36f16fe6d3a3129e24df81443"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: _wlNEHOawmowSdlpT1GApwIIwlk.3B3i
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ooQrl4mQkiM7WF19aaQXmBYqhkrPFs1tZUUd9JXeFj1YEfJKkvU0nw==

GET
H2 200 8.c30eb26a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 1EA3 69 KB
22 KB 19ms
19ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/8.c30eb26a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

6068d230ddc2a94a269034dab608f9966fec8531b5e00c006634c8d725b3765c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 09 Feb 2022 15:29:03 GMT
content-encoding: gzip
age: 754087
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 09 Feb 2022 15:13:08 GMT
server: nginx
etag: W/"a75f570fd77fc567c56e5c7fdad25d77"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: taRffhX16zK2eZuMfxLJC70jbfGAjmFM
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Rl5qvKjaMIfROopKGxkMu9QGhRMkdNL-hQBagwYmBWxwd63onRfZzw==

GET
H2 200 15.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame 1EA3 24 B
666 B 21ms
21ms Stylesheet
text/css 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/15.22abfce0.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 24
last-modified: Tue, 04 Jan 2022 15:08:15 GMT
server: nginx
etag: "0c5dad92482d9a7c7c253510f5082465"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: bzo2zbrJexGHlTPaLulG8N5yfdXT7FR0
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: BCxIRRI_hXuV7Fkd9uW4RuXOc382H3Zj_lvAK_iuFeG9xkuQhsZ0IA==

GET
H2 200 15.1d8f5012.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 1EA3 75 KB
19 KB 22ms
21ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/15.1d8f5012.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

93ca03195ed4c9536d694584455be6d5d71776e00fe33926ae596bfe4f35a76a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 04 Feb 2022 14:43:02 GMT
content-encoding: gzip
age: 1188848
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 04 Feb 2022 14:40:29 GMT
server: nginx
etag: W/"a10801df313ae6aee5353f1d56ee158d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: KAn62QiCijDwsq5BJEU9_1eTMFOTCVrB
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: e2fx6zgX6BXIJo6Dqs8UCJeXd_ByF2AUY_G2SD43CN2Kv6wpN8NM7A==

GET
H2 200 22.947209a2.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 1EA3 47 KB
13 KB 23ms
23ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/22.947209a2.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

a3940c0c7051093e974422b42f2a563671ed810418862f44e8314f5255367e7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 04 Feb 2022 14:43:02 GMT
content-encoding: gzip
age: 1188848
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 04 Feb 2022 14:40:29 GMT
server: nginx
etag: W/"d06d1a64be2b2e5ab91bedd7c4c17717"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: k7zUF0pgH6bmYsPK._H98sqTvr7U2rBt
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: FHw70RrmKakESCwSgu1KhY2a7F0XvyEZPna2KyLI-MzVTucl6dPpzw==

GET
H2 200 13.014e96bd.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 1EA3 41 KB
13 KB 24ms
24ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/13.014e96bd.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

5663a7a55772ac03276f27f2cf05b093c71c6b79c1bf8b7e071b3621b8126f4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 15 Feb 2022 17:02:15 GMT
content-encoding: gzip
age: 230095
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 15 Feb 2022 16:32:48 GMT
server: nginx
etag: W/"0ee44fe830a2d282378c97205f753960"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: eTrq2_ygCQ8X0KEyQ2jeWW6y8G2tanE7
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: VLhTJIcaz17aTKdIFuUGzyBMzbHrbTwhCse-Q5CjUc2M6K1yAMPZQA==

GET
H2 200 43.bf52ab96.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 47 KB
14 KB 22ms
21ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/43.bf52ab96.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

bd713db29fb234eb7584927050df71683e11b7b72bda4fcf72a88f8a7ff2f56d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"4ab965f0d26a973cf1be72a39d537999"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: SIJLtOk7PXIgJIf54NBJQngGjZ1AQW3g
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: z1JXR4KWpbU-QSxxh0LBZ59r38RbS2617WlcaNT1eRyUAOPRgyWYng==

GET
H2 200 18.8ef42267.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 44 KB
13 KB 22ms
22ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/18.8ef42267.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

49c6f7925a020059af53cab3baa5d2ea485e6807744ba07f1b2e90ee47266a44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"0c6f51f22b2a4bddd966a92b56c18e29"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Zug6jTznDFRyogFlBOnxjireRPUkSHKT
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: FfprPubGRGLISqtVdMKK4qgUi-GLRVoF14ed9fKiu9wdTMIr2Uyv8A==

GET
H2 200 37.dc112dfd.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 25 KB
8 KB 22ms
22ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/37.dc112dfd.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

9cd7629d2e66537eb15542646bfd16cd461aaf18592c35f19ce7d67ada586635

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"391f6f28819c5b154653979d5154c888"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: A01_.TOyslfHN6C7mHM2iYp5F_NuODuW
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: VTuOT1WOHPBI4N43U6qjnoXjT-mHtXZl5rxK4V02iOqfUkKdOVKXvQ==

GET
H2 200 16.10d76686.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 16 KB
5 KB 23ms
22ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/16.10d76686.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

1cbf80f7d71564dc48af2c5d6bb5d15fc2aec0d541101c5eedf84bad1b908cab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
content-encoding: gzip
age: 3863008
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"c16e855d0a26bf91ae3cc32cdbfa3ad6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: mzB2ul0u_48ftIGEd6phwcoTfextzATL
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: aNb79q4uAhApOddO1Wwm2raICi8blUpmObqW-ri6ZCaxxK5E0_yLVg==

GET
H2 200 21.8ac5d777.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 72 KB
22 KB 24ms
22ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/21.8ac5d777.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

4038a666dfd5af607a0374ad6e934cf1007e78da69329dbc341eaf757bb38beb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:43 GMT
content-encoding: gzip
age: 3863007
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"c39414a669b98ba4a25856ccdc1c1c1b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: PmO9yEa8J.DEQa9FEB2tMN_1Ccd5vo_f
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: tBBqMFqJ3QWZiGF2tmzpIHDMOhLbL2HSaaJMYtgeL5a18eXjZfIn6g==

GET
H2 200 34.801d3c89.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 16 KB
6 KB 25ms
20ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/34.801d3c89.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

e41e2b5c9df3073d6f7da0080ad2f3eca4994ab372d2f65fa76b14f8868663ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"fa218b0849860dbc5ceda153316c9c38"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: VLd3KMbDPd6s2pCiJkiLNxZPlKywvnnH
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: JSjNWmYX7KkTBXoA6tUwTGsuz8nJaPCyrCoNyOXCaBtXNgd-1gAALQ==

GET
H2 200 23.a53d721f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 59 KB
19 KB 25ms
21ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/23.a53d721f.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

f48829864ffd155da0360e19be956282b6875173f8990394e93bc7c30c97a3ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 28 Dec 2021 01:13:03 GMT
content-encoding: gzip
age: 4520647
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 23 Dec 2021 18:12:25 GMT
server: nginx
etag: W/"fe96cb8c4c390342c29d3c8cb0a4ca14"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: a7WvmR.vwHMPBFEqQ8riDzB0H8J4vers
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: zmAdnAwHES_2CGRO7URqzni-23I2gCjnC6GpYhmW7uY8W2F0NLXI_A==

GET
H2 200 11.8d62d6c4.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 91 KB
28 KB 27ms
21ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/11.8d62d6c4.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

1cf451d2d8d425375505bd10c5540e8e5cce3cbbd5932be038285d8b6a650e63

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:16 GMT
server: nginx
etag: W/"8199a8634768214fc6204b18351f842d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: p_YagIEBvf.Qgp7hIJy74.J4YIszefj5
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: R3T5DCWBTegKGPAN-MmzdC5a-GKIMXZGjZCsHz7sqksc7YSI5-XkLQ==

GET
H2 200 10.937b0755.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 24 KB
7 KB 27ms
21ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/10.937b0755.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

e868d39bbb74d42dffcee0cb1a50ecd105e1a1737d9080246dbdd54a8206d8f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
content-encoding: gzip
age: 3863008
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:16 GMT
server: nginx
etag: W/"e9243456e8ca8af97d77d525d5367d6b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 1OI8MdaO_2Zet9LQGrgpik7z8k_2AhIl
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: pYP_q-YIljs76DEKmKlSw6RUMH3RJ6xjnZV-lTXvwb0IixVvWL5Qcg==

GET
H2 200 14.2a01ddd6.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 62 KB
20 KB 28ms
23ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/14.2a01ddd6.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

ef593584d9432b51ed1cec6f58f844bfa6f81ef0fe27fd9404e400e1346fa09b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"6f457384188c98017d8d27281f3df6ad"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: KpoEpDmO7G9TLWLfSTzA1dytLAyREIfM
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 5K6fFz4byjOkhCvhh2JPPXMrqa8iyLTG9wpCA9Ys-vbr0YeNv29CGQ==

GET
H2 200 41.ef07ba02.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 105 KB
34 KB 28ms
22ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/41.ef07ba02.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

160371118ad2e4d470bc6801bb253ec18332e7b6fb7225bb6d365a99bdb99d22

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"da03c1012cb0aaeb2041fa677a272d14"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 6OpxVYvZjRVHdu0KjdhZlusmExqFlB4E
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: YF8kaUkor4baJK42cyvMEk__cwzxfa8oGcEvjBNgr0Lkq6SyXGZC_Q==

GET
H2 200 35.0810b4b3.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 12 KB
4 KB 29ms
24ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/35.0810b4b3.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

05c1b18ed199fea9af5168c7769dff2cd69f02706fa2568ab2e305be8dfb9c52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"4a61646db5420cc31cb60b9287d9f544"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: wDOiuCZSfZ.KHqNETPwI3S2a9GU0lEIR
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: hTju10_6glaZXgMaLPmzzsVr1NpKkchTS5XJTPe34-fLDdm0vCVt8Q==

GET
H2 200 26.d9eb886e.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 12 KB
5 KB 29ms
25ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/26.d9eb886e.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

b9ddcbc73a2a42b603661b51028d38aba3374f67385f3307e1cfcebdee2f4838

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"44c7301d8127e805fcdfcc1b00ddf2ea"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: EjkJtX0HE9ajSK4icA5a46UNajNAQcku
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: QU6LsJvjckbmHBHF5oJ5neywlLB7GMwr_AQKNELWICYxgO-dkasUtg==

GET
H2 200 17.6c3c965c.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 17 KB
7 KB 30ms
25ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/17.6c3c965c.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

a5ad436c025c2a03ccc5672aed9469ac98d22b73df5b1d20ed2adb46c0c4daf9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"b0b166b8ed88c90ea3dc07661d0dcff4"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: HHiN6wsTfDikx0BfRvhzq1f1VEBLDIa4
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: GCnldSWABku7u0IIY9wjTc0X3MCTGhF9YGFtJP2z7egn2Vz-GD_jnw==

GET
H2 200 8.5b0bb1c3.chunk.css
js.driftt.com/core/assets/css/ Frame 35C7 11 KB
3 KB 28ms
24ms Stylesheet
text/css 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/8.5b0bb1c3.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

d36d8a76a8b7d7fe8655db34eb54e4a4b6d422cdd1a67810d3dd5c014edb14e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:15 GMT
server: nginx
etag: W/"a123c5b36f16fe6d3a3129e24df81443"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: _wlNEHOawmowSdlpT1GApwIIwlk.3B3i
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: qYvLxdHBBLH2vJA1j1Px5UqF6woGEDSpPSASy7n2D7YDE9eReRx_WQ==

GET
H2 200 8.c30eb26a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 69 KB
22 KB 29ms
26ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/8.c30eb26a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

6068d230ddc2a94a269034dab608f9966fec8531b5e00c006634c8d725b3765c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 09 Feb 2022 15:29:03 GMT
content-encoding: gzip
age: 754087
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 09 Feb 2022 15:13:08 GMT
server: nginx
etag: W/"a75f570fd77fc567c56e5c7fdad25d77"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: taRffhX16zK2eZuMfxLJC70jbfGAjmFM
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 7jclUVAhaA49lR4-w8yf6y0Uf0R-bh5aXX8SaPnOXcX-ZathugoUNg==

GET
H2 200 15.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame 35C7 24 B
665 B 28ms
25ms Stylesheet
text/css 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/15.22abfce0.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
age: 3863009
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 24
last-modified: Tue, 04 Jan 2022 15:08:15 GMT
server: nginx
etag: "0c5dad92482d9a7c7c253510f5082465"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: bzo2zbrJexGHlTPaLulG8N5yfdXT7FR0
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: j89gvDdxBdDv7ih0McyxCDRPkQnt_UA3iRhEIITDg2e9laddLZzCNw==

GET
H2 200 15.1d8f5012.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 75 KB
19 KB 30ms
27ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/15.1d8f5012.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

93ca03195ed4c9536d694584455be6d5d71776e00fe33926ae596bfe4f35a76a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 04 Feb 2022 14:43:02 GMT
content-encoding: gzip
age: 1188848
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 04 Feb 2022 14:40:29 GMT
server: nginx
etag: W/"a10801df313ae6aee5353f1d56ee158d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: KAn62QiCijDwsq5BJEU9_1eTMFOTCVrB
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 2wPCb4EBHkz8rexuAzv-in_bO4vYn30FkXrUg-YPSkpxaCn8YI-XbA==

GET
H2 200 22.947209a2.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 47 KB
13 KB 30ms
27ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/22.947209a2.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

a3940c0c7051093e974422b42f2a563671ed810418862f44e8314f5255367e7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 04 Feb 2022 14:43:02 GMT
content-encoding: gzip
age: 1188848
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 04 Feb 2022 14:40:29 GMT
server: nginx
etag: W/"d06d1a64be2b2e5ab91bedd7c4c17717"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: k7zUF0pgH6bmYsPK._H98sqTvr7U2rBt
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: c_ilFEygRYBoUbrRinlnObEpgwHnKccM6Kke3mlIdYVVl4EkEvkDsw==

GET
H2 200 13.014e96bd.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 41 KB
13 KB 31ms
28ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/13.014e96bd.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

5663a7a55772ac03276f27f2cf05b093c71c6b79c1bf8b7e071b3621b8126f4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 15 Feb 2022 17:02:15 GMT
content-encoding: gzip
age: 230095
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 15 Feb 2022 16:32:48 GMT
server: nginx
etag: W/"0ee44fe830a2d282378c97205f753960"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: eTrq2_ygCQ8X0KEyQ2jeWW6y8G2tanE7
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: CgZPMQBOtkAME1y4hMB6h5gGMcpnvGYiAElNEyXxwx5IOMUBpqIy7Q==

GET
H2 200 0.0b2ebd4a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 1EA3 9 KB
3 KB 8ms
7ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
content-encoding: gzip
age: 3863008
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:16 GMT
server: nginx
etag: W/"c5efcdc9e465604f32cf24af10fd6c13"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: DgvAfZ7BPwPZGfOrE621PjhvvHFr1DU0
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: APVgQHT2mBHynrGYAh7V9FOG1d-E0XOGDATzwhRjQysXrXeHdONTeA==

GET
H2 200 24.81d46fe7.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 1EA3 33 KB
10 KB 8ms
7ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/24.81d46fe7.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

e7e2024764e94bff400b354a7cb714ab75f1b9fd4b3fb09de18dca2d6c2e56a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
content-encoding: gzip
age: 3863008
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"4f751bc7b45f18c1d343a3081fe2509f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: LcjepTSdTIP3TYamt9S6TQ4IzFvRquuU
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: _EYLbX7OC10IV8gqoDYKWJZjiZgerE8HwJ89RXmCYfXkMTDOZGAscA==

GET
H2 200 25.49c6961c.chunk.css
js.driftt.com/core/assets/css/ Frame 1EA3 8 KB
2 KB 9ms
8ms Stylesheet
text/css 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/25.49c6961c.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

578cda2391db4e4d761ae5c4f05c03614d0ea8fec0b260edc036cc0bbdfcdd93

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
content-encoding: gzip
age: 3863008
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:15 GMT
server: nginx
etag: W/"f80cd64e339375567091159cb077b941"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: bxrqjBCKX9ERzz7WjftbPaYdOBk8_KxN
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: MPfuWdXQG3cOV1tCOBz4aEuNHBWpl-VujRZMT49qYejB4MtA8lWREA==

GET
H2 200 25.3edea197.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 1EA3 12 KB
5 KB 9ms
8ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/25.3edea197.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

03076b42c04600d8390ca4fdee25bfd27159ae17542a7ce4835d8e95eb3e09c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 15 Feb 2022 17:02:15 GMT
content-encoding: gzip
age: 230095
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 15 Feb 2022 16:32:49 GMT
server: nginx
etag: W/"7fe2c144230edd6f0d5239a188bf14bf"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Qv8p.vMJI0metIekINRXO5m0qweEk1vH
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Jtwcnjospz1taJiarUd8EIsr7C7Mwzx9TETbCq1zLugsVGiMBVWqww==

GET
H2 200 19.c695453b.chunk.css
js.driftt.com/core/assets/css/ Frame 1EA3 365 B
1006 B 9ms
9ms Stylesheet
text/css 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/19.c695453b.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
age: 3863008
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 365
last-modified: Tue, 04 Jan 2022 15:08:15 GMT
server: nginx
etag: "06b2963b029c0824382815165bfea73e"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: eDSgTpssczGDn2812OLuvvF.eUpzKWka
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: bX66MCg94z3jUm0lH-7WU9v2xr1e8uyLZkAbBAQB_rcLKxnoP5SscQ==

GET
H2 200 19.e9c3090f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 1EA3 85 KB
24 KB 9ms
9ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/19.e9c3090f.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

f9a2d2e87a5a58ba21496321a93d073c18ec25e9c38d6d1daeaa9e10a9022535

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=uvut6nv3vzk9&region=US&forceShow=false&skipCampaigns=false&sessionId=6bef3049-d7ab-48c8-a36e-6d3a43a0e788&sessionStarted=1645174629.343&campaignRefreshToken=383b5be3-2b73-4ea4-ad72-f5e5475743fd&hideController=false&pageLoadStartTime=1645174628739&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 15 Feb 2022 14:50:10 GMT
content-encoding: gzip
age: 238020
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 15 Feb 2022 14:20:21 GMT
server: nginx
etag: W/"989589162483f0966d3379f01e8b73a9"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: .mKx0nKUkw8nZFQtU_cnlKbOBINGtcas
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: SM08YwH0rt5cP28d-ffKqajUpFzHqqqTRSP7BZvIz8ffCv8wbYofDg==

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 147ms
50ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-10904891-3&cid=1617449117.1645174630&jid=1463785018&_u=YGBACAAABAAAAC~&z=298157941

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Feb 2022 08:57:10 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
501 B 142ms
50ms Image
image/gif 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-10904891-3&cid=1617449117.1645174630&jid=1463785018&_u=YGBACAAABAAAAC~&z=298157941

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Feb 2022 08:57:10 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 koi Show response
koi-3qn67979n8.marketingautomation.services/ 126 B
591 B 165ms
163ms Script
application/javascript 130.211.21.179
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://koi-3qn67979n8.marketingautomation.services/koi?rf=&hn=www.reliaquest.com&lg=en-US&sr=1600x1200&cd=24&vr=2.4.0&se=1645174630073&ac=KOI-3H2VVXNZ6&ts=1645174630&pt=0&pl=0&loc=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F&tp=page&ti=Threat%20Advisory%3A%20Blackbyte%20Ransomware%20-%20ReliaQuest

Requested by

Host: koi-3qn67979n8.marketingautomation.services
URL: https://koi-3qn67979n8.marketingautomation.services/client/ss.js?ver=1.1.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

130.211.21.179 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

179.21.211.130.bc.googleusercontent.com

Software

openresty /

Resource Hash

90b5dedf2fc3fbe1813dd9220a44247192d1e3503922450d6d4a2bd072a6fe3c

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Feb 2022 08:57:10 GMT
content-encoding: gzip
x-clacks-overhead: GNU Terry Pratchett
last-modified: Fri, 18 Feb 2022 08:57:10 GMT
server: openresty
vary: Accept-Encoding
p3p: CP='This is not a P3P policy! See https://sharpspring.com/legal/privacy/ for more info.'
via: 1.1 google
cache-control: no-store, no-cache, must-revalidate, pre-check=0, post-check=0, max-age=0
pod-hostname: koi-8d669dbd8-gqwpz
content-type: application/javascript
alt-svc: clear
x-xss-protection: 1; mode=block
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 204 website_forms Show response
jukebox.pathfactory.com/api/public/v1/ 0
411 B 113ms
113ms XHR
text/plain 3.225.225.252
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v1/website_forms?clientId=LB-97DF08AC-10844&visitorUuid=1fd347e3-10d7-4627-b884-481d062d9aa6&url=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F

Requested by

Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox/current/jukebox.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.225.225.252 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-225-225-252.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://www.reliaquest.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: application/json

Response headers

x-runtime: 0.011831
date: Fri, 18 Feb 2022 08:57:10 GMT
referrer-policy: no-referrer-when-downgrade
access-control-max-age: 7200
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://www.reliaquest.com
access-control-expose-headers
cache-control: no-cache
access-control-allow-credentials: true
vary: Origin
x-content-type-options: nosniff
x-request-id: 89f67a43-462d-4afe-8293-0cfe39449102

GET
H2 200 32.11d2b6a7.chunk.css
js.driftt.com/core/assets/css/ Frame 35C7 3 KB
1 KB 7ms
7ms Stylesheet
text/css 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/32.11d2b6a7.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
content-encoding: gzip
age: 3863008
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:15 GMT
server: nginx
etag: W/"87532c4db85f1429fa6d759bc3332f36"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: u5jls1rsjTMRW03RSXYJxMQTbD86EmFF
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: WLZpP0arF6HP_mlKOzoww38j7lGOVOrSapiXqZYMWV2RZgZwjHrcJg==

GET
H2 200 32.28be7b35.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 3 KB
2 KB 8ms
8ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/32.28be7b35.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

566639f88e650ada50f7f5a70d52efdd262905b7114ddffd26893b7727493a7f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:05:36 GMT
content-encoding: gzip
age: 2465494
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 20 Jan 2022 18:53:54 GMT
server: nginx
etag: W/"853d736e05b299b857e10b6ab17f3c36"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 9pIhc0wyy2uFZp3UiIdf1ZYNnPQh9D45
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 9gXWQJ5YFfb76c3DtHRUc9qVqoc3Kivtm613_nq1lYCCKOBXLYyVhg==

OPTIONS
H2 200 website_forms
jukebox.pathfactory.com/api/public/v1/ Frame 0
0 100ms
100ms Preflight 3.225.225.252
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jukebox.pathfactory.com/api/public/v1/website_forms?clientId=LB-97DF08AC-10844&visitorUuid=1fd347e3-10d7-4627-b884-481d062d9aa6&url=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.225.225.252 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-225-225-252.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: https://www.reliaquest.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Fri, 18 Feb 2022 08:57:10 GMT
access-control-allow-origin: https://www.reliaquest.com
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-expose-headers
access-control-max-age: 7200
access-control-allow-credentials: true
access-control-allow-headers: content-type

GET
H2 200 0.0b2ebd4a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 9 KB
3 KB 9ms
7ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
content-encoding: gzip
age: 3863008
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:16 GMT
server: nginx
etag: W/"c5efcdc9e465604f32cf24af10fd6c13"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: DgvAfZ7BPwPZGfOrE621PjhvvHFr1DU0
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: VQ_1l3tNFDmQgTPxEwrA3NJkUhLT0sU3DpVuYeUL_bKMofli8HfbGQ==

GET
H2 200 2.07aa08a5.chunk.css
js.driftt.com/core/assets/css/ Frame 35C7 7 KB
2 KB 12ms
10ms Stylesheet
text/css 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/2.07aa08a5.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
content-encoding: gzip
age: 3863008
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:15 GMT
server: nginx
etag: W/"189aeffd571884559dababa22c66d75a"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Y5MQMpfNZ9bYDeQmDMLbw0xNzGrQukfM
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: MPYAAVfZS8E9DpugqJAizveOYlzWxV6_bWyWye6hRN_n8ZQla5fhOA==

GET
H2 200 2.90bfb041.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 54 KB
16 KB 13ms
12ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/2.90bfb041.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

088e1ef91a320f014eecd7495cedfa7fee5e167cadaf55545ce137f4ff749ba8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
content-encoding: gzip
age: 3863008
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"dc43e7dd478d83a9091a7335b8beb11d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: dNyr.b_J6AuxSb56NRWJ3LKsWJ9BzeOS
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: nc6DVCZjfMMjBTq_6KQklZdMirtw7iaI3o3LKYk1o_SkGqDlLzMELA==

GET
H2 200 1.e250bb71.chunk.css
js.driftt.com/core/assets/css/ Frame 35C7 44 KB
7 KB 12ms
11ms Stylesheet
text/css 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/1.e250bb71.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

f9163f3372bf09f2bcb3c8fa8b218443c557dbb32c78a36ee9221ca5abf8b193

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 04 Feb 2022 16:15:00 GMT
content-encoding: gzip
age: 1183330
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 04 Feb 2022 14:40:27 GMT
server: nginx
etag: W/"2b7f0e5ff08649a2d71db9fdde0609ab"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: U0zOe09_ThzYcAoSvmLbLojXTsJVu6PB
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: rHlrDxbSiQxOL-VJREHbyEmBAo8oMOAQhUpSFznU03JEoJGTMWw9MQ==

GET
H2 200 1.4d73e4b0.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 71 KB
24 KB 14ms
13ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/1.4d73e4b0.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

7b3d77afaf24867ae18a33f69f474784f560f9ef07177b4f630dc9e526d7668c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 15 Feb 2022 17:02:15 GMT
content-encoding: gzip
age: 230095
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 15 Feb 2022 16:32:47 GMT
server: nginx
etag: W/"f1e2b02776cbd2a2f3c4fa276534e182"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Zi1fk0tPqcchfIOXcBADnHkL0Gs8.eIW
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: nLpSmT-fcC-FNpoGKcSPuW4ZIK3zt8ykvhr6bCHyF63IZ2RPULNdpQ==

GET
H2 200 30.52060f2d.chunk.css
js.driftt.com/core/assets/css/ Frame 35C7 12 KB
3 KB 12ms
12ms Stylesheet
text/css 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/30.52060f2d.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

643284a0eca0e88605a52952545149695d41d4a6f057d897bedf92a24e32c573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 04 Feb 2022 16:15:00 GMT
content-encoding: gzip
age: 1183330
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 04 Feb 2022 14:40:27 GMT
server: nginx
etag: W/"b63021470083bdc161ef4dda2e4912c3"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: e.sL0vOF62s4pyHwBuhbHf.Miph1ZlJo
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: _mMWaSV-OsvJp9y9E07y99AP9v3UhGGF24IKheq5_fv2ZelcIv3o9w==

GET
H2 200 30.f8f90b50.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 35C7 12 KB
5 KB 16ms
15ms Script
application/javascript 143.204.98.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/30.f8f90b50.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.97f2beae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-111.fra50.r.cloudfront.net

Software

nginx /

Resource Hash

7fbdf18ef718f7d92c5c552cf3133223239e5a87b2b17543417c863895fa3ebc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1645174628739
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 04 Feb 2022 16:15:00 GMT
content-encoding: gzip
age: 1183330
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 04 Feb 2022 14:40:30 GMT
server: nginx
etag: W/"403c83255f6ba5c35738df7176146d93"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 9aY_CUpc8aGc6DumJu3tfRzHETVUuYEF
via: 1.1 009e5e3e32afcd1d135a7234c9da5520.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: H9jMCskX5yidaOWeu7SLiMzAW2hOkLPhBkxrrm-3zKLabEM2pGq-ZQ==

OPTIONS
H2 200 v2
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame 0
0 343ms
100ms Preflight
text/plain 3.94.218.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/widget/init/v2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-94-218-138.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Fri, 18 Feb 2022 08:57:10 GMT
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/plain
allow: POST,OPTIONS
requestid: drift501503c40aa8be3e078960bf5dd
content-length: 13
x-envoy-upstream-service-time: 0
server: istio-envoy

POST
H2 200 v2 Show response
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame 1EA3 25 B
123 B 111ms
110ms XHR
application/json 3.94.218.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/widget/init/v2

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/43.bf52ab96.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-94-218-138.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
Authorization
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 18 Feb 2022 08:57:10 GMT
server: istio-envoy
requestid: f844e525a0c75f99
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
x-envoy-upstream-service-time: 11
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 25
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

POST
H2 200 ping Show response
bootstrap.api.drift.com/widget_bootstrap/ Frame 1EA3 126 B
223 B 109ms
108ms XHR
application/json 54.147.21.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://bootstrap.api.drift.com/widget_bootstrap/ping

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/43.bf52ab96.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-147-21-139.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

2bdf6817931f21e22e509a1067abb9d9c05e397247363472f04b83faadcb59ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 18 Feb 2022 08:57:10 GMT
server: istio-envoy
requestid: b77913174f537932
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
x-envoy-upstream-service-time: 5
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 126
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

OPTIONS
H2 200 ping
bootstrap.api.drift.com/widget_bootstrap/ Frame 0
0 349ms
106ms Preflight
text/plain 54.147.21.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://bootstrap.api.drift.com/widget_bootstrap/ping

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-147-21-139.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Fri, 18 Feb 2022 08:57:10 GMT
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/plain
allow: POST,OPTIONS
requestid: drift0c8b7094223acf1d42cdc3d242e
content-length: 13
x-envoy-upstream-service-time: 0
server: istio-envoy

POST
H2 200 page_views Show response
jukebox.pathfactory.com/api/public/v1/ 2 B
615 B 123ms
122ms XHR
application/json 3.225.225.252
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v1/page_views

Requested by

Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox/current/jukebox.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.225.225.252 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-225-225-252.compute-1.amazonaws.com

Software

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://www.reliaquest.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 18 Feb 2022 08:57:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
access-control-max-age: 7200
vary: Accept, Origin, Accept-Encoding
x-request-id: 6a72e9c2-c637-4a9b-85cd-3472e3c1b530
x-runtime: 0.019017
referrer-policy: no-referrer-when-downgrade
etag: W/"44136fa355b3678a1146ad16f7e8649e"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.reliaquest.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true

OPTIONS
H2 200 page_views
jukebox.pathfactory.com/api/public/v1/ Frame 0
0 99ms
99ms Preflight 3.225.225.252
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jukebox.pathfactory.com/api/public/v1/page_views
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.225.225.252 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-225-225-252.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://www.reliaquest.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Fri, 18 Feb 2022 08:57:10 GMT
access-control-allow-origin: https://www.reliaquest.com
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-expose-headers
access-control-max-age: 7200
access-control-allow-credentials: true
access-control-allow-headers: content-type

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 1B01 0
18 B 17ms
7ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
Origin: https://www.reliaquest.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/

Response headers

content-type: text/plain
access-control-allow-origin: https://www.reliaquest.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority: u=0
date: Fri, 18 Feb 2022 08:57:10 GMT

GET
H2 200 uvut6nv3vzk9.json Show response
embeds.driftcdn.com/embeds/ Frame 1EA3 63 KB
13 KB 438ms
409ms XHR
application/json 18.66.248.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://embeds.driftcdn.com/embeds/uvut6nv3vzk9.json
Requested by: Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/43.bf52ab96.chunk.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.77 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-77.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f8e13499f7baca0f6ac36b7e03884d92a925f96ce0e701bce08b9f0d803b314b

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:12 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-P1
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Thu, 17 Feb 2022 22:59:48 GMT
server: AmazonS3
etag: W/"bd41bbedfd204d06a099433fe35e4bd2"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json; charset=UTF-8
via: 1.1 197c4cb5add90683639ea9a7475e4dd2.cloudfront.net (CloudFront)
cache-control: public, max-age=30
x-amz-cf-id: gbwbAoICsKqGKeiOiOccafz31ASGq9Rs0Oi1OySZSxyVs2gLr5ZWIw==

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 201ms
201ms Image
image/gif 104.92.74.202
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=cdfe02635f87832f7fb37442e2a57166&svisitor=0f58655f5f5e0000645f0f629e030000537e0300&session=c667406e-9d9c-4a2a-8b25-b5636097865c&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2018%20Feb%202022%2008%3A57%3A11%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2018%20Feb%202022%2008%3A57%3A10%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222054%22%7D&isIframe=false&m=%7B%22description%22%3A%22Blackbyte%20is%20a%20newly%20identified%20ransomware-as-a-Service%20operation%20configured%20to%20use%20%27double-extortion%27%20techniques%20based%20on%20an%20available%20%27leaks%27%20website.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Threat%20Advisory%3A%20Blackbyte%20Ransomware%20-%20ReliaQuest%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F&pageViewId=f4a65550-d461-4a54-85f3-238a716f87d7&an_uid=0

Requested by

Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-92-74-202.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 08:57:11 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Fri, 21 Feb 2020 18:57:20 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5e502810-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 clarity.js Show response
e.clarity.ms/s/0.6.32/ 53 KB
23 KB 301ms
98ms Script
application/javascript 20.62.48.180
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://e.clarity.ms/s/0.6.32/clarity.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/p/action/134470029.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.62.48.180 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 3701cadc5fc84e8ad639f83a87e20d82575e3cc28d479d73a0e66e5230e71c65

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 08:57:11 GMT
content-encoding: br
etag: "1d8191fe855c690"
last-modified: Thu, 03 Feb 2022 17:03:04 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: public,max-age=86400
accept-ranges: bytes
content-length: 22927
request-context: appId=cid-v1:bdfb7149-d2ee-45f0-9a22-f0b1c5035608

GET
H2

200

c.gif
c.clarity.ms/
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?CtsSyncId=10196DA412264897B8FFE7103188C80E&RedC=c.clarity.ms&MXFR=02950AFB8BD66B960AFA1BB48FD66571
https://c.clarity.ms/c.gif?CtsSyncId=10196DA412264897B8FFE7103188C80E&MUID=3AB597792BBC60B205EF86362A6E6177

42 B
367 B

27ms
26ms

Image
image/gif

52.142.114.2
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?CtsSyncId=10196DA412264897B8FFE7103188C80E&MUID=3AB597792BBC60B205EF86362A6E6177
Requested by: Host: www.reliaquest.com
URL: https://www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
Protocol: H2
Server: 52.142.114.2 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Feb 2022 08:57:11 GMT
last-modified: Wed, 12 Jan 2022 02:05:35 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "9ea1ae3587d81:0"
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

Redirect headers

pragma: no-cache
date: Fri, 18 Feb 2022 08:57:11 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 0B45832A9C2745489412432F78E29C81 Ref B: FRAEDGE1216 Ref C: 2022-02-18T08:57:11Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?CtsSyncId=10196DA412264897B8FFE7103188C80E&MUID=3AB597792BBC60B205EF86362A6E6177
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 187ms
186ms Image
image/gif 104.92.74.202
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=cdfe02635f87832f7fb37442e2a57166&svisitor=0f58655f5f5e0000645f0f629e030000537e0300&session=c667406e-9d9c-4a2a-8b25-b5636097865c&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2018%20Feb%202022%2008%3A57%3A12%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2018%20Feb%202022%2008%3A57%3A11%20GMT%22%2C%22timeSpent%22%3A%221030%22%2C%22totalTimeSpent%22%3A%223084%22%7D&isIframe=false&m=%7B%22description%22%3A%22Blackbyte%20is%20a%20newly%20identified%20ransomware-as-a-Service%20operation%20configured%20to%20use%20%27double-extortion%27%20techniques%20based%20on%20an%20available%20%27leaks%27%20website.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Threat%20Advisory%3A%20Blackbyte%20Ransomware%20-%20ReliaQuest%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F&pageViewId=f4a65550-d461-4a54-85f3-238a716f87d7&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-92-74-202.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 08:57:12 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Sat, 05 Jun 2021 07:56:05 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "60bb2e15-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 204 collect Show response
e.clarity.ms/ 0
72 B 193ms
193ms XHR
text/plain 20.62.48.180
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://e.clarity.ms/collect
Requested by: Host: e.clarity.ms
URL: https://e.clarity.ms/s/0.6.32/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.62.48.180 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://www.reliaquest.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

access-control-allow-origin: https://www.reliaquest.com
date: Fri, 18 Feb 2022 08:57:11 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:bdfb7149-d2ee-45f0-9a22-f0b1c5035608

POST
H2 200 bulk Show response
metrics.api.drift.com/monitoring/metrics/event2/ Frame 1EA3 25 B
88 B 111ms
111ms XHR
application/json 3.94.218.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/event2/bulk

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/43.bf52ab96.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-94-218-138.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
Authorization
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 18 Feb 2022 08:57:12 GMT
server: istio-envoy
requestid: d2523b6a39bc8ef6
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
x-envoy-upstream-service-time: 12
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 25
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

OPTIONS
H2 200 bulk
metrics.api.drift.com/monitoring/metrics/event2/ Frame 0
0 99ms
99ms Preflight
text/plain 3.94.218.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/event2/bulk

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-94-218-138.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Fri, 18 Feb 2022 08:57:12 GMT
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/plain
allow: POST,OPTIONS
requestid: driftfb95d754019b901b16e02576d8d
content-length: 13
x-envoy-upstream-service-time: 0
server: istio-envoy

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 220ms
219ms Image
image/gif 104.92.74.202
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=cdfe02635f87832f7fb37442e2a57166&svisitor=0f58655f5f5e0000645f0f629e030000537e0300&session=c667406e-9d9c-4a2a-8b25-b5636097865c&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2018%20Feb%202022%2008%3A57%3A13%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2018%20Feb%202022%2008%3A57%3A12%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%224086%22%7D&isIframe=false&m=%7B%22description%22%3A%22Blackbyte%20is%20a%20newly%20identified%20ransomware-as-a-Service%20operation%20configured%20to%20use%20%27double-extortion%27%20techniques%20based%20on%20an%20available%20%27leaks%27%20website.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Threat%20Advisory%3A%20Blackbyte%20Ransomware%20-%20ReliaQuest%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F&pageViewId=f4a65550-d461-4a54-85f3-238a716f87d7&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-92-74-202.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 08:57:13 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Fri, 21 Feb 2020 18:57:20 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5e502810-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 204 collect Show response
e.clarity.ms/ 0
48 B 95ms
94ms XHR
text/plain 20.62.48.180
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://e.clarity.ms/collect
Requested by: Host: e.clarity.ms
URL: https://e.clarity.ms/s/0.6.32/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.62.48.180 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://www.reliaquest.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

access-control-allow-origin: https://www.reliaquest.com
date: Fri, 18 Feb 2022 08:57:13 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:bdfb7149-d2ee-45f0-9a22-f0b1c5035608

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 195ms
194ms Image
image/gif 104.92.74.202
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=cdfe02635f87832f7fb37442e2a57166&svisitor=0f58655f5f5e0000645f0f629e030000537e0300&session=c667406e-9d9c-4a2a-8b25-b5636097865c&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2018%20Feb%202022%2008%3A57%3A14%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2018%20Feb%202022%2008%3A57%3A13%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225087%22%7D&isIframe=false&m=%7B%22description%22%3A%22Blackbyte%20is%20a%20newly%20identified%20ransomware-as-a-Service%20operation%20configured%20to%20use%20%27double-extortion%27%20techniques%20based%20on%20an%20available%20%27leaks%27%20website.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Threat%20Advisory%3A%20Blackbyte%20Ransomware%20-%20ReliaQuest%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F&pageViewId=f4a65550-d461-4a54-85f3-238a716f87d7&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-92-74-202.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.reliaquest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 08:57:14 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Tue, 05 Oct 2021 22:17:52 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "615ccf10-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET img.gif
b.6sc.co/v1/beacon/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: b.6sc.co
URL: https://b.6sc.co/v1/beacon/img.gif?token=cdfe02635f87832f7fb37442e2a57166&svisitor=0f58655f5f5e0000645f0f629e030000537e0300&session=c667406e-9d9c-4a2a-8b25-b5636097865c&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2018%20Feb%202022%2008%3A57%3A15%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2018%20Feb%202022%2008%3A57%3A14%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226088%22%7D&isIframe=false&m=%7B%22description%22%3A%22Blackbyte%20is%20a%20newly%20identified%20ransomware-as-a-Service%20operation%20configured%20to%20use%20%27double-extortion%27%20techniques%20based%20on%20an%20available%20%27leaks%27%20website.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Threat%20Advisory%3A%20Blackbyte%20Ransomware%20-%20ReliaQuest%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reliaquest.com%2Fblog%2Fthreat-advisory-blackbyte-ransomware%2F&pageViewId=f4a65550-d461-4a54-85f3-238a716f87d7&an_uid=0

Verdicts & Comments Add Verdict or Comment

149 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

42 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.6sc.co/	1970-01-20 18:30:46	Name: 6suuid Value: 0f58655f5f5e0000645f0f629e030000537e0300
www.reliaquest.com/	1970-01-20 18:30:46	Name: _gd_visitor Value: 38c06401-01f0-4c91-88cc-4446c5435feb
www.reliaquest.com/	1970-01-20 00:59:49	Name: _gd_session Value: c667406e-9d9c-4a2a-8b25-b5636097865c
www.reliaquest.com/	1970-01-20 00:59:36	Name: drift_campaign_refresh Value: 383b5be3-2b73-4ea4-ad72-f5e5475743fd
.reliaquest.com/	1970-01-20 18:30:46	Name: _mkto_trk Value: id:438-KYK-786&token:_mch-reliaquest.com-1645174629763-42459
www.reliaquest.com/	1970-01-20 18:30:46	Name: _gd_svisitor Value: 0f58655f5f5e0000645f0f629e030000537e0300
www.reliaquest.com/	1970-01-20 01:09:39	Name: _an_uid Value: 0
.bing.com/	1970-01-20 10:21:10	Name: MUID Value: 3AB597792BBC60B205EF86362A6E6177
.reliaquest.com/	1970-01-20 01:01:01	Name: _uetsid Value: c1975de0909811ecaceb8315a23737fc
.reliaquest.com/	1970-01-20 10:21:10	Name: _uetvid Value: c1976300909811ec9dcee93cd7afe0ab
www.reliaquest.com/	1970-01-20 01:09:39	Name: slireg Value: https://scout.us2.salesloft.com
.reliaquest.com/	1970-01-20 18:30:46	Name: _ga Value: GA1.2.1617449117.1645174630
.reliaquest.com/	1970-01-20 01:01:01	Name: _gid Value: GA1.2.405862885.1645174630
.reliaquest.com/	1970-01-20 00:59:34	Name: _gat_UA-10904891-3 Value: 1
.reliaquest.com/	1970-01-20 09:45:10	Name: _hjSessionUser_2441060 Value: eyJpZCI6IjcyODBiNDM4LWI4ZjktNTIzOS04Y2ZmLTBkYjcwYjU1N2Y2YyIsImNyZWF0ZWQiOjE2NDUxNzQ2Mjk4MTMsImV4aXN0aW5nIjpmYWxzZX0=
.reliaquest.com/	1970-01-20 00:59:36	Name: _hjFirstSeen Value: 1
www.reliaquest.com/	1970-01-20 00:59:34	Name: _hjIncludedInSessionSample Value: 1
.reliaquest.com/	1970-01-20 00:59:36	Name: _hjSession_2441060 Value: eyJpZCI6IjY0YjQ5MTk4LTEwZWMtNGYwYy05NzQzLTUwMTVmYTcwZGYwMiIsImNyZWF0ZWQiOjE2NDUxNzQ2Mjk5MzksImluU2FtcGxlIjp0cnVlfQ==
www.reliaquest.com/	1970-01-20 00:59:34	Name: _hjIncludedInPageviewSample Value: 1
.reliaquest.com/	1970-01-20 00:59:36	Name: _hjAbsoluteSessionInProgress Value: 0
www.reliaquest.com/	1970-01-20 09:45:10	Name: slirequested Value: true
www.reliaquest.com/	1970-01-20 09:45:10	Name: sliguid Value: b176f4c2-6cea-4eef-9abb-eee3531bee3b
.reliaquest.com/	1970-01-20 03:09:10	Name: _fbp Value: fb.1.1645174630069.1308828824
www.reliaquest.com/	1970-01-20 01:01:01	Name: __ss Value: 1645174630073
www.reliaquest.com/	1970-01-20 00:59:38	Name: __ss_referrer Value: https%3A//www.reliaquest.com/blog/threat-advisory-blackbyte-ransomware/
.marketingautomation.services/	1970-01-23 16:35:34	Name: koitk Value: 202202%7C620f5f667fe19a0370775bcf
www.reliaquest.com/	1970-01-29 03:59:34	Name: __ss_tk Value: 202202%7C620f5f667fe19a0370775bcf
.linkedin.com/	1970-01-20 01:42:46	Name: UserMatchHistory Value: AQIoUtDK3BaFtgAAAX8MDKfahTjxSPi5_Lrb3t-y41kBmCfJoHQf40e6V9jjknYKldB5SgDg2z43iw
.linkedin.com/	1970-01-20 01:42:46	Name: AnalyticsSyncHistory Value: AQL5qoPwsOidOAAAAX8MDKfaoReCQSn1pFlUGy2jSi9C9s7fJLEs-LO1bPadTLu2fDC2i7VXr9TCeh2_zFdcCQ
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 18:31:28	Name: bcookie Value: "v=2&9b7d4022-ff34-49a1-8755-b5912d0d6884"
.linkedin.com/	1970-01-20 01:01:01	Name: lidc Value: "b=VGST04:s=V:r=V:a=V:p=V:g=2548:u=1:x=1:i=1645174630:t=1645261030:v=2:sig=AQF6Pgd8lGUMhyKF3HovcTqAyYlzHCj-"
.reliaquest.com/	1970-01-20 18:30:46	Name: vid Value: 1fd347e3-10d7-4627-b884-481d062d9aa6
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.www.linkedin.com/	1970-01-20 18:31:28	Name: bscookie Value: "v=1&202202180857103576d622-6d06-480e-8644-7fa31becdf64AQEn7OTn_OYphhaADktqvpKKnJG88K5P"
.linkedin.com/	1970-01-20 18:08:26	Name: li_gc Value: MTswOzE2NDUxNzQ2MzA7MjswMjFJ3hp0REgc62uYC2l9o0g260Xl9lyEkWkvxroNXyzvcA==
.c.bing.com/	1970-01-20 10:21:10	Name: SRM_B Value: 3AB597792BBC60B205EF86362A6E6177
.c.clarity.ms/	1969-12-31 23:59:59	Name: SM Value: C
.clarity.ms/	1970-01-20 10:21:10	Name: MUID Value: 3AB597792BBC60B205EF86362A6E6177
.c.clarity.ms/	1970-01-20 00:59:35	Name: ANONCHK Value: 0
.reliaquest.com/	1970-01-20 09:45:10	Name: _clck Value: wxam6c\|1\|ez3\|0
.reliaquest.com/	1970-01-20 01:01:01	Name: _clsk Value: foik50\|1645174632381\|1\|1\|e.clarity.ms/collect

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.fullstory.com/s/fs.js Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' resources.reliaquest.com *.reliaquest.com;
X-Frame-Options	ALLOW-FROM https://www.reliaquest.com/

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

438-kyk-786.mktoresp.com
app.salesloft.com
b.6sc.co
bat.bing.com
bootstrap.api.drift.com
c.6sc.co
c.bing.com
c.clarity.ms
cc.swiftype.com
cdn-app.pathfactory.com
connect.facebook.net
e.clarity.ms
embeds.driftcdn.com
epsilon.6sense.com
fonts.googleapis.com
fonts.gstatic.com
in.hotjar.com
j.6sc.co
js.driftt.com
jukebox.pathfactory.com
koi-3qn67979n8.marketingautomation.services
maxcdn.bootstrapcdn.com
metrics.api.drift.com
munchkin.marketo.net
nexus.ensighten.com
px.ads.linkedin.com
px4.ads.linkedin.com
s.swiftypecdn.com
scout-cdn.salesloft.com
scout.salesloft.com
script.hotjar.com
secure.adnxs.com
sl.reliaquest.com
snap.licdn.com
static.hotjar.com
stats.g.doubleclick.net
vars.hotjar.com
ws29.hotjar.com
www.facebook.com
www.fullstory.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
www.reliaquest.com
b.6sc.co
104.92.72.193
104.92.74.202
108.157.4.128
108.157.4.38
108.157.4.53
108.174.10.24
130.211.21.179
141.193.213.21
143.204.98.111
151.101.128.143
169.48.219.66
18.195.42.228
18.196.76.175
18.66.248.64
18.66.248.77
185.33.221.91
192.28.144.124
20.62.48.180
23.111.9.64
2606:4700::6812:acf
2620:1ec:22::14
2620:1ec:c11::200
2a00:1450:4001:803::2003
2a00:1450:4001:80f::2003
2a00:1450:4001:810::2004
2a00:1450:4001:810::200e
2a00:1450:4001:82a::2008
2a00:1450:4001:830::200a
2a00:1450:400c:c0c::9b
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a03:5f80:a::b212:e7d1
2a05:d014:275:cb00:ce75:162:d945:5f34
3.208.158.149
3.225.225.252
3.94.218.138
35.159.4.142
52.142.114.2
52.206.18.39
52.210.97.70
54.147.21.139
54.171.89.80
0055b9d0429e9c194b4aa6b5f49cbc2ec31a7220ee7c8c186a9ee951feabd482
01dfdc130cd3e3b7ed01572613ea6552ab9819ca803c688076f850d06aa627a0
03076b42c04600d8390ca4fdee25bfd27159ae17542a7ce4835d8e95eb3e09c0
05c1b18ed199fea9af5168c7769dff2cd69f02706fa2568ab2e305be8dfb9c52
088e1ef91a320f014eecd7495cedfa7fee5e167cadaf55545ce137f4ff749ba8
08dba73430a831aefc84bff275109c401e50dc97fcc27ae6d3ae710edf9c0836
0c8f3094bd58170e9a6cbecb11bba6a925ae7423d31ecff5271f191acfa1f3e8
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
10942ce68f3786755833e291b8c0e806cd381d73a57f9666e5494e3bb533eb64
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
160371118ad2e4d470bc6801bb253ec18332e7b6fb7225bb6d365a99bdb99d22
1cbf80f7d71564dc48af2c5d6bb5d15fc2aec0d541101c5eedf84bad1b908cab
1cf451d2d8d425375505bd10c5540e8e5cce3cbbd5932be038285d8b6a650e63
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
26d1f8df59f501200b5889d69c5e0f20a0e21f72a59526d2b298a2b41aecfa1f
2707e48726a3f7ec48a1d1aec9738f20b36bac1535cfa9de2e4d92310c4e7e7a
27bcdc67e32fef9bdd86b785b1bafadd7f6915c49f6b49bed86bfbddf414b2f8
28638213bd78babaa122363c6a0f387234d0cc8fd72f26ece553bddf7922bccc
291b8f746f5fb8ef8dff392fee9cfabc7921aec0335fc4e15cd2633aeb383db2
2bdf6817931f21e22e509a1067abb9d9c05e397247363472f04b83faadcb59ca
2c7dbfca232b557ed75833405c3c8f92ffb224f014aab602a75c7d17328c4a82
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
3701cadc5fc84e8ad639f83a87e20d82575e3cc28d479d73a0e66e5230e71c65
37da17e676b0298cd88c1835b00618318df670f9ed4c199274546d4555248dab
4038a666dfd5af607a0374ad6e934cf1007e78da69329dbc341eaf757bb38beb
43b21a37ead752a35feeeb473aecb119bc2b63800594adc825bcb903b81f23da
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
462cdaa288f102690c2b8e9ae934ce582a9d9ddd7bd909c562506d45a66662e3
47bd861a92545ae4f694449a925f8d0b7044a4021bf34f748d472487ce23e3fa
49c6f7925a020059af53cab3baa5d2ea485e6807744ba07f1b2e90ee47266a44
4a007af67f716c30c8848ab0ad0bfaab8a5fcf3e36dedf918b59c9429d522440
4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08
53c088f65c77c6b7af2804face3e267d4c1bf148177798a30fa3a15aa693c36f
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5663a7a55772ac03276f27f2cf05b093c71c6b79c1bf8b7e071b3621b8126f4e
566639f88e650ada50f7f5a70d52efdd262905b7114ddffd26893b7727493a7f
578cda2391db4e4d761ae5c4f05c03614d0ea8fec0b260edc036cc0bbdfcdd93
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
6068d230ddc2a94a269034dab608f9966fec8531b5e00c006634c8d725b3765c
61949f8baab66ddadf9a8c14424b78715b9b9654ef3b882bc0ce3888a64632d9
643284a0eca0e88605a52952545149695d41d4a6f057d897bedf92a24e32c573
6abefb6d09cc0305793204985ae74596668f40336404367e0c8be080729df9a2
6c182493f60207d3b84f1ff7a91ddcea57cfaa8e35ccc759c702d268d96a266e
6e12019db287290647a1cd911f274d1556cc30c2ec7434064403a667dcbbe8f6
755b968a3f16f088eb890f8c555cc54be07862c94454a0f9fe2747c7f1ac0d2e
7b3d77afaf24867ae18a33f69f474784f560f9ef07177b4f630dc9e526d7668c
7b6fef0a63424245b31b293b1a3bfd074c9da482e28fb9e920e1cf306e54e8a2
7bf24330f3489cc5a7b43f8cc020f5ba15c92dea9721bc52f11defe9d8f542a0
7f9fb733d97f062a88ca692d057cf4e1b4d2c35ae2b08ee2f05f9e0bcaf7686c
7fbdf18ef718f7d92c5c552cf3133223239e5a87b2b17543417c863895fa3ebc
80d6e0449b911b2fa17ed729b9981f123c4e21d6fe186e454f20c32a13ac6845
80e9a2d87b73f4a48d5456f281e3378031b56348211878938f40c00cb90a263b
81804537c91508bd247771532aac07a03a73524343a61bb6ff596caa2c07d524
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
840711eaa754b000831567752cc1f5e460bd0f0097be8cb273230834a1a3a7a2
844732f4b71575f9a7c457209abc12cacc8fe7650d6c55bcf49e3c6eb853386a
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8540c5e2d2e85cc6c5d46b1b06b7f6642dce39e0314299a08976cfe6053c7c52
857a56d6b671208c542d51f78d02ff88e586c6996d186cb4b6517acd6b5d2a36
85e7661a2ff868a598b2bf29ce05049c4e8fb2ee5568225336ab0905eda3c1c1
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
86a76f2db4ea268a8ddfee33ad3a7ab05becfdef07b5ea781d8245a63f397878
8aed12b8b95a1d49011f3e134dc8e71804a3576818d1d1334145aaa96d71aa5e
8ceb3992861ed1fda25855c2e500e76842ae0d788405e50e3a9f45df36499cf6
90b5dedf2fc3fbe1813dd9220a44247192d1e3503922450d6d4a2bd072a6fe3c
9186ad0839410bf3d20f3c5b242b36027562baac85ffb8cba18b50b6e4d7945d
926f767fec2a5ed3a610735fde7861c24c9c15fa136d9a85d111c2b9ec4a0fa0
93ca03195ed4c9536d694584455be6d5d71776e00fe33926ae596bfe4f35a76a
95eeb8cfd9a50c5f43ea5afbf75c1e458570410b2bddbab2a81abd1afb12ef7e
96b4484567f62578827735526911d063a73fe35de3e13cc04af8f137dd40d379
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9cd7629d2e66537eb15542646bfd16cd461aaf18592c35f19ce7d67ada586635
9d8f8c89a5f7c90adc5196d1c10fe3e8c46d16cb8d24de13ade83de53183027d
9fa46f4bbcad04d753344ce78ff778a6f9af9c021c7bbb17332db3e33a52f0b8
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a3940c0c7051093e974422b42f2a563671ed810418862f44e8314f5255367e7d
a5ad436c025c2a03ccc5672aed9469ac98d22b73df5b1d20ed2adb46c0c4daf9
aa011ed383cb780028a85caaa0dda67dce19b0f4bc596f4f708d1857015c1362
b368fa48f6ea18e7727db43df597fce82a998eab83ef5b0bccd8a0b4ba203710
b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d
b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a
b9ddcbc73a2a42b603661b51028d38aba3374f67385f3307e1cfcebdee2f4838
bd50219667293fd4ee2c24ca0ab2140a609854fc6b1facb507cbf1d5d1a5effd
bd713db29fb234eb7584927050df71683e11b7b72bda4fcf72a88f8a7ff2f56d
c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537
c7ce9129d72ef25d747bb326a8c890c9c0bd660cfff4acb7ce7882466eafd9f5
cbd99f2690682eb26f975f14d4125e7ab101a307d83d00ad05758f045f15835b
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cd30193bf4f2348717c45237d14c680540841cbfb00ea48615785bc13e8205f1
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d36d8a76a8b7d7fe8655db34eb54e4a4b6d422cdd1a67810d3dd5c014edb14e4
d3ebb498192527b985939ae62cc4e5eb5c108efc1896184126b45d866868e73d
d872b4fb8c3c09ef3e1d75ddd63ec0e93260ab406ebc57079d8c85f9f38ce06e
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dcfc540946183ee12e6ccb43e706ad1a30b4f0205c25adcfa316829075f94a31
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e0f23d16bb40b894855d19e097cc0b9f4695b98a7db1fed18625cfb1ce8bda35
e101c64b7f06dd0b5a7e8392c75dd3577f688c4c69b2c73b9180046a21ad2711
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba
e41e2b5c9df3073d6f7da0080ad2f3eca4994ab372d2f65fa76b14f8868663ec
e70ab20a03bb158184806ee4989b61ea50eeda103d9e4592df89bf0b89416ee9
e7e2024764e94bff400b354a7cb714ab75f1b9fd4b3fb09de18dca2d6c2e56a5
e868d39bbb74d42dffcee0cb1a50ecd105e1a1737d9080246dbdd54a8206d8f0
ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff
ee5d74390a8a2e80111e61ee050a276c9d2fa2ae2d414c094f6ec9d79ad33f1e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef593584d9432b51ed1cec6f58f844bfa6f81ef0fe27fd9404e400e1346fa09b
f48829864ffd155da0360e19be956282b6875173f8990394e93bc7c30c97a3ed
f667ce53487e412daa30b3351d678699e9f6997f88b0963e5fc37045adcae97a
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
f8e13499f7baca0f6ac36b7e03884d92a925f96ce0e701bce08b9f0d803b314b
f9163f3372bf09f2bcb3c8fa8b218443c557dbb32c78a36ee9221ca5abf8b193
f9a2d2e87a5a58ba21496321a93d073c18ec25e9c38d6d1daeaa9e10a9022535
fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

www.reliaquest.com Open in urlscan Pro 141.193.213.21 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

161 Requests

98 %HTTPS

33 %IPv6

31 Domains

46 Subdomains

40 IPs

6 Countries

1888 kBTransfer

5990 kBSize

42 Cookies

13 Outgoing links

Page URL History

Redirected requests

161 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.reliaquest.com Open in urlscan Pro
141.193.213.21 Public Scan

Screenshot
Live screenshot

Full Image

161
Requests

98 %
HTTPS

33 %
IPv6

31
Domains

46
Subdomains

40
IPs

6
Countries

1888 kB
Transfer

5990 kB
Size

42
Cookies

161 HTTP transactions
6 data transactions