URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Submission: On August 31 via api from US — Scanned from DE

Summary

This website contacted 46 IPs in 6 countries across 35 domains to perform 144 HTTP transactions. The main IP is 104.198.136.223, located in Council Bluffs, United States and belongs to GOOGLE, US. The main domain is redcanary.com. The Cisco Umbrella rank of the primary domain is 439602.
TLS certificate: Issued by R3 on July 24th 2023. Valid for: 3 months.
This is the only time redcanary.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
23 104.198.136.223 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 104.17.71.206 13335 (CLOUDFLAR...)
5 152.195.15.58 15133 (EDGECAST)
6 2606:4700::68... 13335 (CLOUDFLAR...)
3 2a00:1450:400... 15169 (GOOGLE)
6 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 52.218.169.216 16509 (AMAZON-02)
2 104.64.124.188 16625 (AKAMAI-AS)
12 2.20.142.112 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
2 2600:1901:1:c... 15169 (GOOGLE)
18 2a04:4e42:8d:... 54113 (FASTLY)
1 146.75.116.157 54113 (FASTLY)
2 2a02:26f0:350... 20940 (AKAMAI-ASN1)
1 2a04:4e42:400... 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
3 2620:1ec:c11:... 8068 (MICROSOFT...)
2 2a03:2880:f08... 32934 (FACEBOOK)
1 1 68.67.153.60 29990 (ASN-APPNEX)
2 3 185.89.210.101 29990 (ASN-APPNEX)
1 2600:9000:225... 16509 (AMAZON-02)
1 2001:4860:480... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 192.28.147.68 15224 (OMNITURE)
1 2a04:4e42:8d:... 54113 (FASTLY)
3 2a02:26f0:350... 20940 (AKAMAI-ASN1)
2 2600:1901:0:5... 15169 (GOOGLE)
1 104.244.42.197 13414 (TWITTER)
1 104.244.42.195 13414 (TWITTER)
1 151.101.65.140 54113 (FASTLY)
2 2a00:1450:400... 15169 (GOOGLE)
1 2600:9000:20e... 16509 (AMAZON-02)
4 4 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
2 2a03:2880:f17... 32934 (FACEBOOK)
8 2600:1901:1:81:: 15169 (GOOGLE)
1 99.81.137.90 16509 (AMAZON-02)
1 52.204.253.158 14618 (AMAZON-AES)
2 2a02:26f0:2c:... 20940 (AKAMAI-ASN1)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 35.186.247.156 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
2 35.158.23.65 16509 (AMAZON-02)
2 52.216.144.158 16509 (AMAZON-02)
144 46
Apex Domain
Subdomains
Transfer
24 redcanary.com
redcanary.com — Cisco Umbrella Rank: 439602
resource.redcanary.com — Cisco Umbrella Rank: 731005
2 MB
18 spotifycdn.com
embed-cdn.spotifycdn.com — Cisco Umbrella Rank: 13792
543 KB
14 6sc.co
j.6sc.co — Cisco Umbrella Rank: 5691
c.6sc.co — Cisco Umbrella Rank: 8562
ipv6.6sc.co — Cisco Umbrella Rank: 5947
b.6sc.co — Cisco Umbrella Rank: 3992
38 KB
12 spotify.com
open.spotify.com — Cisco Umbrella Rank: 3592
apresolve.spotify.com — Cisco Umbrella Rank: 898
gew4-spclient.spotify.com — Cisco Umbrella Rank: 9281
6 KB
9 qualified.com
js.qualified.com — Cisco Umbrella Rank: 20853
app.qualified.com — Cisco Umbrella Rank: 21652
assets.qualified.com — Cisco Umbrella Rank: 22975
832 KB
7 crazyegg.com
script.crazyegg.com — Cisco Umbrella Rank: 2237
tracking.crazyegg.com — Cisco Umbrella Rank: 4119
75 KB
5 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 365
www.linkedin.com — Cisco Umbrella Rank: 625
px4.ads.linkedin.com — Cisco Umbrella Rank: 6371
5 KB
4 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 35
69 KB
4 scdn.co
i.scdn.co — Cisco Umbrella Rank: 1328
encore.scdn.co — Cisco Umbrella Rank: 6604
288 KB
4 bizible.com
cdn.bizible.com — Cisco Umbrella Rank: 6623
26 KB
3 google.de
www.google.de — Cisco Umbrella Rank: 6457
625 B
3 google.com
region1.analytics.google.com — Cisco Umbrella Rank: 3238
www.google.com — Cisco Umbrella Rank: 2
815 B
3 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 450
2 KB
3 bing.com
bat.bing.com — Cisco Umbrella Rank: 374
13 KB
3 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 40
stats.g.doubleclick.net — Cisco Umbrella Rank: 87
2 KB
3 amazonaws.com
s3-us-west-2.amazonaws.com
qualified-production.s3.us-east-1.amazonaws.com — Cisco Umbrella Rank: 29787
67 KB
3 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 47
283 KB
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 9384
593 B
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 109
256 B
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 169
87 KB
2 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 760
6 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 3330
6 KB
2 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 220
34 KB
2 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 368
fonts.googleapis.com — Cisco Umbrella Rank: 41
32 KB
1 sentry.io
sentry.io — Cisco Umbrella Rank: 177
325 B
1 bizibly.com
cdn.bizibly.com — Cisco Umbrella Rank: 12180
328 B
1 oribi.io
cdn.linkedin.oribi.io — Cisco Umbrella Rank: 881
375 B
1 reddit.com
alb.reddit.com — Cisco Umbrella Rank: 1523
637 B
1 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 742
396 B
1 t.co
t.co — Cisco Umbrella Rank: 577
375 B
1 mktoresp.com
003-yru-314.mktoresp.com
318 B
1 ml-api.io
attr.ml-api.io — Cisco Umbrella Rank: 20509
235 B
1 ml-attr.com
s.ml-attr.com — Cisco Umbrella Rank: 16560
278 B
1 redditstatic.com
www.redditstatic.com — Cisco Umbrella Rank: 1344
8 KB
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 758
15 KB
144 35
Domain Requested by
23 redcanary.com redcanary.com
18 embed-cdn.spotifycdn.com open.spotify.com
embed-cdn.spotifycdn.com
8 gew4-spclient.spotify.com embed-cdn.spotifycdn.com
7 b.6sc.co
7 assets.qualified.com redcanary.com
app.qualified.com
6 script.crazyegg.com redcanary.com
script.crazyegg.com
4 www.google-analytics.com www.googletagmanager.com
cdn.bizible.com
4 cdn.bizible.com redcanary.com
cdn.bizible.com
3 px.ads.linkedin.com 3 redirects
3 encore.scdn.co embed-cdn.spotifycdn.com
3 www.google.de redcanary.com
3 secure.adnxs.com 2 redirects cdn.bizible.com
3 bat.bing.com www.googletagmanager.com
bat.bing.com
redcanary.com
3 j.6sc.co redcanary.com
www.googletagmanager.com
j.6sc.co
3 www.googletagmanager.com redcanary.com
www.googletagmanager.com
2 qualified-production.s3.us-east-1.amazonaws.com
2 epsilon.6sense.com cdn.bizible.com
2 ipv6.6sc.co cdn.bizible.com
2 c.6sc.co cdn.bizible.com
2 www.facebook.com redcanary.com
2 www.google.com redcanary.com
2 apresolve.spotify.com embed-cdn.spotifycdn.com
2 stats.g.doubleclick.net www.googletagmanager.com
cdn.bizible.com
2 connect.facebook.net redcanary.com
connect.facebook.net
2 snap.licdn.com www.googletagmanager.com
snap.licdn.com
2 open.spotify.com redcanary.com
embed-cdn.spotifycdn.com
2 munchkin.marketo.net redcanary.com
munchkin.marketo.net
2 cdnjs.cloudflare.com redcanary.com
1 sentry.io assets.qualified.com
1 app.qualified.com js.qualified.com
1 tracking.crazyegg.com script.crazyegg.com
1 cdn.bizibly.com redcanary.com
1 px4.ads.linkedin.com redcanary.com
1 www.linkedin.com 1 redirects
1 cdn.linkedin.oribi.io snap.licdn.com
1 alb.reddit.com redcanary.com
1 analytics.twitter.com redcanary.com
1 t.co redcanary.com
1 i.scdn.co embed-cdn.spotifycdn.com
1 003-yru-314.mktoresp.com munchkin.marketo.net
1 region1.analytics.google.com www.googletagmanager.com
1 attr.ml-api.io redcanary.com
1 s.ml-attr.com 1 redirects
1 googleads.g.doubleclick.net www.googletagmanager.com
1 www.redditstatic.com www.googletagmanager.com
1 static.ads-twitter.com www.googletagmanager.com
1 fonts.googleapis.com redcanary.com
1 s3-us-west-2.amazonaws.com redcanary.com
1 js.qualified.com redcanary.com
1 resource.redcanary.com redcanary.com
1 ajax.googleapis.com redcanary.com
144 51
Subject Issuer Validity Valid
redcanary.com
R3
2023-07-24 -
2023-10-22
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2023-08-07 -
2023-10-30
3 months crt.sh
resource.redcanary.com
Cloudflare Inc ECC CA-3
2023-04-02 -
2024-04-01
a year crt.sh
io.bizible.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-06-01 -
2024-07-01
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-03-09 -
2024-03-08
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2023-08-07 -
2023-10-30
3 months crt.sh
*.s3-us-west-2.amazonaws.com
Amazon RSA 2048 M01
2023-04-11 -
2023-12-28
9 months crt.sh
*.marketo.net
DigiCert TLS RSA SHA256 2020 CA1
2023-02-06 -
2024-02-05
a year crt.sh
6sc.co
R3
2023-08-19 -
2023-11-17
3 months crt.sh
*.spotify.com
DigiCert TLS RSA SHA256 2020 CA1
2023-03-07 -
2024-03-06
a year crt.sh
*.spotifycdn.com
GlobalSign Atlas R3 DV TLS CA 2023 Q2
2023-07-07 -
2024-08-07
a year crt.sh
ads-twitter.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-07-21 -
2024-07-19
a year crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2023-02-01 -
2024-01-31
a year crt.sh
www.redditstatic.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-08-25 -
2024-02-21
6 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2023-08-07 -
2023-10-30
3 months crt.sh
www.bing.com
Microsoft Azure TLS Issuing CA 05
2023-07-26 -
2024-01-22
6 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2023-06-10 -
2023-09-08
3 months crt.sh
www.google.de
GTS CA 1C3
2023-08-07 -
2023-10-30
3 months crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1
2022-10-05 -
2023-11-05
a year crt.sh
*.scdn.co
GlobalSign Atlas R3 DV TLS CA 2023 Q2
2023-07-07 -
2024-08-07
a year crt.sh
t.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2023-02-05 -
2024-02-05
a year crt.sh
*.twitter.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2023-02-05 -
2024-02-05
a year crt.sh
*.reddit.com
DigiCert TLS RSA SHA256 2020 CA1
2023-04-19 -
2023-10-15
6 months crt.sh
www.google.com
GTS CA 1C3
2023-08-07 -
2023-10-30
3 months crt.sh
linkedin.oribi.io
Amazon RSA 2048 M01
2023-06-08 -
2024-07-07
a year crt.sh
crazyegg.com
Amazon RSA 2048 M02
2023-06-23 -
2024-07-22
a year crt.sh
app.qualified.com
R3
2023-07-22 -
2023-10-20
3 months crt.sh
sentry.io
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-08-08 -
2024-09-07
a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2023-02-13 -
2024-03-15
a year crt.sh
*.6sense.com
Amazon RSA 2048 M01
2023-05-01 -
2024-05-29
a year crt.sh
*.google.de
GTS CA 1C3
2023-08-07 -
2023-10-30
3 months crt.sh
s3.amazonaws.com
Amazon RSA 2048 M01
2023-07-10 -
2024-06-21
a year crt.sh

This page contains 5 frames:

Primary Page: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Frame ID: C8F1F1B38F965871335C45C274060C11
Requests: 98 HTTP requests in this frame

Frame: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Frame ID: 59443E5B45A4EE6F08F34A80265434D3
Requests: 31 HTTP requests in this frame

Frame: https://tracking.crazyegg.com/clock?t=1693508323276&tk=40ea43635c9a9388c5f9f97df894a565&s=360154&p=%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&u=969416&v=4de60124dd6a1ef9cdde4520856015d4904751c2&f=redcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation&ul=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F
Frame ID: C9B7B057B506A9834A000EB23866AF99
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 165599DACBC2ACB31D15A6B90F4F053E
Requests: 1 HTTP requests in this frame

Frame: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=3b4a38d1-dbb1-4b31-8263-29484df5432e
Frame ID: 5FAC76E3BC6F55294A24BE9F769B6D1F
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Windows Management Instrumentation - Red Canary Threat Report

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • /(?:([\d.])+/)?highlight(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

144
Requests

96 %
HTTPS

60 %
IPv6

35
Domains

51
Subdomains

46
IPs

6
Countries

4012 kB
Transfer

14310 kB
Size

45
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 46
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID HTTP 302
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID HTTP 307
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dredcanary.com%2526pId%253d%2524UID HTTP 302
  • https://attr.ml-api.io/?domain=redcanary.com&pId=2845935910886929701
Request Chain 71
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693508322472&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693508322472&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1693508322472%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fthreat-detection-report%252Ftechniques%252Fwindows-management-instrumentation%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693508322472&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesTest=true&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693508322472&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesTest=true&liSync=true&e_ipv6=AQLAG719kUnbNAAAAYpM9kibbzQGd0v02hDPSL7eyv2bQZI82ZRZ_vXYl9_NSHJhVhJC05Wh7EY5kg

144 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
359 KB
64 KB
Document
General
Full URL
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx / WP Engine
Resource Hash
8994173b286983d0ba4938dd7a8da5e6eecbad6eec2982ab528efb6131a8f132
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=600, must-revalidate
content-encoding
br
content-security-policy
upgrade-insecure-requests
content-type
text/html; charset=UTF-8
date
Thu, 31 Aug 2023 18:58:40 GMT
feature-policy
microphone 'none'; geolocation 'none'
link
<https://redcanary.com/?p=33541>; rel=shortlink
referrer-policy
strict-origin-when-cross-origin
server
nginx
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
vary
Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding
x-cache
HIT: 12
x-cache-group
normal
x-cacheable
SHORT
x-content-type-options
nosniff
x-frame-options
deny
x-permitted-cross-domain-policies
master-only
x-powered-by
WP Engine
x-wpe-request-id
e2e305a81acbb37b8028c1303bb7be42
x-xss-protection
1; mode=block
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.6.1/
88 KB
31 KB
Script
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.6.1/jquery.min.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Sun, 27 Aug 2023 09:30:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
379698
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
31100
x-xss-protection
0
last-modified
Thu, 08 Sep 2022 18:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 26 Aug 2024 09:30:23 GMT
forms2.min.js
resource.redcanary.com/js/forms2/js/
208 KB
70 KB
Script
General
Full URL
https://resource.redcanary.com/js/forms2/js/forms2.min.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.71.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f244fcb6b0aeadba8f41f30a7f451c0aaa06445ec854c3d9bbef1c485a036424
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 13 Jul 2023 18:50:22 GMT
server
cloudflare
age
4118
etag
"3340a86-34099-60062cdee3780"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
7ff781a0ebff4d2e-FRA
expires
Thu, 31 Aug 2023 22:58:41 GMT
bizible.js
cdn.bizible.com/scripts/
67 KB
25 KB
Script
General
Full URL
https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67D4) /
Resource Hash
3562dd5ebaf7d001cd283fe325fc4b574e26b053807efb3331dd8fcb5964f559

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
gzip
last-modified
Wed, 30 Aug 2023 15:35:31 GMT
server
ECS (frb/67D4)
age
53293
etag
"b215169c57dbd91:0"
vary
Accept-Encoding
x-cache
HIT
content-type
application/x-javascript
cache-control
max-age=86400
accept-ranges
bytes
content-length
25470
9416.js
script.crazyegg.com/pages/scripts/0096/
6 KB
2 KB
Script
General
Full URL
https://script.crazyegg.com/pages/scripts/0096/9416.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a4499f745882700108e60115ea38c28693bf225e861ffa788c30fceac83fb88e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
gzip
cf-cache-status
HIT
age
12904
cf-polished
origSize=6004
ce-version
11.5.121
cf-bgj
minify
last-modified
Thu, 31 Aug 2023 15:23:37 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
timing-allow-origin
*
cf-ray
7ff781a1fce9373e-FRA
js
www.googletagmanager.com/gtag/
301 KB
94 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
6e6f98c4389081777426fefbe315bf755c164f9983b5d3a2b3f14d62542fc78b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
96160
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Thu, 31 Aug 2023 18:58:41 GMT
qualified.js
js.qualified.com/
329 KB
95 KB
Script
General
Full URL
https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d3cffae0a07184a7f41e99ed86654a87129116d1bc4ad30df766400d3953c404
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:42 GMT
content-encoding
gzip
via
1.1 spaces-router (devel)
strict-transport-security
max-age=63072000; includeSubDomains
cf-cache-status
MISS
x-content-type-options
nosniff
x-permitted-cross-domain-policies
none
x-xss-protection
1; mode=block
x-request-id
0518b7e8-be5f-304b-07ae-a329d22de4f7
pragma
no-cache
x-runtime
0.078062
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
etag
W/"d3cffae0a07184a7f41e99ed86654a87"
x-download-options
noopen
vary
Accept,Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
cache-control
public, max-age=14400
cf-ray
7ff781a1ff399176-FRA
expires
Thu, 31 Aug 2023 22:58:41 GMT
highlight.min.js
cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/
130 KB
33 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/highlight.min.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d2f545bb226e5bcc1d50af37b345d245dce63bc07aaeba2243e0f1ea87b2dcb9
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
10537633
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
33250
last-modified
Mon, 08 Feb 2021 15:10:43 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"60215473-20801"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XItvFnKFGq4wgLoCDg3bW3lzHYVA3hlZCnFFLJCl5dY48BrYby40zLf1iUp5ePkT5ZudKgY3AKRbWnsPInYaX4CxzhJdQLjhkgWP88hrAHFaehJiYXagB0S5WtXwBVKZKwJSqoQzoElislrYYplZCPWI"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff781a14b241e20-FRA
expires
Tue, 20 Aug 2024 18:58:41 GMT
teknkl-formsplus-1.0.5.js
s3-us-west-2.amazonaws.com/s.cdpn.io/250687/
41 KB
41 KB
Script
General
Full URL
https://s3-us-west-2.amazonaws.com/s.cdpn.io/250687/teknkl-formsplus-1.0.5.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.218.169.216 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-us-west-2.amazonaws.com
Software
AmazonS3 /
Resource Hash
731fcb30d45f2e35aaa139a7a964410a7c2bcdbfbb48a837c9d56dec7cc3732f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:58:43 GMT
x-amz-version-id
OjXdZ5iYdmgpgEuq0ftytCBc_PO35ThO
Last-Modified
Thu, 26 Apr 2018 08:20:46 GMT
Server
AmazonS3
x-amz-request-id
47E4GERK7X088ASB
ETag
"bab0c2b3523f8244564b675fe34db610"
Content-Type
application/x-js
Cache-Control
public
Accept-Ranges
bytes
Content-Length
41617
x-amz-id-2
jtML7fHAwPIcdTrmI/JPIiX1l0pM/u7+6XqjU6L1WM+1pEtCBEjgai64JUzJbzv3zbh+akT0kaI=
autoptimize_7b69b65ef8ada1b627de544e100cc1d8.js
redcanary.com/wp-content/cache/autoptimize/js/
288 KB
82 KB
Script
General
Full URL
https://redcanary.com/wp-content/cache/autoptimize/js/autoptimize_7b69b65ef8ada1b627de544e100cc1d8.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
6e0b02e307a08a6384527ffd3c99e8a3d4f83927b855c2ab6836e951337be886
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Wed, 16 Aug 2023 15:12:29 GMT
server
nginx
etag
W/"64dce75d-48160"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
976a5b5cf78ee7201a2a602900559a0b
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.64.124.188 Prague, Czech Republic, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-64-124-188.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:58:41 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 Mar 2023 01:24:48 GMT
Server
AkamaiNetStorage
ETag
"cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
729
gtm.js
www.googletagmanager.com/
287 KB
95 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
176be825d2d8a9067afb1920060b4ca608fda05a7ce1da76bea32a56b446367b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
97052
x-xss-protection
0
last-modified
Thu, 31 Aug 2023 18:34:20 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 31 Aug 2023 18:58:41 GMT
6si.min.js
j.6sc.co/
51 KB
15 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.142.112 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-142-112.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
3ac0c589d242920586289eabdd93bf71f3d85bb1c6c8333d3e2deb4e173b61a4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 24 Aug 2023 22:29:49 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"64e7d9dd-cc38"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
14993
expires
Thu, 31 Aug 2023 18:58:41 GMT
css
fonts.googleapis.com/
7 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
dd25827c9ad7ac0cbdb3545ed377f0ff5c9d5c1d14282307cf04ac4776d0a572
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Thu, 31 Aug 2023 18:58:41 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 31 Aug 2023 18:58:41 GMT
autoptimize_7c1b044830350562b8347035fb5ab725.css
redcanary.com/wp-content/cache/autoptimize/css/
5 MB
253 KB
Stylesheet
General
Full URL
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
35134ff1cfb9ea2e3a5d5e63856b1efeba6893a5bcbfb93a73b6e4b671239282
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Wed, 16 Aug 2023 15:12:30 GMT
server
nginx
etag
W/"64dce75e-53c907"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
d5c46a59ef87397d325e632d4a026a9d
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
default.min.css
cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/
763 B
610 B
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/default.min.css
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3cc36c64ef86bed21592653daac82fd7e4c364c32c8344336aa13f7dbf52c90
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
19738547
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
271
last-modified
Mon, 08 Feb 2021 15:10:43 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"60215473-2fb"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OWVrvGwE2XRVgDkmYxodCr%2FeWpSUSAtovCb0rQ%2B7w9wNxNWRPq%2BU1ergjzpQmCDwEqFwq9JaVO3jXd24ZE%2FNgqZmh%2B0laoNdhWhmpOCHGGRGg4RqUkZaQQH3ZCBZ4FLRX%2FNCq4qrk2Lpvk9yJ0fum1KW"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff781a1aba21e20-FRA
expires
Tue, 20 Aug 2024 18:58:41 GMT
truncated
/
64 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
65 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9edb5c5ef600768db6e8ee027853f2c6f8ab34f615b495faaf114579f8de2e22

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Type
image/svg+xml
bullet-square.svg
redcanary.com/wp-content/themes/redcanary/assets/img/
443 B
654 B
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/bullet-square.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
6217f642930c0d2411329fb00cf9a7e2e138a98f56eece6e82b3a7359f20cb11
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 23 Aug 2021 16:46:07 GMT
server
nginx
etag
W/"6123d0cf-1bb"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
bdddd26d0209e7081607c3dd2dd23ec3
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
source-sans-pro-v21-latin-regular.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/
13 KB
13 KB
Font
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-regular.woff2
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Origin
https://redcanary.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Thu, 02 Jun 2022 17:26:25 GMT
server
nginx
etag
"6298f2c1-32ec"
vary
Accept-Encoding
x-wpe-request-id
d3f247c9a847ad1ccf89728fcaba9276
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
13036
source-sans-pro-v21-latin-700.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/
13 KB
13 KB
Font
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-700.woff2
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
7348a2eb48c9a681d6178433394c7037144d85b57ee33a11339d3a33fa1001a4
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Origin
https://redcanary.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Thu, 02 Jun 2022 17:26:24 GMT
server
nginx
etag
"6298f2c0-327c"
vary
Accept-Encoding
x-wpe-request-id
19b541ea5a1afec8b6a38db89292e50f
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
12924
source-sans-pro-v21-latin-300.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/
13 KB
13 KB
Font
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-300.woff2
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
122854df4f39cf922db317714c2ff0eccab27a1028c14a5aa2211f48b7e0eade
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Origin
https://redcanary.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Thu, 02 Jun 2022 17:26:22 GMT
server
nginx
etag
"6298f2be-329c"
vary
Accept-Encoding
x-wpe-request-id
a1a011bb081421d6f8e26d8e672ebd4c
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
12956
source-sans-pro-v21-latin-600.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/
13 KB
13 KB
Font
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-600.woff2
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Origin
https://redcanary.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Thu, 02 Jun 2022 17:26:23 GMT
server
nginx
etag
"6298f2bf-32fc"
vary
Accept-Encoding
x-wpe-request-id
ebaf40efe7f602bcc247f8fbae194200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
13052
56z2qI0gKcPthQF6l8AW3E
open.spotify.com/embed/track/ Frame 5944
11 KB
5 KB
Document
General
Full URL
https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:c36:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy / Next.js
Resource Hash
ad73a65390838c7aa6178369b1d1df0ecc23a314ec62655313582be575ade8dd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://redcanary.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 31 Aug 2023 18:58:41 GMT
etag
"11r4izfshuv8m3"
server
envoy
sp-trace-id
9c2e36cdf76e7af2
strict-transport-security
max-age=31536000
vary
Accept-Encoding
via
HTTP/2 edgeproxy, 1.1 google
x-content-type-options
nosniff
x-powered-by
Next.js
truncated
/
68 B
68 B
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3a48ba6d11055a2a6f840befa14e603650d8ca3d752e16daccd828d3869fb791

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Type
image/svg+xml
redcanary.com.json
script.crazyegg.com/pages/data-scripts/0096/9416/site/
5 KB
2 KB
XHR
General
Full URL
https://script.crazyegg.com/pages/data-scripts/0096/9416/site/redcanary.com.json?t=1
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0096/9416.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f1d4b7e28e37dd7d9a576c9b49f998374ed3a3d34a3e8cf865fa134a8486f14c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
gzip
cf-cache-status
HIT
age
10562
ce-version
11.5.121
content-length
1539
last-modified
Thu, 31 Aug 2023 16:02:39 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff781a2d88b5c98-FRA
munchkin.js
munchkin.marketo.net/163/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/163/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.64.124.188 Prague, Czech Republic, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-64-124-188.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:58:41 GMT
Content-Encoding
gzip
Last-Modified
Fri, 06 Jan 2023 02:26:40 GMT
Server
AkamaiNetStorage
ETag
"ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4741
Expires
Sat, 09 Dec 2023 18:58:41 GMT
8cd00e627952ec8a.css
embed-cdn.spotifycdn.com/_next/static/css/ Frame 5944
26 KB
4 KB
Stylesheet
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/css/8cd00e627952ec8a.css
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
8ec32112354b4493286cb34daa05fa0a49791553bfedb374d7a67c7ad9cb2c9f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
gzip
age
4435183
x-amz-meta-goog-reserved-file-mtime
1689072066
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
4039
x-served-by
cache-chi-kigq8000089-CHI, cache-fra-eddf8230106-FRA
last-modified
Tue, 11 Jul 2023 10:56:36 GMT
etag
"f3d572702831405545a59c2b3c1f6f80"
x-goog-generation
1689072996772325
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
26326
accept-ranges
bytes
x-cache-hits
6, 86722
c47c6e7745a8b455.css
embed-cdn.spotifycdn.com/_next/static/css/ Frame 5944
34 KB
6 KB
Stylesheet
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/css/c47c6e7745a8b455.css
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
16005d3dd555b3e66dd9ebf840d8b225ee02966d26b62f58aea68e6808ff3c83

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
gzip
age
109924
x-amz-meta-goog-reserved-file-mtime
1693397565
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
5946
x-served-by
cache-chi-kigq8000053-CHI, cache-fra-eddf8230106-FRA
last-modified
Wed, 30 Aug 2023 12:25:18 GMT
etag
"fcbec68c9d848190b4c167a8202f2ffd"
x-goog-generation
1693398318469994
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
35014
x-amz-checksum-crc32c
v/JnmQ==
accept-ranges
bytes
x-cache-hits
2, 4147
webpack-3e4f342dbb144246.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 5944
5 KB
2 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
f526e42397f6b24d9b2c3cb34f9cec6af49cc7e1eb921f397a2ce7315fd607d1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
gzip
age
109924
x-amz-meta-goog-reserved-file-mtime
1693397565
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
2186
x-served-by
cache-chi-kigq8000089-CHI, cache-fra-eddf8230106-FRA
last-modified
Wed, 30 Aug 2023 12:25:18 GMT
etag
"afb8c163c2105c690dae52a64acf740d"
x-goog-generation
1693398318516219
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
4611
x-amz-checksum-crc32c
lAXGCg==
accept-ranges
bytes
x-cache-hits
5, 15461
framework-33d379e787c03ddb.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 5944
127 KB
41 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/framework-33d379e787c03ddb.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
b40d37fbb13b1b903fd3c063523b41c47c57e61ab99cad3bd35881672ea3e3d6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
gzip
age
8686463
x-amz-meta-goog-reserved-file-mtime
1684765243
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
42161
x-served-by
cache-chi-kigq8000070-CHI, cache-fra-eddf8230106-FRA
last-modified
Mon, 22 May 2023 14:27:39 GMT
etag
"124a9f12f15f3120a5ef711a66ba2662"
x-goog-generation
1684765659849262
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
129927
accept-ranges
bytes
x-cache-hits
739, 90187
main-0117c27f823659ce.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 5944
111 KB
33 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/main-0117c27f823659ce.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
99e97366cd580fb716ea693b2696808c006d45c6366004db4286156077f20c4f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
gzip
age
7186678
x-amz-meta-goog-reserved-file-mtime
1686222071
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
33612
x-served-by
cache-chi-kigq8000158-CHI, cache-fra-eddf8230106-FRA
last-modified
Thu, 08 Jun 2023 11:07:26 GMT
etag
"81865ede7cdb1740008282943c7855ac"
x-goog-generation
1686222445991402
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
113515
accept-ranges
bytes
x-cache-hits
617, 89780
_app-fe44d090509824d5.js
embed-cdn.spotifycdn.com/_next/static/chunks/pages/ Frame 5944
507 KB
138 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
f872315d333981663bad5953d1280c886beab704fa9a9d2abc768352aa71d39a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
gzip
age
109924
x-amz-meta-goog-reserved-file-mtime
1693397565
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
140746
x-served-by
cache-chi-kigq8000132-CHI, cache-fra-eddf8230106-FRA
last-modified
Wed, 30 Aug 2023 12:25:18 GMT
etag
"5686bcaf61d1e15b5f94a8ec151d3215"
x-goog-generation
1693398318953757
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
518987
x-amz-checksum-crc32c
ZWKppg==
accept-ranges
bytes
x-cache-hits
2, 53
fec483df-b230338ad030162e.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 5944
320 KB
99 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/fec483df-b230338ad030162e.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
53f545d884abf02ce99f4e0369ffec8be28f1f3f22eb99bf0fab9f4522ea5142

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
gzip
age
6779853
x-amz-meta-goog-reserved-file-mtime
1686661750
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
100913
x-served-by
cache-chi-klot8100047-CHI, cache-fra-eddf8230106-FRA
last-modified
Tue, 13 Jun 2023 13:18:59 GMT
etag
"9c4d5b20d500a4646af02cb2e28e11da"
x-goog-generation
1686662339475826
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
327829
accept-ranges
bytes
x-cache-hits
462, 90308
415-d009a9159d740903.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 5944
25 KB
6 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/415-d009a9159d740903.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
2fb0db460ef1851e44c7e94a3f1944e299e306def449ed72c30adfb89b25b029

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
gzip
age
2542543
x-amz-meta-goog-reserved-file-mtime
1690964677
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
5881
x-served-by
cache-chi-kigq8000020-CHI, cache-fra-eddf8230106-FRA
last-modified
Wed, 02 Aug 2023 08:40:17 GMT
etag
"f45ad0e97a8e71419371027175275215"
x-goog-generation
1690965617730993
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
25338
x-amz-checksum-crc32c
I6sMew==
accept-ranges
bytes
x-cache-hits
7, 84994
122-f7d6a526163e333e.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 5944
262 KB
72 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/122-f7d6a526163e333e.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
1486615b34c43bee393a5dd74f110c6f25c5f2d66d8111278f54e77ffcbc63a3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
gzip
age
127103
x-amz-meta-goog-reserved-file-mtime
1693380126
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
73305
x-served-by
cache-chi-kigq8000095-CHI, cache-fra-eddf8230106-FRA
last-modified
Wed, 30 Aug 2023 07:38:06 GMT
etag
"09569bb140037810c364b24b4e3dbfb2"
x-goog-generation
1693381086734856
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
267882
x-amz-checksum-crc32c
vgEZdw==
accept-ranges
bytes
x-cache-hits
64, 17858
345-dd05f38d7ac8a99d.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 5944
96 KB
25 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/345-dd05f38d7ac8a99d.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
24b99703cc2b2d010f48778c5700beb1ed63e688c460b7498c911bb4a97e2e23

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
gzip
age
127103
x-amz-meta-goog-reserved-file-mtime
1693380126
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
25529
x-served-by
cache-chi-kigq8000078-CHI, cache-fra-eddf8230106-FRA
last-modified
Wed, 30 Aug 2023 07:38:06 GMT
etag
"2ae89e701fdd03960a8a00c1f5dcfa88"
x-goog-generation
1693381086719715
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
98413
x-amz-checksum-crc32c
+DCSmw==
accept-ranges
bytes
x-cache-hits
63, 17718
%5Bid%5D-025dca3822d6ecec.js
embed-cdn.spotifycdn.com/_next/static/chunks/pages/track/ Frame 5944
31 KB
9 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/track/%5Bid%5D-025dca3822d6ecec.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
99011a0690be8d013bbf0ba1c7e2921db4c6f9e03d6d78e03ca8e1e826bf5b96

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
gzip
age
127102
x-amz-meta-goog-reserved-file-mtime
1693380126
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
8521
x-served-by
cache-chi-kigq8000160-CHI, cache-fra-eddf8230106-FRA
last-modified
Wed, 30 Aug 2023 07:38:06 GMT
etag
"ac10207c64f660116f59fdf475284935"
x-goog-generation
1693381086898125
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
31582
x-amz-checksum-crc32c
q2CFuQ==
accept-ranges
bytes
x-cache-hits
54, 4455
_buildManifest.js
embed-cdn.spotifycdn.com/_next/static/860b7926-9444-42a4-a58e-096cebb90b02/ Frame 5944
2 KB
1023 B
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/860b7926-9444-42a4-a58e-096cebb90b02/_buildManifest.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d9e0863aa56b8cba71d458f9491fdca3c7cc6b0eddbc288d0dfe3d41d0a30eef

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
gzip
age
109924
x-amz-meta-goog-reserved-file-mtime
1693397565
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
821
x-served-by
cache-chi-klot8100127-CHI, cache-fra-eddf8230106-FRA
last-modified
Wed, 30 Aug 2023 12:25:18 GMT
etag
"e4f2f5f28d975e18a45aa130cfa30f72"
x-goog-generation
1693398318168737
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
2163
x-amz-checksum-crc32c
8Pix6g==
accept-ranges
bytes
x-cache-hits
5, 15464
_ssgManifest.js
embed-cdn.spotifycdn.com/_next/static/860b7926-9444-42a4-a58e-096cebb90b02/ Frame 5944
77 B
261 B
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/860b7926-9444-42a4-a58e-096cebb90b02/_ssgManifest.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
gzip
age
109924
x-amz-meta-goog-reserved-file-mtime
1693397565
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
61
x-served-by
cache-chi-klot8100033-CHI, cache-fra-eddf8230106-FRA
last-modified
Wed, 30 Aug 2023 12:25:18 GMT
etag
"b6652df95db52feb4daf4eca35380933"
x-goog-generation
1693398318123960
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
77
x-amz-checksum-crc32c
Ypo4GQ==
accept-ranges
bytes
x-cache-hits
1, 15472
uwt.js
static.ads-twitter.com/
56 KB
15 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
146.75.116.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
gzip
last-modified
Thu, 27 Oct 2022 16:56:53 GMT
etag
"32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary
Accept-Encoding,Host
x-cache
HIT, HIT
content-type
application/javascript; charset=utf-8
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn
FT
cache-control
no-cache
accept-ranges
bytes
content-length
15375
x-served-by
cache-iad-kjyo7100081-IAD, cache-fra-eddf8230121-FRA
insight.min.js
snap.licdn.com/li.lms-analytics/
1 KB
1 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:1497 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
292f853f9ef0e448c5536987fe87197f401bafcde3e0857e17de1f0676f5b2eb
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
x-content-type-options
nosniff
last-modified
Wed, 30 Aug 2023 18:41:20 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
content-type
application/javascript;charset=utf-8
cache-control
max-age=76692
accept-ranges
bytes
content-length
1046
pixel.js
www.redditstatic.com/ads/
23 KB
8 KB
Script
General
Full URL
https://www.redditstatic.com/ads/pixel.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:400::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
last-modified
Thu, 15 Jun 2023 20:49:59 GMT
server
snooserv
nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag
"4a205643a240cb95fa82289d62b5af7e"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding,Origin
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type
application/javascript
cache-control
public, max-age=60
accept-ranges
bytes
content-length
7409
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/
3 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/?random=1693508321784&cv=11&fst=1693508321784&bg=ffffff&guid=ON&async=1&gtm=45He38u0&u_w=1600&u_h=1200&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&hn=www.googleadservices.com&frm=0&tiba=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&auid=216149889.1693508322&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
317ee837827c977d173835f63d93a514075cddc5f7c52c31caa7d89dee648b08
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1356
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
bat.js
bat.bing.com/
42 KB
13 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2f472251b6b4a4a8d7ceed7539cb6ebea71caf28bccc0beda7a6866a6847b53e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Thu, 31 Aug 2023 18:58:41 GMT
last-modified
Fri, 28 Jul 2023 18:19:39 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 0481AD042D384920AA04349CE241ECE2 Ref B: FRA31EDGE0506 Ref C: 2023-08-31T18:58:41Z
etag
"806f3b1280c1d91:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
12469
fbevents.js
connect.facebook.net/en_US/
193 KB
52 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
9e41e783ec4cfc524c1666d1d5a4c805f8e92be52b030d130acfb31105e1e04c
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Thu, 31 Aug 2023 18:58:41 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
52127
x-xss-protection
0
pragma
public
x-fb-debug
/lWUzLhXdFeaKbmCwkMRSiqIFXcqjibl1FbYmww4t1bFe1G2KqVXUAcz8AV1Ubtpc2LPVYCFSQ0Gz3Trk0JXXQ==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires
Sat, 01 Jan 2000 00:00:00 GMT
js
www.googletagmanager.com/gtag/
301 KB
94 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
a2fddc4ed1c9bf8894fef28beb525f07fa0f74db732511b6c8986f7eff8e853b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
96233
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Thu, 31 Aug 2023 18:58:41 GMT
/
attr.ml-api.io/
Redirect Chain
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dredcanary.com%2526pId%253d%2524UID
  • https://attr.ml-api.io/?domain=redcanary.com&pId=2845935910886929701
0
235 B
Image
General
Full URL
https://attr.ml-api.io/?domain=redcanary.com&pId=2845935910886929701
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Server
2600:9000:2251:9000:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:43 GMT
via
1.1 39e6266db143f6443f194d8c60e22480.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P3
x-cache
Miss from cloudfront
content-type
application/json
x-amz-cf-id
TxAcA4CC5av2ap5UXoy-pfxnW2vKXHSkWfFj8B3jjjwHLG4igIB8ng==
content-length
0
apigw-requestid
KihjijLnoAMEJ5Q=

Redirect headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:58:42 GMT
an-x-request-uuid
83b3ab72-d50f-4c62-90da-1aa746685c53
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
location
https://attr.ml-api.io/?domain=redcanary.com&pId=2845935910886929701
x-proxy-origin
217.114.218.27; 217.114.218.27; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length
0
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
b2625509b46b716ab8df67870a7d87b8.js
script.crazyegg.com/pages/versioned/common-scripts/
91 KB
31 KB
Script
General
Full URL
https://script.crazyegg.com/pages/versioned/common-scripts/b2625509b46b716ab8df67870a7d87b8.js
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0096/9416.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6bc9a4bdde5c48a39cabd8840dec8bd11281dcdd167cf4440f383f01ad3ab123

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:41 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Thu, 24 Aug 2023 15:03:06 GMT
server
cloudflare
age
20530
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000, s-maxage=31536000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff781a35f2e373e-FRA
content-length
31312
collect
region1.analytics.google.com/g/
0
252 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-T3K4MTNQJN&gtm=45je38u0&_p=137598725&_gaz=1&cid=649153911.1693508322&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EA&_s=1&sid=1693508321&sct=1&seg=0&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&dt=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:58:42 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://redcanary.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/
0
252 B
Ping
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-T3K4MTNQJN&cid=649153911.1693508322&gtm=45je38u0&aip=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:58:42 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://redcanary.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
408 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-T3K4MTNQJN&cid=649153911.1693508322&gtm=45je38u0&aip=1&z=1795449739
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:58:42 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
visitWebPage
003-yru-314.mktoresp.com/webevents/
2 B
318 B
Ping
General
Full URL
https://003-yru-314.mktoresp.com/webevents/visitWebPage?_mchNc=1693508322004&_mchCn=&_mchId=003-YRU-314&_mchTk=_mch-redcanary.com-1693508322003-29241&_mchHo=redcanary.com&_mchPo=&_mchRu=%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:58:42 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
731f5d00-22a0-4130-8aa5-f1d78092a5aa
ab67616d00001e02ebcc9144c41ae7d42efe6d94
i.scdn.co/image/ Frame 5944
31 KB
32 KB
Image
General
Full URL
https://i.scdn.co/image/ab67616d00001e02ebcc9144c41ae7d42efe6d94
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/css/c47c6e7745a8b455.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:8d::760 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cc240e36234dec6c472a04a70af52dfa5dce110a2766d9280e19fb12cde54e9d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://embed-cdn.spotifycdn.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:58:42 GMT
Age
728076
X-Cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
Connection
keep-alive
Content-Length
31979
X-Served-By
cache-chi-kigq8000117-CHI, cache-fra-eddf8230044-FRA
Last-Modified
Wed, 04 Sep 2019 11:41:29 GMT
ETag
"7684273fe7fc515e237eab3b4c5eef9d"
x-goog-generation
1567597289264217
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
max-age=315360000
x-goog-stored-content-length
31979
x-amz-checksum-crc32c
1a4KSA==
Accept-Ranges
bytes
Timing-Allow-Origin
*
X-Cache-Hits
11653, 1
CircularSpTitle-Bold-2fbf72b606d7f0b0f771ea4956a8b4d6.woff2
encore.scdn.co/fonts/ Frame 5944
85 KB
86 KB
Font
General
Full URL
https://encore.scdn.co/fonts/CircularSpTitle-Bold-2fbf72b606d7f0b0f771ea4956a8b4d6.woff2
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/css/8cd00e627952ec8a.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:6::17d8:4dae Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
1d752805498ebd36b9c69ad1d3da93b1561ea6b33f58ec89a66a4228a357dfe2
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://embed-cdn.spotifycdn.com/
Origin
https://open.spotify.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:42 GMT
content-encoding
gzip
strict-transport-security
max-age=15768000
content-length
87344
last-modified
Thu, 19 May 2022 07:59:23 GMT
etag
"db1a27b35e26398fef4be920ea96078d"
vary
Accept-Encoding
access-control-max-age
86400
content-type
font/woff2
access-control-allow-origin
*
access-control-allow-methods
GET
cache-control
max-age=31536000
x-amz-checksum-crc32c
r/+ZKQ==
accept-ranges
bytes
access-control-allow-headers
range
expires
Fri, 30 Aug 2024 18:58:42 GMT
CircularSp-Book-4eaffdf96f4c6f984686e93d5d9cb325.woff2
encore.scdn.co/fonts/ Frame 5944
82 KB
82 KB
Font
General
Full URL
https://encore.scdn.co/fonts/CircularSp-Book-4eaffdf96f4c6f984686e93d5d9cb325.woff2
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/css/8cd00e627952ec8a.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:6::17d8:4dae Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
9b7413f945c8b8bb3f75eb10513c7ad79d386e98494d541e5f1fa9301ffbddd6
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://embed-cdn.spotifycdn.com/
Origin
https://open.spotify.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:42 GMT
content-encoding
gzip
strict-transport-security
max-age=15768000
content-length
84027
last-modified
Fri, 13 May 2022 11:38:51 GMT
etag
"f7b12903dd7a2d536ceb2b7cd1dba2c1"
vary
Accept-Encoding
access-control-max-age
86400
content-type
font/woff2
access-control-allow-origin
*
access-control-allow-methods
GET
cache-control
max-age=31536000
x-amz-checksum-crc32c
rmKVPg==
accept-ranges
bytes
access-control-allow-headers
range
expires
Fri, 30 Aug 2024 18:58:42 GMT
monitoring
open.spotify.com/embed/ Frame 5944
2 B
412 B
Fetch
General
Full URL
https://open.spotify.com/embed/monitoring?o=22381&p=4505164808585216
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:c36:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://open.spotify.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

sp-trace-id
dc19125205e7289f
date
Thu, 31 Aug 2023 18:58:42 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
via
1.1 google, HTTP/2 edgeproxy, 1.1 google
server
envoy
vary
origin,access-control-request-method,access-control-request-headers, Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
x-sentry-error,x-sentry-rate-limits,retry-after
x-envoy-upstream-service-time
2
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000, h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
/
apresolve.spotify.com/ Frame 5944
273 B
270 B
XHR
General
Full URL
https://apresolve.spotify.com/?type=dealer&type=spclient
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:0:524d:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
cca95ef2a816865f55df96aedf861e29dd6dbe5c7c968a53de535de77089c6ee

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:42 GMT
content-encoding
gzip
via
1.1 google
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
110
CircularSp-Bold-fe1cfc14b7498b187c78fa72fb72d148.woff2
encore.scdn.co/fonts/ Frame 5944
87 KB
88 KB
Font
General
Full URL
https://encore.scdn.co/fonts/CircularSp-Bold-fe1cfc14b7498b187c78fa72fb72d148.woff2
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/css/8cd00e627952ec8a.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:6::17d8:4dae Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
039130d456855a745451bff40707bee5512bc4466373224b2258f67cc6c6d879
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://embed-cdn.spotifycdn.com/
Origin
https://open.spotify.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:42 GMT
content-encoding
gzip
strict-transport-security
max-age=15768000
content-length
89529
last-modified
Fri, 13 May 2022 11:38:50 GMT
etag
"216b12b5a9657850b1b324e158454f8e"
vary
Accept-Encoding
access-control-max-age
86400
content-type
font/woff2
access-control-allow-origin
*
access-control-allow-methods
GET
cache-control
max-age=31536000
x-amz-checksum-crc32c
3OfNxA==
accept-ranges
bytes
access-control-allow-headers
range
expires
Fri, 30 Aug 2024 18:58:42 GMT
adsct
t.co/i/
43 B
375 B
Image
General
Full URL
https://t.co/i/adsct?bci=3&eci=2&event_id=23113879-02e6-494a-83c2-1af21609b464&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=e991eb67-15ef-4cd4-af20-1f18bcb8f125&tw_document_href=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o015g&type=javascript&version=2.3.29
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.197 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-response-time
172
date
Thu, 31 Aug 2023 18:58:41 GMT
strict-transport-security
max-age=0
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
0b9e112351ebcde8
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
c980b710d30d0c7a15c38baac915699bf4012ff8b106e02f61a705376e759466
content-length
43
adsct
analytics.twitter.com/i/
43 B
396 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=23113879-02e6-494a-83c2-1af21609b464&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=e991eb67-15ef-4cd4-af20-1f18bcb8f125&tw_document_href=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o015g&type=javascript&version=2.3.29
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.195 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-response-time
175
date
Thu, 31 Aug 2023 18:58:42 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
5844a074c0beadd0
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
4c58ef4142dad279d079b405b4eadfff4095c88e6169840ce62164a750bdc37d
content-length
43
insight.old.min.js
snap.licdn.com/li.lms-analytics/
13 KB
5 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:1497 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 28 Aug 2023 12:14:15 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=36464
accept-ranges
bytes
content-length
4862
1042590016249604
connect.facebook.net/signals/config/
137 KB
35 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/1042590016249604?v=2.9.125&r=stable&domain=redcanary.com
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
5d07fef4322254c5ef1217d36478f2493d1dcdea7254b5f35adf231c55588cb4
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Thu, 31 Aug 2023 18:58:42 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
35944
x-xss-protection
0
pragma
public
x-fb-debug
AUNFgR52n3zgT6B8Ub6iXF9QDULezuWIN32a5QK20Pez8Gxbp6Q214ITQFPmmtc7FDkkVWo94R3HK/3zR7UUIw==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
origin-agent-cluster
?0
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires
Sat, 01 Jan 2000 00:00:00 GMT
rp.gif
alb.reddit.com/
42 B
637 B
Image
General
Full URL
https://alb.reddit.com/rp.gif?ts=1693508322199&id=t2_5kac730w&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=b9c064d4-2a9f-4315-9d61-8bb0888deadd&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_f5bd31b2
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Varnish /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:42 GMT
via
1.1 varnish
nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server
Varnish
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type
image/gif
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
42
retry-after
0
662.dc13e1cf69424def.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 5944
56 KB
12 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/662.dc13e1cf69424def.js
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
fd7385bd0bc7f291c2370cc63389d132bcac95e8449f516bbd8c0e40c10cdabe

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:42 GMT
content-encoding
gzip
age
2542544
x-amz-meta-goog-reserved-file-mtime
1690964677
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
12292
x-served-by
cache-chi-kigq8000034-CHI, cache-fra-eddf8230106-FRA
last-modified
Wed, 02 Aug 2023 08:40:17 GMT
etag
"f63aef00c0a6fb21f8372a038ee41c3a"
x-goog-generation
1690965617313097
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
57497
x-amz-checksum-crc32c
yfdB0g==
accept-ranges
bytes
x-cache-hits
8, 81249
90.e174c663531d2840.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 5944
5 KB
2 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/90.e174c663531d2840.js
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
1004dc1b12f999eafe5336d4c92c18af95daf65af8b2bd641d29e697efb56364

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:42 GMT
content-encoding
gzip
age
2542544
x-amz-meta-goog-reserved-file-mtime
1690964677
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
1750
x-served-by
cache-chi-klot8100099-CHI, cache-fra-eddf8230106-FRA
last-modified
Wed, 02 Aug 2023 08:40:17 GMT
etag
"9a75e6801ccd6da13a45572ceefe7d6b"
x-goog-generation
1690965617342176
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
5117
x-amz-checksum-crc32c
467rEw==
accept-ranges
bytes
x-cache-hits
8, 79147
/
apresolve.spotify.com/ Frame 5944
273 B
174 B
Fetch
General
Full URL
https://apresolve.spotify.com/?type=dealer&type=spclient
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:0:524d:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
c50d38b6e5102868bfcab53c19db01fb7e7f78a180795822dfc6cc90492a7c24

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:42 GMT
content-encoding
gzip
via
1.1 google
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
111
56383426.js
bat.bing.com/p/action/
0
118 B
Script
General
Full URL
https://bat.bing.com/p/action/56383426.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
date
Thu, 31 Aug 2023 18:58:41 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 7E79C1684A5F4BA0BBE93280637CFF01 Ref B: FRA31EDGE0506 Ref C: 2023-08-31T18:58:42Z
x-cache
CONFIG_NOCACHE
627f7126-ee06-4466-b7ce-fa6eea1dea44
https://open.spotify.com/ Frame 5944
46 KB
0
Other
General
Full URL
blob:https://open.spotify.com/627f7126-ee06-4466-b7ce-fa6eea1dea44
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3436a3567df14bd76a0e5b2ab1edba77ff61c49fb811b64de0dd23899103ecdc

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Length
46922
Content-Type
/
www.google.com/pagead/1p-user-list/759876114/
42 B
455 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/759876114/?random=1693508321784&cv=11&fst=1693504800000&bg=ffffff&guid=ON&async=1&gtm=45He38u0&u_w=1600&u_h=1200&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&frm=0&tiba=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&fmt=3&is_vtc=1&random=3158028150&rmt_tld=0&ipr=y
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:58:42 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/759876114/
42 B
154 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/759876114/?random=1693508321784&cv=11&fst=1693504800000&bg=ffffff&guid=ON&async=1&gtm=45He38u0&u_w=1600&u_h=1200&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&frm=0&tiba=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&fmt=3&is_vtc=1&random=3158028150&rmt_tld=1&ipr=y
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:58:42 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
token
cdn.linkedin.oribi.io/partner/1540753/domain/redcanary.com/
36 B
375 B
XHR
General
Full URL
https://cdn.linkedin.oribi.io/partner/1540753/domain/redcanary.com/token
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:c000:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept
*
Referer
https://redcanary.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:20:24 GMT
content-encoding
gzip
via
1.1 f7bf326347bdd7f275a38a22b5b83724.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
age
2298
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=3600
x-amz-cf-id
30XE2U56RkPVETGED4VRuS9bZsalnWAlvrDm6UKhk7iUJxOH9c2hCQ==
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693508322472&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693508322472&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesT...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1693508322472%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fthre...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693508322472&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesT...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693508322472&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookies...
0
267 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693508322472&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesTest=true&liSync=true&e_ipv6=AQLAG719kUnbNAAAAYpM9kibbzQGd0v02hDPSL7eyv2bQZI82ZRZ_vXYl9_NSHJhVhJC05Wh7EY5kg
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:43 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: F1DBD7C867CC466BB3A17D1FFE5899C6 Ref B: FRAEDGE1117 Ref C: 2023-08-31T18:58:43Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-ltx1
x-li-proto
http/2
content-length
0
x-li-uuid
AAYEPKIPhfGDh2QM96/ddg==

Redirect headers

date
Thu, 31 Aug 2023 18:58:42 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: A939F182B08647329508120741E39B88 Ref B: DUS30EDGE0718 Ref C: 2023-08-31T18:58:43Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693508322472&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesTest=true&liSync=true&e_ipv6=AQLAG719kUnbNAAAAYpM9kibbzQGd0v02hDPSL7eyv2bQZI82ZRZ_vXYl9_NSHJhVhJC05Wh7EY5kg
x-li-proto
http/2
content-length
0
x-li-uuid
AAYEPKILhBSOi/byo9yH3w==
239.07bc4bf7922798bd.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 5944
112 KB
32 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/239.07bc4bf7922798bd.js
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
62c59060782cf4822b2598e623b331039dc6e4a1f8ded9c07032eb91f60adc20

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:42 GMT
content-encoding
gzip
age
2542543
x-amz-meta-goog-reserved-file-mtime
1690964677
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
32825
x-served-by
cache-chi-klot8100053-CHI, cache-fra-eddf8230106-FRA
last-modified
Wed, 02 Aug 2023 08:40:17 GMT
etag
"754ab6b3cee4b386497a168a8900298e"
x-goog-generation
1690965617240921
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
114759
x-amz-checksum-crc32c
Xrafeg==
accept-ranges
bytes
x-cache-hits
8, 82245
70.0c0cdff9477a566b.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 5944
241 KB
53 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/70.0c0cdff9477a566b.js
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6ea27beb5e90d0b65a769f26f1864df79c97c997cc279952734892eeafd5ab05

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:42 GMT
content-encoding
gzip
age
2542543
x-amz-meta-goog-reserved-file-mtime
1690964677
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
54273
x-served-by
cache-chi-kigq8000064-CHI, cache-fra-eddf8230106-FRA
last-modified
Wed, 02 Aug 2023 08:40:17 GMT
etag
"d01bb82fc57aa696eb7a37f25227533f"
x-goog-generation
1690965617620460
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
246299
x-amz-checksum-crc32c
60anbQ==
accept-ranges
bytes
x-cache-hits
8, 82777
spotify_player_o.42e735f526de3a43.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 5944
25 KB
7 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/spotify_player_o.42e735f526de3a43.js
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ccccfce93233bff70d19b919d1cb552aed5bc6caac3fc76d01ab6f4c757901d9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:42 GMT
content-encoding
gzip
age
2542544
x-amz-meta-goog-reserved-file-mtime
1690964677
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
7328
x-served-by
cache-chi-klot8100155-CHI, cache-fra-eddf8230106-FRA
last-modified
Wed, 02 Aug 2023 08:40:17 GMT
etag
"615db0ae9631539d4b3438ee8a5a68da"
x-goog-generation
1690965617266128
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
25627
x-amz-checksum-crc32c
CIvg6w==
accept-ranges
bytes
x-cache-hits
8, 79300
tdr-sidenav-grain.png
redcanary.com/wp-content/themes/redcanary/assets/img/
84 KB
84 KB
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/tdr-sidenav-grain.png
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
747e9ca7a5f5157e1555dca2f78d780db6a1bef9dc270dcd7a73f571f1391d2b
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:42 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 15:41:32 GMT
server
nginx
etag
"64187eac-14f3f"
vary
Accept-Encoding
x-wpe-request-id
2a81c5156add74bb69b2d5390dcd8f45
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
85823
tdr-search-icon.svg
redcanary.com/wp-content/themes/redcanary/assets/img/
773 B
764 B
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/tdr-search-icon.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
7bb26544c7c0d00e118860dc125c1bc943201bca5cf780804370732b39210d38
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:42 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 15:41:32 GMT
server
nginx
etag
W/"64187eac-305"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
ce15f18eb539be1d5af6d6749ccd71be
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
tdr-hero-canaries.png
redcanary.com/wp-content/themes/redcanary/assets/img/
10 KB
10 KB
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/tdr-hero-canaries.png
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
7481436346ad777435fe494e87a3d7fa9dc1251ab9a024d5305a90fcc0b44f8c
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:42 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 15:41:31 GMT
server
nginx
etag
"64187eab-27ad"
vary
Accept-Encoding
x-wpe-request-id
4b0375b88565d8bb4fb5b866648a520a
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
10157
topic-hero.jpg
redcanary.com/wp-content/themes/redcanary/assets/img/
244 KB
245 KB
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/topic-hero.jpg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
36975a27509bf92a53016181456a48ff34220ab524329a013bd2fa486ab19048
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:42 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Wed, 27 Feb 2019 15:51:15 GMT
server
nginx
etag
"5c76b1f3-3d141"
vary
Accept-Encoding
x-wpe-request-id
ee68cac80350e1cd262878f46ac771ac
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
250177
graphic-soundwave.svg
redcanary.com/wp-content/themes/redcanary/assets/img/
3 KB
836 B
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/graphic-soundwave.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
1d3d9de6db687e8b9bf3aa08f565dc2db8743147acce6904bf762b7ff56dbf09
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:42 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 15:41:29 GMT
server
nginx
etag
W/"64187ea9-abb"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
2676856f6016db16bceef32291d78133
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
icon-spotify.svg
redcanary.com/wp-content/themes/redcanary/assets/img/
2 KB
1 KB
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/icon-spotify.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
5a67c844a08bb049379474c28891b836a26d673555f882dd5717beeabf42200f
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:42 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 15:41:30 GMT
server
nginx
etag
W/"64187eaa-653"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
ddb4a8e6ab242b836be3f3b7dd6c7244
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
tdr-hero-dots.png
redcanary.com/wp-content/themes/redcanary/assets/img/
11 KB
11 KB
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/tdr-hero-dots.png
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
af40bad1e1b6415c6d7dfa127a6e8bf4c64111adfca9e4f4c43ade9c39dc9592
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:42 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 15:41:31 GMT
server
nginx
etag
"64187eab-2b89"
vary
Accept-Encoding
x-wpe-request-id
66b393e30208e0de7a5458917bd88a62
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
11145
TDR-Header03-1200w.jpeg
redcanary.com/wp-content/themes/redcanary/assets/img/
331 KB
332 KB
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/TDR-Header03-1200w.jpeg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
f8e765848384e530beac002fc4656b7d54b12ef24564025933981afe76e2ca43
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:42 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Tue, 21 Mar 2023 18:01:24 GMT
server
nginx
etag
"6419f0f4-52bf0"
vary
Accept-Encoding
x-wpe-request-id
6fe5b294e1f8d0be251dba8303580760
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
338928
search-btn.svg
redcanary.com/wp-content/themes/redcanary/assets/img/
161 B
473 B
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/search-btn.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
0f57969cdf0d61b86fc25ded8a8c5058a5edd346d1845b232610a54f08d0fcb8
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:42 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Wed, 08 Sep 2021 23:08:04 GMT
server
nginx
etag
W/"61394254-a1"
vary
Accept-Encoding, Accept-Encoding
x-wpe-request-id
d1fb8570a21d181e752d797b82412a56
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
/
www.facebook.com/tr/
0
185 B
Image
General
Full URL
https://www.facebook.com/tr/?id=1042590016249604&ev=PageView&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&rl=&if=false&ts=1693508322778&sw=1600&sh=1200&v=2.9.125&r=stable&ec=0&o=30&fbp=fb.1.1693508322777.1172826766&it=1693508322191&coo=false&rqm=GET
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Thu, 31 Aug 2023 18:58:42 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame 5944
13 B
172 B
Fetch
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash
debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://open.spotify.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
content-type
application/json

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 31 Aug 2023 18:58:42 GMT
via
HTTP/2 edgeproxy, 1.1 google
server
envoy
content-type
application/json
access-control-allow-origin
https://open.spotify.com
cache-control
private, max-age=0
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
39
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame 5944
13 B
103 B
Fetch
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash
debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://open.spotify.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
content-type
application/json

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 31 Aug 2023 18:58:42 GMT
via
HTTP/2 edgeproxy, 1.1 google
server
envoy
content-type
application/json
access-control-allow-origin
https://open.spotify.com
cache-control
private, max-age=0
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
39
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame
0
0
Preflight
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://open.spotify.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Origin,Content-Type,Spotify-App-Version,App-Platform,X-Spotify-Connection-Id,X-Client-Id,X-Spotify-Quicksilver-Uri,client-token,content-access-token,x-cloud-trace-context
access-control-allow-methods
DELETE,GET,PATCH,POST,PUT,OPTIONS
access-control-allow-origin
https://open.spotify.com
access-control-max-age
604800
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Thu, 31 Aug 2023 18:58:42 GMT
server
envoy
vary
Accept-Encoding
via
HTTP/2 edgeproxy, 1.1 google
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame
0
0
Preflight
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://open.spotify.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Origin,Content-Type,Spotify-App-Version,App-Platform,X-Spotify-Connection-Id,X-Client-Id,X-Spotify-Quicksilver-Uri,client-token,content-access-token,x-cloud-trace-context
access-control-allow-methods
DELETE,GET,PATCH,POST,PUT,OPTIONS
access-control-allow-origin
https://open.spotify.com
access-control-max-age
604800
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Thu, 31 Aug 2023 18:58:42 GMT
server
envoy
vary
Accept-Encoding
via
HTTP/2 edgeproxy, 1.1 google
redcanary.com.json
script.crazyegg.com/pages/data-scripts/0096/9416/sampling/
158 B
261 B
XHR
General
Full URL
https://script.crazyegg.com/pages/data-scripts/0096/9416/sampling/redcanary.com.json?t=470418
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/b2625509b46b716ab8df67870a7d87b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5408d95db01e0b235e7f251650932b36f5abfe4f40e8111b74c437826480b8fb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:42 GMT
content-encoding
gzip
cf-cache-status
HIT
age
10545
ce-version
11.5.121
content-length
145
last-modified
Thu, 31 Aug 2023 16:02:57 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff781aa8af05c98-FRA
ipv
cdn.bizible.com/m/
43 B
203 B
Image
General
Full URL
https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=3c9b8451c64c4ce3855f143bd8c65409&_biz_s=90f3e9&_biz_l=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&_biz_t=1693508321528&_biz_i=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&_biz_n=0&a=redcanary.com&rnd=987511&cdn_o=a&_biz_z=1693508322959
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6760) /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:58:42 GMT
last-modified
Wed, 30 Aug 2023 04:10:18 GMT
server
ECS (frb/6760)
age
139704
x-cache
HIT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type
image/gif
cache-control
no-cache, no-store
accept-ranges
bytes
content-length
43
expires
-1
u
cdn.bizibly.com/
43 B
328 B
Image
General
Full URL
https://cdn.bizibly.com/u?_biz_u=3c9b8451c64c4ce3855f143bd8c65409&_biz_s=90f3e9&_biz_l=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&_biz_t=1693508322976&_biz_i=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&a=redcanary.com&rnd=700722&cdn_o=a&_biz_z=1693508322976
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67E0) /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:58:42 GMT
last-modified
Wed, 30 Aug 2023 04:10:19 GMT
server
ECS (frb/67E0)
age
139703
x-cache
HIT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type
image/gif
cache-control
no-cache, no-store
accept-ranges
bytes
content-length
43
expires
-1
f3744a5e-342b-429c-9d2c-2c1b7b45310a.js
j.6sc.co/j/
4 KB
4 KB
Script
General
Full URL
https://j.6sc.co/j/f3744a5e-342b-429c-9d2c-2c1b7b45310a.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.142.112 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-142-112.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
040c6c4b281ea6760e1db7e9f2063e2409f8a2434d95851d85cc535f0ff1f9b5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-amz-version-id
a5rebSMZ.Kk9yiZR85vsDTngv6hjCogp
date
Thu, 31 Aug 2023 18:58:43 GMT
x-amz-cf-pop
FRA2-C2
x-amz-server-side-encryption
AES256
x-amz-meta-content-type
application/json
content-length
3771
pragma
no-cache
last-modified
Mon, 22 May 2023 19:07:21 GMT
server
AmazonS3
etag
"9fdd9f5f306ab8eec57207f0e3c1a4e7"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
x-amz-cf-id
HLRJgvk2KGMKYquh5zU0GAM-vpwPCX2p7y4nzqKuHRAXNh0u8bYsAg==
expires
Thu, 31 Aug 2023 18:58:43 GMT
0
bat.bing.com/action/
0
288 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=56383426&tm=gtm002&Ver=2&mid=c55eb3c4-8c59-4e9c-b965-47490b2fc999&sid=67cc5e90483011eea425b7b547117454&vid=67cc95b0483011eea199ed63fa96e35e&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&p=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&r=&lt=2671&evt=pageLoad&sv=1&rn=495857
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Thu, 31 Aug 2023 18:58:42 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 305A49CFE5BC44168764AC576C67623E Ref B: FRA31EDGE0506 Ref C: 2023-08-31T18:58:43Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
TDR-Logo-Lockup-02.png
redcanary.com/wp-content/uploads/2023/03/
7 KB
8 KB
Image
General
Full URL
https://redcanary.com/wp-content/uploads/2023/03/TDR-Logo-Lockup-02.png
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
756b9a05dda5b1afa4e8c3aaa061eccf77460cbd84f4b31f511b675fc9dbacd3
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:43 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Tue, 21 Mar 2023 02:03:06 GMT
server
nginx
etag
"6419105a-1d03"
vary
Accept-Encoding
x-wpe-request-id
51b3fc00ffeb54132eaac84e4cf855f5
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
7427
birdInFlight-flipped-975x975-1.jpg
redcanary.com/wp-content/uploads/2022/03/
18 KB
18 KB
Image
General
Full URL
https://redcanary.com/wp-content/uploads/2022/03/birdInFlight-flipped-975x975-1.jpg
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
9dcafe0dd491720f7b4e7168ee159909aba669acbba23ca17e32c9a2174510b0
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:43 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 07 Mar 2022 19:56:58 GMT
server
nginx
etag
"6226638a-460b"
vary
Accept-Encoding
x-wpe-request-id
bb85af73b3e681eac06a7a410ab2abb5
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
17931
TDR-Header01-1200w.jpg
redcanary.com/wp-content/uploads/2023/03/
339 KB
340 KB
Image
General
Full URL
https://redcanary.com/wp-content/uploads/2023/03/TDR-Header01-1200w.jpg
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
6af930f857a9b1c2e3f638e4c2eeae1f5a8d28643db55d6a2f7d99c77e17489f
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:43 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 20:12:02 GMT
server
nginx
etag
"6418be12-54b50"
vary
Accept-Encoding
x-wpe-request-id
772364c9c855d6ccef286c96c353b257
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
346960
Icon_Alert-Center_Investigation.svg
redcanary.com/wp-content/uploads/2020/09/
4 KB
1 KB
Image
General
Full URL
https://redcanary.com/wp-content/uploads/2020/09/Icon_Alert-Center_Investigation.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
1576f47ba50e5433d2efe01986fa43b861bd6a4de15751c35bf606b2a9fed2c9
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:43 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Thu, 24 Sep 2020 17:12:27 GMT
server
nginx
etag
W/"5f6cd37b-e55"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
68050eb6eafb56cda4b7496177b091ea
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
84b6d68d-a2a9-4518-993a-f0ecd1ef0c36
https://redcanary.com/
45 B
0
Other
General
Full URL
blob:https://redcanary.com/84b6d68d-a2a9-4518-993a-f0ecd1ef0c36
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
86551808dbfbf8bc9b23ab3d0725794c2e1f2b4265c96715f2945638160edc2b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Length
45
Content-Type
text/javascript
xdc.js
cdn.bizible.com/
116 B
349 B
Script
General
Full URL
https://cdn.bizible.com/xdc.js?_biz_u=3c9b8451c64c4ce3855f143bd8c65409&_biz_h=-1906410348&cdn_o=a&jsVer=4.23.08.24&a=redcanary.com
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6711) /
Resource Hash
a3f3a976fd7933cb06e76dc3c48947c15ab8b7f20bdbca0dc7851fdb5a7470a1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:43 GMT
content-encoding
gzip
server
ECS (frb/6711)
etag
5987BFBE
vary
Accept-Encoding
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type
text/javascript; charset=utf-8
cache-control
private, must-revalidate, max-age=21600
content-length
219
button-right-arrow-white.svg
redcanary.com/wp-content/themes/redcanary/assets/img/
350 B
620 B
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/button-right-arrow-white.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
8edbf02936f4bbda931a228bd84f7b668522af07f3dfc33b5caee429e7febb85
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:43 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Wed, 27 Feb 2019 15:51:05 GMT
server
nginx
etag
W/"5c76b1e9-15e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
9ae7c54820cb071ad8d5b3393da2cebd
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
spotify-logo-black-8-01.svg
redcanary.com/wp-content/uploads/2021/03/
898 B
858 B
Image
General
Full URL
https://redcanary.com/wp-content/uploads/2021/03/spotify-logo-black-8-01.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
24a9979fff20ad59cba9b4a38af6fba8903c482fa2c390e2f0e82c97a649da98
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:43 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 29 Mar 2021 15:22:29 GMT
server
nginx
etag
W/"6061f0b5-382"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
5c15c8566789265cde4892fd3d6282d0
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
clock
tracking.crazyegg.com/ Frame C9B7
30 B
138 B
XHR
General
Full URL
https://tracking.crazyegg.com/clock?t=1693508323276&tk=40ea43635c9a9388c5f9f97df894a565&s=360154&p=%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&u=969416&v=4de60124dd6a1ef9cdde4520856015d4904751c2&f=redcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation&ul=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/b2625509b46b716ab8df67870a7d87b8.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.81.137.90 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-99-81-137-90.eu-west-1.compute.amazonaws.com
Software
awselb/2.0 /
Resource Hash
4c2abed80cacd245c5f3097eb93eb20d9b0b535381c4dd4cfeb0da49e2f54085

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-origin
*
date
Thu, 31 Aug 2023 18:58:43 GMT
cache-control
no-store
server
awselb/2.0
content-length
30
content-type
text/plain
/
www.facebook.com/tr/ Frame 1655
0
71 B
Document
General
Full URL
https://www.facebook.com/tr/
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://redcanary.com
Referer
https://redcanary.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://redcanary.com
alt-svc
h3=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Thu, 31 Aug 2023 18:58:43 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
u
cdn.bizible.com/m/
43 B
121 B
Image
General
Full URL
https://cdn.bizible.com/m/u?mapType=mkto&mapValue=id%3A003-YRU-314%26token%3A_mch-redcanary.com-1693508322003-29241&_biz_u=3c9b8451c64c4ce3855f143bd8c65409&_biz_s=90f3e9&_biz_l=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&_biz_t=1693508322976&_biz_i=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&_biz_n=1&a=redcanary.com&rnd=775341&cdn_o=a&_biz_z=1693508323316
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6776) /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:58:43 GMT
last-modified
Wed, 30 Aug 2023 04:10:23 GMT
server
ECS (frb/6776)
age
139700
x-cache
HIT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type
image/gif
cache-control
no-cache, no-store
accept-ranges
bytes
content-length
43
expires
-1
d9b6b28e3d84db3e4c966a5cf73af402.js
script.crazyegg.com/pages/versioned/trackingpagestate-scripts/
20 KB
8 KB
Script
General
Full URL
https://script.crazyegg.com/pages/versioned/trackingpagestate-scripts/d9b6b28e3d84db3e4c966a5cf73af402.js
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0096/9416.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
86f2855487ee0f2a026de07b800d0a191f2d66723011cf5e7bddea4669037b33

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:43 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 28 Aug 2023 18:41:50 GMT
server
cloudflare
age
20531
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000, s-maxage=31536000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff781add875373e-FRA
content-length
8025
db7431f2-cfd2-4cf1-a800-6acff8acdcd7
https://redcanary.com/
241 B
0
Other
General
Full URL
blob:https://redcanary.com/db7431f2-cfd2-4cf1-a800-6acff8acdcd7
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1cbfcbb81af382110b9d1911b035a8d19b3ca175272555884721d64fb72221c1

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Length
241
Content-Type
text/javascript
661bb7e9d0e0abee5d7403d3d65553a1.js
script.crazyegg.com/pages/versioned/tracking-scripts/
98 KB
32 KB
Script
General
Full URL
https://script.crazyegg.com/pages/versioned/tracking-scripts/661bb7e9d0e0abee5d7403d3d65553a1.js
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0096/9416.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2182476b2f19b36cc23e9bbdb2dd97b84f4d6eddabc117e374b893fe3cd8cdc5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:43 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 28 Aug 2023 18:41:48 GMT
server
cloudflare
age
20533
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000, s-maxage=31536000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff781ae08c4373e-FRA
content-length
32149
messenger
app.qualified.com/w/1/bAEbi2aHVysBKzuy/ Frame 5FAC
6 KB
3 KB
Document
General
Full URL
https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=3b4a38d1-dbb1-4b31-8263-29484df5432e
Requested by
Host: js.qualified.com
URL: https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
52.204.253.158 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-204-253-158.compute-1.amazonaws.com
Software
/
Resource Hash
23beb1299c9ce3903083b644ea6776549b79dbaf32de324eb394fc3517a84d02
Security Headers
Name Value
Content-Security-Policy
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://redcanary.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
max-age=0, private, must-revalidate
Content-Encoding
gzip
Content-Length
1829
Content-Security-Policy
Content-Type
text/html; charset=utf-8
Date
Thu, 31 Aug 2023 18:58:43 GMT
Etag
W/"23beb1299c9ce3903083b644ea677654"
Link
<https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css>; rel=preload; as=style; nopush,<https://assets.qualified.com/packs/css/widget/sandboxed/messenger-84a66aeb.chunk.css>; rel=preload; as=style; nopush
Referrer-Policy
strict-origin-when-cross-origin
Strict-Transport-Security
max-age=63072000; includeSubDomains
Vary
Accept-Encoding
Via
1.1 spaces-router (devel)
X-Content-Type-Options
nosniff
X-Download-Options
noopen
X-Permitted-Cross-Domain-Policies
none
X-Request-Id
837771a1-5518-cff1-6907-ab163775a976
X-Runtime
0.030169
X-Xss-Protection
1; mode=block
6si.min.js
j.6sc.co/
51 KB
15 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/j/f3744a5e-342b-429c-9d2c-2c1b7b45310a.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.142.112 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-142-112.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
3ac0c589d242920586289eabdd93bf71f3d85bb1c6c8333d3e2deb4e173b61a4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:58:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 24 Aug 2023 22:29:49 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"64e7d9dd-cc38"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
14993
expires
Thu, 31 Aug 2023 18:58:43 GMT
/
c.6sc.co/
7 B
192 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.142.112 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-142-112.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:43 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://redcanary.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/
24 B
315 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:2c::216:f230 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f0871092f9e672c52b6f12d73598a0c04b99bfb0b62dd1a8848ff49d524b8e48

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:58:43 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://redcanary.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2001:1b60:2:240:3247::12
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1693508323727_35058220_11770207_20_795_22_48_219";dur=1
content-length
24
expires
Thu, 31 Aug 2023 18:58:43 GMT
messenger-94e6eccc.chunk.css
assets.qualified.com/packs/css/vendors~widget/sandboxed/ Frame 5FAC
35 KB
7 KB
Stylesheet
General
Full URL
https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb3487cae40a55bf31dc6e6191ab0d88ec8c8f85c62bf28ad25ad0a40c16a611

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:44 GMT
x-amz-version-id
E6HYLeBtJT9W_tVmGW0Eqr.OlxotuqBf
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
TWWJG8YEJHXPZZ7S
age
1337
x-amz-server-side-encryption
AES256
x-amz-id-2
pmVx2lEmrfr+SZw1PNz6Gk7wk5PDZjVY2mXjV0nP+pusJpO0y0ybkjWYmA8SfR0+0AgzD5IZe2g=
last-modified
Sat, 01 Jul 2023 05:07:35 GMT
server
cloudflare
etag
W/"a788ecf510f83ee517cbaf79306145dd"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
cf-ray
7ff781b16c989176-FRA
expires
Thu, 31 Aug 2023 22:58:44 GMT
messenger-84a66aeb.chunk.css
assets.qualified.com/packs/css/widget/sandboxed/ Frame 5FAC
5 KB
1 KB
Stylesheet
General
Full URL
https://assets.qualified.com/packs/css/widget/sandboxed/messenger-84a66aeb.chunk.css
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6ec35ab99388f6afab345622a22772619b83b7d63705d98df3c404da782fcabb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:44 GMT
x-amz-version-id
fpwfPR87MrNeDeRB8HK3_YqThtrHvu_x
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 14 Feb 2023 21:15:43 GMT
server
cloudflare
x-amz-request-id
SX9SQCNRBPP25R4V
age
6117
etag
W/"22d5f23e695250d3c5a5b1e76a015c5e"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
cf-ray
7ff781b16c969176-FRA
x-amz-id-2
DVSxJtm5loz+Fow4Nc3A3gBN6tgjZvi30UrOE7IOnl+182SmT4Whb0D915mYTINkiGCjZrRqAVU=
expires
Thu, 31 Aug 2023 22:58:44 GMT
messenger~runtime-f4ac063cf9338bc709b8.js
assets.qualified.com/packs/js/widget/sandboxed/ Frame 5FAC
2 KB
2 KB
Script
General
Full URL
https://assets.qualified.com/packs/js/widget/sandboxed/messenger~runtime-f4ac063cf9338bc709b8.js
Requested by
Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=3b4a38d1-dbb1-4b31-8263-29484df5432e
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
977858a0c518ab885051998c26954247bcc67d50bd26c4438d3022aec559c5c8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:44 GMT
x-amz-version-id
PdfsJsTwxZSJ8tn07cjcyE.BvIAlLvhP
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
HN0VCG6PXDZ3P0XA
age
6603
x-amz-server-side-encryption
AES256
x-amz-id-2
z3ycbKCLZGPULp5MFVOniQIzz/mG09/69JgjZCxIhm7yfGfVueZ68+oII83RbHR4kWV/1VacuhoKajDnkHoDBHU+E5hmHlTlVTfu9fOJNj8=
last-modified
Thu, 31 Aug 2023 01:01:43 GMT
server
cloudflare
etag
W/"211c830511b7e3f0f42259032f070166"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=14400
cf-ray
7ff781b17cab9176-FRA
expires
Thu, 31 Aug 2023 22:58:44 GMT
messenger-369223c5490f8cdcf187.chunk.js
assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/ Frame 5FAC
1 MB
362 KB
Script
General
Full URL
https://assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/messenger-369223c5490f8cdcf187.chunk.js
Requested by
Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=3b4a38d1-dbb1-4b31-8263-29484df5432e
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
15e5827ebf3a8660ccf687d7f208b247f355421bfeeaa572f26913a453acf45e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:44 GMT
x-amz-version-id
oK9jovqhn.gYLI4zbnGqtErXgbUHzdXb
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
5WVV8NB3N3HA5WGG
age
203
x-amz-server-side-encryption
AES256
x-amz-id-2
janlbonQ1EG1+ZqENoYbQWCmsIzGg+CRwtbiWAjoLUa38NLQf43bTFEDMa0CoL6Yp4DoBM7CQadqokx5yTA85yPPKjL7xvRUzDmQnq+zDE8=
last-modified
Mon, 28 Aug 2023 20:31:37 GMT
server
cloudflare
etag
W/"07365b735e31be744e837d71d12cb7ad"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=14400
cf-ray
7ff781b17cae9176-FRA
expires
Thu, 31 Aug 2023 22:58:44 GMT
messenger-4dcf43b9b54c3f5764c6.chunk.js
assets.qualified.com/packs/js/widget-sandboxed-chunks/widget/sandboxed/ Frame 5FAC
622 KB
162 KB
Script
General
Full URL
https://assets.qualified.com/packs/js/widget-sandboxed-chunks/widget/sandboxed/messenger-4dcf43b9b54c3f5764c6.chunk.js
Requested by
Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=3b4a38d1-dbb1-4b31-8263-29484df5432e
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
263e16f176fddc5af313fa27a6173538c61b5f28db6a4360e9ae9f81504907b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:44 GMT
x-amz-version-id
TbFSaWaZouDNzEPRloXQJWsSi3g5kbCP
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
HN0NY0WCTXX5VE81
age
6603
x-amz-server-side-encryption
AES256
x-amz-id-2
MiQsPrjBYoH13Di+C//dkHARlTVZiHW9ICod+B1P1LwN+P6/leR2yhE55brTmqj7nTl4tCn1Ulpn6jEfSreAEg==
last-modified
Thu, 31 Aug 2023 01:01:44 GMT
server
cloudflare
etag
W/"94ddddc8eac8fb41be3179fa9a2943df"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=14400
cf-ray
7ff781b19d079176-FRA
expires
Thu, 31 Aug 2023 22:58:44 GMT
Inter-Regular-c8ba52b05a9ef10f47584d08ece2ec5c.woff2
assets.qualified.com/packs/media/fonts/inter/ Frame 5FAC
97 KB
97 KB
Font
General
Full URL
https://assets.qualified.com/packs/media/fonts/inter/Inter-Regular-c8ba52b05a9ef10f47584d08ece2ec5c.woff2
Requested by
Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=3b4a38d1-dbb1-4b31-8263-29484df5432e
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d612f1212b452af07f1a5defb2b672e76a91f7139e7499fa48bb9b2b985c22d6

Request headers

Referer
https://app.qualified.com/
Origin
https://app.qualified.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:44 GMT
x-amz-version-id
Ts0p7fbKsZIFu_VEk6HOvm9iYpTRKuos
cf-cache-status
HIT
x-amz-request-id
A014AXCH5HAYN619
age
22958142
content-length
98868
x-amz-id-2
IJ/hVgCs33ecZmS06+Ka+dHvpugbE2eU1ZCcp0I9amPp9Dk45jvq9GOwp+V0XScoH+qD8bPUljc=
last-modified
Thu, 08 Dec 2022 23:17:25 GMT
server
cloudflare
etag
"dc131113894217b5031000575d9de002"
access-control-max-age
3600
access-control-allow-methods
GET
content-type
font/woff2
access-control-allow-origin
*
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cache-control
public, max-age=31557600
accept-ranges
bytes
cf-ray
7ff781b1bfa29b9e-FRA
expires
Sat, 31 Aug 2024 00:58:44 GMT
Inter-SemiBold-b5f0f109bc88052d4000c58ca615671d.woff2
assets.qualified.com/packs/media/fonts/inter/ Frame 5FAC
103 KB
104 KB
Font
General
Full URL
https://assets.qualified.com/packs/media/fonts/inter/Inter-SemiBold-b5f0f109bc88052d4000c58ca615671d.woff2
Requested by
Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=3b4a38d1-dbb1-4b31-8263-29484df5432e
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
152261291c938aa5aad6a56d52b47ffcb893d1c0387e76d7f270a7382ff786d5

Request headers

Referer
https://app.qualified.com/
Origin
https://app.qualified.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:44 GMT
x-amz-version-id
ePBeoMCujYBxKBCWHO9COs36tHcpJSw9
cf-cache-status
HIT
x-amz-request-id
A01B2QDFTMXZH5PS
age
22958142
content-length
105804
x-amz-id-2
QrEATIdRG82StQ9vuCskL/XEsQIIMY+OzO15MGNTQIYZKmPGvaIhnxUF1uCukz9/QAqZn2UpPyU=
last-modified
Thu, 08 Dec 2022 23:17:25 GMT
server
cloudflare
etag
"007ad31a53f4ab3f58ee74f2308482ce"
access-control-max-age
3600
access-control-allow-methods
GET
content-type
font/woff2
access-control-allow-origin
*
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cache-control
public, max-age=31557600
accept-ranges
bytes
cf-ray
7ff781b1bfa39b9e-FRA
expires
Sat, 31 Aug 2024 00:58:44 GMT
/
sentry.io/api/1332833/envelope/ Frame 5FAC
2 B
325 B
Fetch
General
Full URL
https://sentry.io/api/1332833/envelope/?sentry_key=b5158ee3382d49b28a864fb2b91bcaaf&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.11.1
Requested by
Host: assets.qualified.com
URL: https://assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/messenger-369223c5490f8cdcf187.chunk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.247.156 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
156.247.186.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.qualified.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Thu, 31 Aug 2023 18:58:44 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 google
server
nginx
vary
origin,access-control-request-method,access-control-request-headers
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
x-sentry-error,x-sentry-rate-limits,retry-after
x-envoy-upstream-service-time
0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
getuidj
secure.adnxs.com/
29 B
705 B
XHR
General
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
d96a336dfd4e90adb7f50bdd1d325b536459b90d1a27427bb31d977971da7899
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:58:44 GMT
an-x-request-uuid
e47adc80-826b-4fe3-81d2-dcaa03895f9b
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
application/json; charset=utf-8
access-control-allow-origin
https://redcanary.com
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
x-proxy-origin
217.114.218.27; 217.114.218.27; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length
29
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
/
c.6sc.co/
7 B
192 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.142.112 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-142-112.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:44 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://redcanary.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/
24 B
315 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:2c::216:f230 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f0871092f9e672c52b6f12d73598a0c04b99bfb0b62dd1a8848ff49d524b8e48

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:58:44 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://redcanary.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2001:1b60:2:240:3247::12
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1693508324388_35058220_11771133_18_1011_21_0_219";dur=1
content-length
24
expires
Thu, 31 Aug 2023 18:58:44 GMT
optimize.js
www.google-analytics.com/gtm/
124 KB
48 KB
Script
General
Full URL
https://www.google-analytics.com/gtm/optimize.js?id=GTM-KJTKFT3
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
7d16d5b86d8a772e8039843458e2a6d91ab2ec51a9cc01f64d934e0bd4ab4327
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:44 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
49068
x-xss-protection
0
last-modified
Thu, 31 Aug 2023 18:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 31 Aug 2023 18:58:44 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=4b6d5ac9-ace1-44d2-8ffd-8552f0b993d2&session=baedd7cc-7658-4238-8f92-f13f14e1d095&event=ipv6&q=%7B%22address%22%3A%222001%3A1b60%3A2%3A240%3A3247%3A%3A12%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=46ab3987-f34f-4ada-831f-e543dabd397d&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.142.112 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-142-112.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:44 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"5e502810-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=4b6d5ac9-ace1-44d2-8ffd-8552f0b993d2&session=baedd7cc-7658-4238-8f92-f13f14e1d095&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A58%3A41%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2031%20Aug%202023%2018%3A58%3A41%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22565ffb1efc5e75f417d1fe1c2134f835%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2031%20Aug%202023%2018%3A58%3A41%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2031%20Aug%202023%2018%3A58%3A41%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=46ab3987-f34f-4ada-831f-e543dabd397d&an_uid=2845935910886929701&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.142.112 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-142-112.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:44 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
details
epsilon.6sense.com/v3/company/ Frame
0
0
Preflight
General
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.158.23.65 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-158-23-65.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,x-6s-customid
Access-Control-Request-Method
GET
Origin
https://redcanary.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
authorization,x-6s-customid
access-control-allow-methods
OPTIONS,GET
access-control-allow-origin
https://redcanary.com
access-control-max-age
1800
date
Thu, 31 Aug 2023 18:58:44 GMT
server
nginx
details
epsilon.6sense.com/v3/company/
770 B
593 B
XHR
General
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.158.23.65 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-158-23-65.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
8f747cdb56a6ab39c12ede219686c746531c30fecf37506b9d941baac2ea08c5

Request headers

Referer
https://redcanary.com/
accept-language
de-DE,de;q=0.9
Authorization
Token e8bebcdaa132f727ae8d16d9967447769318945e
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
X-6s-CustomID
WebTag f3744a5e-342b-429c-9d2c-2c1b7b45310a

Response headers

date
Thu, 31 Aug 2023 18:58:44 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://redcanary.com
access-control-allow-credentials
true
content-length
409
analytics.js
www.google-analytics.com/
52 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 31 Aug 2023 17:49:43 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
4141
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Thu, 31 Aug 2023 19:49:43 GMT
collect
www.google-analytics.com/j/
4 B
24 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=137598725&t=pageview&_s=1&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&ul=en-us&de=UTF-8&dt=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABQAAAACAAI~&jid=769579419&gjid=2052282535&cid=649153911.1693508322&tid=UA-52702906-1&_gid=102489558.1693508325&_r=1&_slc=1&gtm=45He38u0n81PXWC8JW&cd18=null&z=888058635
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://redcanary.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:58:44 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://redcanary.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/
4 B
152 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-52702906-1&cid=649153911.1693508322&jid=769579419&gjid=2052282535&_gid=102489558.1693508325&_u=YADAAEAAQAAAACAAI~&z=1551566103
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://redcanary.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Thu, 31 Aug 2023 18:58:44 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://redcanary.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
108 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-52702906-1&cid=649153911.1693508322&jid=769579419&_u=YADAAEAAQAAAACAAI~&z=652540929
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:58:44 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
63 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-52702906-1&cid=649153911.1693508322&jid=769579419&_u=YADAAEAAQAAAACAAI~&z=652540929
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:58:44 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j101&a=137598725&t=event&ni=1&_s=1&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&ul=en-us&de=UTF-8&dt=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=aADAAEABQAAAACAAI~&jid=&gjid=&cid=649153911.1693508322&tid=UA-52702906-1&_gid=102489558.1693508325&gtm=45He38u0n81PXWC8JW&cd4=&cd5=&cd10=&cd11=&cd20=&z=1451827956
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 01:27:50 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
63054
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=4b6d5ac9-ace1-44d2-8ffd-8552f0b993d2&session=baedd7cc-7658-4238-8f92-f13f14e1d095&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A58%3A45%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A58%3A41%20GMT%22%2C%22timeSpent%22%3A%223692%22%2C%22totalTimeSpent%22%3A%223692%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=46ab3987-f34f-4ada-831f-e543dabd397d&an_uid=2845935910886929701&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.142.112 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-142-112.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:45 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
d23c0c4e194430380ef64982f7fd6ecf318cd5881017bc61dec0ef8955cc0079.png
qualified-production.s3.us-east-1.amazonaws.com/uploads/ Frame 5FAC
13 KB
13 KB
Image
General
Full URL
https://qualified-production.s3.us-east-1.amazonaws.com/uploads/d23c0c4e194430380ef64982f7fd6ecf318cd5881017bc61dec0ef8955cc0079.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.144.158 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-us-east-1-r-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
9a586f0b3e8add35ad17a2eec2cee97cbe175f48d7c47e34492dd973aa0f8381

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:58:47 GMT
Last-Modified
Thu, 20 Oct 2022 23:47:27 GMT
Server
AmazonS3
x-amz-request-id
AN9N5PRJDKF2H0JD
ETag
"fd481ec600c1b3fad6f9e29aa732a946"
x-amz-server-side-encryption
AES256
Content-Type
image/png
Cache-Control
Cache-Control: public, max-age=31536000
Accept-Ranges
bytes
Content-Length
12932
x-amz-id-2
yeUb4+S3G1ZZh4in4M0TZDBZbpzMvXR13zAdqQlkS+4un0X5v0PTkuaJ1TbRFqlb4wsFxMejO4Y=
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame 5944
13 B
58 B
XHR
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash
debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://open.spotify.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
content-type
application/json

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 31 Aug 2023 18:58:46 GMT
via
HTTP/2 edgeproxy, 1.1 google
server
envoy
content-type
application/json
access-control-allow-origin
https://open.spotify.com
cache-control
private, max-age=0
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
39
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame 5944
13 B
58 B
XHR
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash
debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://open.spotify.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
content-type
application/json

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 31 Aug 2023 18:58:45 GMT
via
HTTP/2 edgeproxy, 1.1 google
server
envoy
content-type
application/json
access-control-allow-origin
https://open.spotify.com
cache-control
private, max-age=0
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
39
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame
0
0
Preflight
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://open.spotify.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Origin,Content-Type,Spotify-App-Version,App-Platform,X-Spotify-Connection-Id,X-Client-Id,X-Spotify-Quicksilver-Uri,client-token,content-access-token,x-cloud-trace-context
access-control-allow-methods
DELETE,GET,PATCH,POST,PUT,OPTIONS
access-control-allow-origin
https://open.spotify.com
access-control-max-age
604800
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Thu, 31 Aug 2023 18:58:45 GMT
server
envoy
vary
Accept-Encoding
via
HTTP/2 edgeproxy, 1.1 google
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame
0
0
Preflight
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://open.spotify.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Origin,Content-Type,Spotify-App-Version,App-Platform,X-Spotify-Connection-Id,X-Client-Id,X-Spotify-Quicksilver-Uri,client-token,content-access-token,x-cloud-trace-context
access-control-allow-methods
DELETE,GET,PATCH,POST,PUT,OPTIONS
access-control-allow-origin
https://open.spotify.com
access-control-max-age
604800
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Thu, 31 Aug 2023 18:58:46 GMT
server
envoy
vary
Accept-Encoding
via
HTTP/2 edgeproxy, 1.1 google
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=4b6d5ac9-ace1-44d2-8ffd-8552f0b993d2&session=baedd7cc-7658-4238-8f92-f13f14e1d095&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A58%3A46%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A58%3A45%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224693%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=46ab3987-f34f-4ada-831f-e543dabd397d&an_uid=2845935910886929701&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.142.112 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-142-112.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:46 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
b34302d7d25df402909dab75f43c994eaa9697d42e982abeee77e1d6cb8e2697.png
qualified-production.s3.us-east-1.amazonaws.com/uploads/ Frame 5FAC
13 KB
13 KB
Image
General
Full URL
https://qualified-production.s3.us-east-1.amazonaws.com/uploads/b34302d7d25df402909dab75f43c994eaa9697d42e982abeee77e1d6cb8e2697.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.144.158 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-us-east-1-r-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
00bbc66153e493c73e6ee4448a25fac555d74e1fd957f6f804754ff27bb9884f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:58:47 GMT
Last-Modified
Thu, 20 Oct 2022 23:48:08 GMT
Server
AmazonS3
x-amz-request-id
AN9JEQ12YEF66GZS
ETag
"7797b96a7f999ac42de528bede3329af"
x-amz-server-side-encryption
AES256
Content-Type
image/png
Cache-Control
Cache-Control: public, max-age=31536000
Accept-Ranges
bytes
Content-Length
13099
x-amz-id-2
Z8kwSDr6D0/C64sssb1gPbGaLuZID2c1XU9CvcFayw6FiFZH+K25g0XGyUgeesVVAA8YsP5duWw=
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=4b6d5ac9-ace1-44d2-8ffd-8552f0b993d2&session=baedd7cc-7658-4238-8f92-f13f14e1d095&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A58%3A47%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A58%3A46%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%225693%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=46ab3987-f34f-4ada-831f-e543dabd397d&an_uid=2845935910886929701&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.142.112 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-142-112.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:47 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=4b6d5ac9-ace1-44d2-8ffd-8552f0b993d2&session=baedd7cc-7658-4238-8f92-f13f14e1d095&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A58%3A48%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A58%3A47%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226694%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=46ab3987-f34f-4ada-831f-e543dabd397d&an_uid=2845935910886929701&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.142.112 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-142-112.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:48 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=4b6d5ac9-ace1-44d2-8ffd-8552f0b993d2&session=baedd7cc-7658-4238-8f92-f13f14e1d095&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A58%3A49%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A58%3A48%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%227695%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=46ab3987-f34f-4ada-831f-e543dabd397d&an_uid=2845935910886929701&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.142.112 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-142-112.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:58:49 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
b.6sc.co
URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=4b6d5ac9-ace1-44d2-8ffd-8552f0b993d2&session=baedd7cc-7658-4238-8f92-f13f14e1d095&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A58%3A50%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A58%3A49%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%228696%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=46ab3987-f34f-4ada-831f-e543dabd397d&an_uid=2845935910886929701&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6

Verdicts & Comments Add Verdict or Comment

99 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| documentPictureInPicture function| $ function| jQuery object| Cli_Data object| cli_cookiebar_settings object| log_object object| MktoForms2 object| dataLayer object| _6si function| gtag string| QualifiedObject function| qualified object| Bizible object| BizTrackingA object| BizA object| hljs object| theme_ajax_object object| lazyLoadOptions boolean| CE_USER_SCRIPT object| CE2 string| CE_USER_SITE_DATA_URL string| CE_USER_DATA_URL function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| google_tag_manager function| postscribe object| google_tag_manager_external object| google_tag_data function| twq string| _linkedin_data_partner_id function| rdt object| GooglebQhCsO function| fbq function| _fbq function| getParam function| getExpiryRecord function| addGclid string| CE_USER_COMMON_SCRIPT_URL string| CE_USER_THIRDPARTY_SCRIPT_URL function| onYouTubeIframeAPIReady object| gaGlobal object| MunchkinTracker object| webpackChunkCE2 object| CE2BH function| CE_URL_FINGERPRINT object| regeneratorRuntime object| twttr function| UET function| UET_init function| UET_push object| configArgs number| pixelRatio number| width number| height object| screenSize object| labels object| CE_API object| ueto_fcabfad950 object| uetq boolean| _q_widgetInitialized function| lintrk boolean| _already_called_lintrk object| FormsPlus undefined| Cookies undefined| URI object| CLI_Cookie object| CLI object| cliBlocker string| CLI_ACCEPT_COOKIE_NAME string| CLI_PREFERNCE_COOKIE number| CLI_ACCEPT_COOKIE_EXPIRE boolean| CLI_COOKIEBAR_AS_POPUP object| webpackChunknylon function| LazyLoad object| images boolean| is_image object| iframes boolean| is_iframe object| rocket_lazy object| _vis_opt_queue object| LC_API string| _q_lastClientActivityAt string| currentText string| categoryCookie object| categoryCookieValue object| cli_chkbox_elm string| cli_chkbox_data_id string| cli_chkbox_data_id_trimmed string| GoogleAnalyticsObject function| ga boolean| _storagePopulated object| google_optimize object| gaplugins object| gaData

45 Cookies

Domain/Path Name / Value
.resource.redcanary.com/ Name: __cf_bm
Value: ji6u5q.5QEzHpNCIbZd0Bpyc4fgILEt9IAG5uhsk2WY-1693508321-0-AahHSAxbqRA6eHWigtpKHlZ9MBNLNETVRuxPT7MsrUz1zIJIIzmOl+1NwF5X8vVqdJkbSrg7JqhNS4K88w8WaCU=
.redcanary.com/ Name: _biz_uid
Value: 3c9b8451c64c4ce3855f143bd8c65409
.redcanary.com/ Name: _biz_sid
Value: 90f3e9
.spotify.com/ Name: sp_t
Value: 5889cebcf20b3185fde8801b33b915cd
.spotify.com/ Name: sp_landing
Value: https%3A%2F%2Fredcanary.com%2F%3Fsp_cid%3D5889cebcf20b3185fde8801b33b915cd%26device%3Ddesktop
.redcanary.com/ Name: _gcl_au
Value: 1.1.216149889.1693508322
.redcanary.com/ Name: _ga_T3K4MTNQJN
Value: GS1.1.1693508321.1.0.1693508321.60.0.0
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
.redcanary.com/ Name: _mkto_trk
Value: id:003-YRU-314&token:_mch-redcanary.com-1693508322003-29241
.redcanary.com/ Name: _rdt_uuid
Value: 1693508322198.b9c064d4-2a9f-4315-9d61-8bb0888deadd
.t.co/ Name: muc_ads
Value: c66e1147-f86f-4eea-bc5e-f750355ac809
.twitter.com/ Name: personalization_id
Value: "v1_u5m8v6OtTHsIeX0RDMnDNg=="
.adnxs.com/ Name: uuid2
Value: 2845935910886929701
redcanary.com/ Name: ln_or
Value: eyIxNTQwNzUzIjoiZCJ9
.linkedin.com/ Name: li_sugr
Value: 57ca792c-10a9-46b1-b2d5-23d6ec0e772c
.linkedin.com/ Name: bcookie
Value: "v=2&bc86cca9-9967-41cd-8818-07aca8ef9cea"
.linkedin.com/ Name: lidc
Value: "b=TGST04:s=T:r=T:a=T:p=T:g=3003:u=1:x=1:i=1693508322:t=1693594722:v=2:sig=AQGqxvOXmAKImIgGTggyJS90SVjtDHBN"
.redcanary.com/ Name: _fbp
Value: fb.1.1693508322777.1172826766
.redcanary.com/ Name: _biz_nA
Value: 2
.linkedin.com/ Name: UserMatchHistory
Value: AQI8Sc1zuSbjSgAAAYpM9kZOIgK52n48lRy_XbD4oJBZOQNWDXNePu3i9Iyv8bx8CebE2SeA26vgTQ
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQJkt1dGPJYdBgAAAYpM9kZOf6d6wa2lr3nBUkpNXbGfDgb0XQbOpa7J-4GBNS--qODN_jmxple0hMkFan0xfw
.bizibly.com/ Name: _BUID
Value: fb34556895db2af811cf326f0672fc5b
.bizible.com/ Name: _BUID
Value: 3c9b8451c64c4ce3855f143bd8c65409
redcanary.com/ Name: cookielawinfo-checkbox-necessary
Value: yes
redcanary.com/ Name: cookielawinfo-checkbox-non-necessary
Value: yes
.redcanary.com/ Name: cebs
Value: 1
.redcanary.com/ Name: _ce.s
Value: v~4de60124dd6a1ef9cdde4520856015d4904751c2~lcw~1693508323204~vpv~0~lcw~1693508323205
.redcanary.com/ Name: _uetsid
Value: 67cc5e90483011eea425b7b547117454
.redcanary.com/ Name: _uetvid
Value: 67cc95b0483011eea199ed63fa96e35e
.bing.com/ Name: MUID
Value: 317C9F69E81665941E638C17E99D648C
.redcanary.com/ Name: _ce.clock_event
Value: 1
.redcanary.com/ Name: _biz_flagsA
Value: %7B%22Version%22%3A1%2C%22Mkto%22%3A%221%22%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%7D
.redcanary.com/ Name: _biz_pendingA
Value: %5B%5D
.www.linkedin.com/ Name: bscookie
Value: "v=1&2023083118584321ca7ef9-5b22-4d69-863e-65fda891c4c7AQFAUtDWBLJJmRTrJ8BvDz0uzPKIX7u4"
.linkedin.com/ Name: li_gc
Value: MTswOzE2OTM1MDgzMjM7MjswMjFhXEQwVgwd7crBvd2tzGYk4UOGj3sIXg0WjbrxRYFuEw==
.redcanary.com/ Name: _ce.clock_data
Value: 46%2C217.114.218.27%2C1%2C0f286e8f7fa153358c622af13d09b529
.redcanary.com/ Name: cebsp_
Value: 1
redcanary.com/ Name: _gd_visitor
Value: 4b6d5ac9-ace1-44d2-8ffd-8552f0b993d2
redcanary.com/ Name: _gd_session
Value: baedd7cc-7658-4238-8f92-f13f14e1d095
redcanary.com/ Name: _an_uid
Value: 2845935910886929701
.redcanary.com/ Name: _ga
Value: GA1.2.649153911.1693508322
.redcanary.com/ Name: _gid
Value: GA1.2.102489558.1693508325
.redcanary.com/ Name: _gat_UA-52702906-1
Value: 1
.6sc.co/ Name: 6suuid
Value: 6c8e140257700000e4e2f064ae020000b2ff0000
.redcanary.com/ Name: __q_state_bAEbi2aHVysBKzuy
Value: eyJ1dWlkIjoiM2I0YTM4ZDEtZGJiMS00YjMxLTgyNjMtMjk0ODRkZjU0MzJlIiwiY29va2llRG9tYWluIjoicmVkY2FuYXJ5LmNvbSIsIm1lc3NlbmdlckV4cGFuZGVkIjpmYWxzZSwicHJvbXB0RGlzbWlzc2VkIjpmYWxzZSwiY29udmVyc2F0aW9uSWQiOiIxMjE0NDE3NTE4MDM3NzQ1OTA1In0=

3 Console Messages

Source Level URL
Text
other warning URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/(Line 306)
Message:
Allow attribute will take precedence over 'allowfullscreen'.
javascript warning URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/662.dc13e1cf69424def.js
Message:
It is recommended that a robustness level be specified. Not specifying the robustness level could result in unexpected behavior.
javascript verbose URL: https://assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/messenger-369223c5490f8cdcf187.chunk.js(Line 1)
Message:
Rendering was performed in a subtree hidden by content-visibility.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

003-yru-314.mktoresp.com
ajax.googleapis.com
alb.reddit.com
analytics.twitter.com
app.qualified.com
apresolve.spotify.com
assets.qualified.com
attr.ml-api.io
b.6sc.co
bat.bing.com
c.6sc.co
cdn.bizible.com
cdn.bizibly.com
cdn.linkedin.oribi.io
cdnjs.cloudflare.com
connect.facebook.net
embed-cdn.spotifycdn.com
encore.scdn.co
epsilon.6sense.com
fonts.googleapis.com
gew4-spclient.spotify.com
googleads.g.doubleclick.net
i.scdn.co
ipv6.6sc.co
j.6sc.co
js.qualified.com
munchkin.marketo.net
open.spotify.com
px.ads.linkedin.com
px4.ads.linkedin.com
qualified-production.s3.us-east-1.amazonaws.com
redcanary.com
region1.analytics.google.com
resource.redcanary.com
s.ml-attr.com
s3-us-west-2.amazonaws.com
script.crazyegg.com
secure.adnxs.com
sentry.io
snap.licdn.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
tracking.crazyegg.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
www.redditstatic.com
b.6sc.co
104.17.71.206
104.198.136.223
104.244.42.195
104.244.42.197
104.64.124.188
13.107.42.14
146.75.116.157
151.101.65.140
152.195.15.58
185.89.210.101
192.28.147.68
2.20.142.112
2001:4860:4802:32::36
2600:1901:0:524d::
2600:1901:1:81::
2600:1901:1:c36::
2600:9000:20eb:c000:2:53b2:240:93a1
2600:9000:2251:9000:12:3734:2a40:93a1
2606:4700::6811:190e
2606:4700::6812:1005
2606:4700::6812:1105
2606:4700::6813:9408
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:801::2004
2a00:1450:4001:80b::200a
2a00:1450:4001:811::2003
2a00:1450:4001:813::2008
2a00:1450:4001:829::200e
2a00:1450:4001:82b::200a
2a00:1450:4001:830::2002
2a00:1450:400c:c00::9c
2a02:26f0:2c::216:f230
2a02:26f0:3500:16::215:1497
2a02:26f0:3500:6::17d8:4dae
2a03:2880:f083:100:face:b00c:0:3
2a03:2880:f177:185:face:b00c:0:25de
2a04:4e42:400::396
2a04:4e42:8d::760
2a04:4e42:8d::762
35.158.23.65
35.186.247.156
52.204.253.158
52.216.144.158
52.218.169.216
68.67.153.60
99.81.137.90
00bbc66153e493c73e6ee4448a25fac555d74e1fd957f6f804754ff27bb9884f
039130d456855a745451bff40707bee5512bc4466373224b2258f67cc6c6d879
040c6c4b281ea6760e1db7e9f2063e2409f8a2434d95851d85cc535f0ff1f9b5
0f57969cdf0d61b86fc25ded8a8c5058a5edd346d1845b232610a54f08d0fcb8
1004dc1b12f999eafe5336d4c92c18af95daf65af8b2bd641d29e697efb56364
122854df4f39cf922db317714c2ff0eccab27a1028c14a5aa2211f48b7e0eade
1486615b34c43bee393a5dd74f110c6f25c5f2d66d8111278f54e77ffcbc63a3
152261291c938aa5aad6a56d52b47ffcb893d1c0387e76d7f270a7382ff786d5
1576f47ba50e5433d2efe01986fa43b861bd6a4de15751c35bf606b2a9fed2c9
15e5827ebf3a8660ccf687d7f208b247f355421bfeeaa572f26913a453acf45e
16005d3dd555b3e66dd9ebf840d8b225ee02966d26b62f58aea68e6808ff3c83
176be825d2d8a9067afb1920060b4ca608fda05a7ce1da76bea32a56b446367b
1cbfcbb81af382110b9d1911b035a8d19b3ca175272555884721d64fb72221c1
1d3d9de6db687e8b9bf3aa08f565dc2db8743147acce6904bf762b7ff56dbf09
1d752805498ebd36b9c69ad1d3da93b1561ea6b33f58ec89a66a4228a357dfe2
2182476b2f19b36cc23e9bbdb2dd97b84f4d6eddabc117e374b893fe3cd8cdc5
23beb1299c9ce3903083b644ea6776549b79dbaf32de324eb394fc3517a84d02
24a9979fff20ad59cba9b4a38af6fba8903c482fa2c390e2f0e82c97a649da98
24b99703cc2b2d010f48778c5700beb1ed63e688c460b7498c911bb4a97e2e23
263e16f176fddc5af313fa27a6173538c61b5f28db6a4360e9ae9f81504907b1
292f853f9ef0e448c5536987fe87197f401bafcde3e0857e17de1f0676f5b2eb
2f472251b6b4a4a8d7ceed7539cb6ebea71caf28bccc0beda7a6866a6847b53e
2fb0db460ef1851e44c7e94a3f1944e299e306def449ed72c30adfb89b25b029
317ee837827c977d173835f63d93a514075cddc5f7c52c31caa7d89dee648b08
3436a3567df14bd76a0e5b2ab1edba77ff61c49fb811b64de0dd23899103ecdc
35134ff1cfb9ea2e3a5d5e63856b1efeba6893a5bcbfb93a73b6e4b671239282
3562dd5ebaf7d001cd283fe325fc4b574e26b053807efb3331dd8fcb5964f559
36975a27509bf92a53016181456a48ff34220ab524329a013bd2fa486ab19048
3a48ba6d11055a2a6f840befa14e603650d8ca3d752e16daccd828d3869fb791
3ac0c589d242920586289eabdd93bf71f3d85bb1c6c8333d3e2deb4e173b61a4
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4c2abed80cacd245c5f3097eb93eb20d9b0b535381c4dd4cfeb0da49e2f54085
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
53f545d884abf02ce99f4e0369ffec8be28f1f3f22eb99bf0fab9f4522ea5142
5408d95db01e0b235e7f251650932b36f5abfe4f40e8111b74c437826480b8fb
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5a67c844a08bb049379474c28891b836a26d673555f882dd5717beeabf42200f
5d07fef4322254c5ef1217d36478f2493d1dcdea7254b5f35adf231c55588cb4
6217f642930c0d2411329fb00cf9a7e2e138a98f56eece6e82b3a7359f20cb11
62c59060782cf4822b2598e623b331039dc6e4a1f8ded9c07032eb91f60adc20
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
6af930f857a9b1c2e3f638e4c2eeae1f5a8d28643db55d6a2f7d99c77e17489f
6bc9a4bdde5c48a39cabd8840dec8bd11281dcdd167cf4440f383f01ad3ab123
6e0b02e307a08a6384527ffd3c99e8a3d4f83927b855c2ab6836e951337be886
6e6f98c4389081777426fefbe315bf755c164f9983b5d3a2b3f14d62542fc78b
6ea27beb5e90d0b65a769f26f1864df79c97c997cc279952734892eeafd5ab05
6ec35ab99388f6afab345622a22772619b83b7d63705d98df3c404da782fcabb
6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e
731fcb30d45f2e35aaa139a7a964410a7c2bcdbfbb48a837c9d56dec7cc3732f
7348a2eb48c9a681d6178433394c7037144d85b57ee33a11339d3a33fa1001a4
747e9ca7a5f5157e1555dca2f78d780db6a1bef9dc270dcd7a73f571f1391d2b
7481436346ad777435fe494e87a3d7fa9dc1251ab9a024d5305a90fcc0b44f8c
756b9a05dda5b1afa4e8c3aaa061eccf77460cbd84f4b31f511b675fc9dbacd3
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7bb26544c7c0d00e118860dc125c1bc943201bca5cf780804370732b39210d38
7d16d5b86d8a772e8039843458e2a6d91ab2ec51a9cc01f64d934e0bd4ab4327
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
86551808dbfbf8bc9b23ab3d0725794c2e1f2b4265c96715f2945638160edc2b
86f2855487ee0f2a026de07b800d0a191f2d66723011cf5e7bddea4669037b33
8994173b286983d0ba4938dd7a8da5e6eecbad6eec2982ab528efb6131a8f132
8ec32112354b4493286cb34daa05fa0a49791553bfedb374d7a67c7ad9cb2c9f
8edbf02936f4bbda931a228bd84f7b668522af07f3dfc33b5caee429e7febb85
8f747cdb56a6ab39c12ede219686c746531c30fecf37506b9d941baac2ea08c5
977858a0c518ab885051998c26954247bcc67d50bd26c4438d3022aec559c5c8
99011a0690be8d013bbf0ba1c7e2921db4c6f9e03d6d78e03ca8e1e826bf5b96
99e97366cd580fb716ea693b2696808c006d45c6366004db4286156077f20c4f
9a586f0b3e8add35ad17a2eec2cee97cbe175f48d7c47e34492dd973aa0f8381
9b7413f945c8b8bb3f75eb10513c7ad79d386e98494d541e5f1fa9301ffbddd6
9dcafe0dd491720f7b4e7168ee159909aba669acbba23ca17e32c9a2174510b0
9e41e783ec4cfc524c1666d1d5a4c805f8e92be52b030d130acfb31105e1e04c
9edb5c5ef600768db6e8ee027853f2c6f8ab34f615b495faaf114579f8de2e22
a2fddc4ed1c9bf8894fef28beb525f07fa0f74db732511b6c8986f7eff8e853b
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
a3f3a976fd7933cb06e76dc3c48947c15ab8b7f20bdbca0dc7851fdb5a7470a1
a4499f745882700108e60115ea38c28693bf225e861ffa788c30fceac83fb88e
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad73a65390838c7aa6178369b1d1df0ecc23a314ec62655313582be575ade8dd
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
af40bad1e1b6415c6d7dfa127a6e8bf4c64111adfca9e4f4c43ade9c39dc9592
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b40d37fbb13b1b903fd3c063523b41c47c57e61ab99cad3bd35881672ea3e3d6
b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a
bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a
c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0
c50d38b6e5102868bfcab53c19db01fb7e7f78a180795822dfc6cc90492a7c24
cc240e36234dec6c472a04a70af52dfa5dce110a2766d9280e19fb12cde54e9d
cca95ef2a816865f55df96aedf861e29dd6dbe5c7c968a53de535de77089c6ee
ccccfce93233bff70d19b919d1cb552aed5bc6caac3fc76d01ab6f4c757901d9
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d2f545bb226e5bcc1d50af37b345d245dce63bc07aaeba2243e0f1ea87b2dcb9
d3cffae0a07184a7f41e99ed86654a87129116d1bc4ad30df766400d3953c404
d612f1212b452af07f1a5defb2b672e76a91f7139e7499fa48bb9b2b985c22d6
d96a336dfd4e90adb7f50bdd1d325b536459b90d1a27427bb31d977971da7899
d9e0863aa56b8cba71d458f9491fdca3c7cc6b0eddbc288d0dfe3d41d0a30eef
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd25827c9ad7ac0cbdb3545ed377f0ff5c9d5c1d14282307cf04ac4776d0a572
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3cc36c64ef86bed21592653daac82fd7e4c364c32c8344336aa13f7dbf52c90
e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f
eb3487cae40a55bf31dc6e6191ab0d88ec8c8f85c62bf28ad25ad0a40c16a611
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0871092f9e672c52b6f12d73598a0c04b99bfb0b62dd1a8848ff49d524b8e48
f1d4b7e28e37dd7d9a576c9b49f998374ed3a3d34a3e8cf865fa134a8486f14c
f244fcb6b0aeadba8f41f30a7f451c0aaa06445ec854c3d9bbef1c485a036424
f526e42397f6b24d9b2c3cb34f9cec6af49cc7e1eb921f397a2ce7315fd607d1
f872315d333981663bad5953d1280c886beab704fa9a9d2abc768352aa71d39a
f8e765848384e530beac002fc4656b7d54b12ef24564025933981afe76e2ca43
fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25
fd7385bd0bc7f291c2370cc63389d132bcac95e8449f516bbd8c0e40c10cdabe
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a