www.fireeye.com Open in urlscan Pro
2606:4700:300b::a29f:f67d Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
Submission: On March 04 via api (March 4th 2021, 12:46:34 pm UTC) from US

Summary HTTP 183 Redirects Links 28 Behaviour Indicators

Summary

This website contacted 51 IPs in 7 countries across 42 domains to perform 183 HTTP transactions. The main IP is 2606:4700:300b::a29f:f67d, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.fireeye.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on January 7th 2021. Valid for: a year.

This is the only time www.fireeye.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
24	2606:4700:300... 2606:4700:300b::a29f:f67d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	104.111.232.231 104.111.232.231	16625 (AKAMAI-AS) (AKAMAI-AS)
1	13.108.248.135 13.108.248.135	14340 (SALESFORCE) (SALESFORCE)
6	104.17.70.206 104.17.70.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	104.75.88.112 104.75.88.112	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6810:262f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:6c0... 2a02:26f0:6c00:28c::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY)
1	142.250.185.98 142.250.185.98	15169 (GOOGLE) (GOOGLE)
1 2	142.250.185.70 142.250.185.70	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	23.79.148.198 23.79.148.198	16625 (AKAMAI-AS) (AKAMAI-AS)
1	13.32.24.102 13.32.24.102	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:303... 2606:4700:3036::ac43:dfcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
68	13.224.193.72 13.224.193.72	16509 (AMAZON-02) (AMAZON-02)
1 1	68.67.153.60 68.67.153.60	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	185.33.221.14 185.33.221.14	29990 (ASN-APPNEX) (ASN-APPNEX)
1	65.9.58.81 65.9.58.81	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:827::200e	15169 (GOOGLE) (GOOGLE)
1	65.9.58.60 65.9.58.60	16509 (AMAZON-02) (AMAZON-02)
1 2	2620:119:50e3... 2620:119:50e3:101::6cae:b45	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	52.142.114.176 52.142.114.176	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a00:1450:400... 2a00:1450:4001:803::2002	15169 (GOOGLE) (GOOGLE)
8	34.194.181.251 34.194.181.251	14618 (AMAZON-AES) (AMAZON-AES)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:1a	20446 (HIGHWINDS3) (HIGHWINDS3)
3	2a00:1450:400... 2a00:1450:4001:811::200a	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
2	2a00:1450:400... 2a00:1450:400c:c1b::9d	15169 (GOOGLE) (GOOGLE)
4	54.85.197.191 54.85.197.191	14618 (AMAZON-AES) (AMAZON-AES)
3	2a00:1450:400... 2a00:1450:4001:812::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
1	184.30.21.162 184.30.21.162	16625 (AKAMAI-AS) (AKAMAI-AS)
1	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
1	13.108.248.7 13.108.248.7	14340 (SALESFORCE) (SALESFORCE)
1 2	54.155.47.148 54.155.47.148	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:125e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	182.22.24.252 182.22.24.252	23816 (YAHOO Yah...) (YAHOO Yahoo Japan Corporation)
1	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
2	52.204.168.112 52.204.168.112	14618 (AMAZON-AES) (AMAZON-AES)
1	13.110.65.53 13.110.65.53	14340 (SALESFORCE) (SALESFORCE)
1	182.22.30.204 182.22.30.204	23816 (YAHOO Yah...) (YAHOO Yahoo Japan Corporation)
2	2a00:1288:80:... 2a00:1288:80:800::7001	203220 (YAHOO-DEB) (YAHOO-DEB)
1	52.51.251.137 52.51.251.137	16509 (AMAZON-02) (AMAZON-02)
1	13.224.193.96 13.224.193.96	16509 (AMAZON-02) (AMAZON-02)
6	3.94.218.138 3.94.218.138	14618 (AMAZON-AES) (AMAZON-AES)
1	52.22.71.46 52.22.71.46	14618 (AMAZON-AES) (AMAZON-AES)
2	34.204.215.213 34.204.215.213	14618 (AMAZON-AES) (AMAZON-AES)
2	18.205.49.143 18.205.49.143	14618 (AMAZON-AES) (AMAZON-AES)
2	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
183	51

24 2606:4700:300b::a29f:f67d (United States)

ASN13335 (CLOUDFLARENET, US)

www.fireeye.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.232.231 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-232-231.deploy.static.akamaitechnologies.com

cloud.typography.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.108.248.135 (United States)

ASN14340 (SALESFORCE, US)
PTR: dcl2-ord.la1-c2-ord.salesforceliveagent.com

c.la2c2.salesforceliveagent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.17.70.206 (United States)

ASN13335 (CLOUDFLARENET, US)

www2.fireeye.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.75.88.112 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-75-88-112.deploy.static.akamaitechnologies.com

s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
v1.addthisedge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:262f (United States)

ASN13335 (CLOUDFLARENET, US)

js.maxmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:28c::25ea (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.70 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f6.1e100.net

8443343.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.79.148.198 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-79-148-198.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.24.102 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-24-102.fra56.r.cloudfront.net

app.cdn.lookbookhq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3036::ac43:dfcf (United States)

ASN13335 (CLOUDFLARENET, US)

v2.listenloop.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

68 13.224.193.72 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-193-72.fra2.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.153.60 (Secaucus, United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: s.ml-attr.com.pxlsrv.net

s.ml-attr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.33.221.14 (Amsterdam, Netherlands) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.58.81 (United States)

ASN16509 (AMAZON-02, US)

attr.ml-api.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.58.60 (United States)

ASN16509 (AMAZON-02, US)

lftracker.leadfeeder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:119:50e3:101::6cae:b45 (United States) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.142.114.176 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

g.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 34.194.181.251 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-194-181-251.compute-1.amazonaws.com

jukebox.pathfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:1a (Netherlands)

ASN20446 (HIGHWINDS3, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:811::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c1b::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 54.85.197.191 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-85-197-191.compute-1.amazonaws.com

abm2.listenloop.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:812::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.30.21.162 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-21-162.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.108.248.7 (United States)

ASN14340 (SALESFORCE, US)
PTR: dcl1-ord.la1-c2-ord.salesforceliveagent.com

d.la2c2.salesforceliveagent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.155.47.148 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-155-47-148.eu-west-1.compute.amazonaws.com

segment.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 182.22.24.252 (Japan)

ASN23816 (YAHOO Yahoo Japan Corporation, JP)

s.yimg.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.204.168.112 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

spcollector.pathfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.110.65.53 (United States)

ASN14340 (SALESFORCE, US)
PTR: dcl2-ncg1-c6-iad5.la1-c1-ia5.salesforceliveagent.com

d.la1-c1-ia5.salesforceliveagent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 182.22.30.204 (Japan)

ASN23816 (YAHOO Yahoo Japan Corporation, JP)

b91.yahoo.co.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1288:80:800::7001 (United Kingdom)

ASN203220 (YAHOO-DEB, GB)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.51.251.137 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

fireeye.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.193.96 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-193-96.fra2.r.cloudfront.net

embeds.driftcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 3.94.218.138 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-94-218-138.compute-1.amazonaws.com

metrics.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.22.71.46 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-22-71-46.compute-1.amazonaws.com

bootstrap.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.204.215.213 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-204-215-213.compute-1.amazonaws.com

targeting.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.205.49.143 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-205-49-143.compute-1.amazonaws.com

event.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
68	driftt.com js.driftt.com	729 KB
30	fireeye.com www.fireeye.com www2.fireeye.com	799 KB
11	drift.com metrics.api.drift.com bootstrap.api.drift.com targeting.api.drift.com event.api.drift.com	5 KB
10	pathfactory.com jukebox.pathfactory.com spcollector.pathfactory.com	4 KB
5	listenloop.com v2.listenloop.com abm2.listenloop.com	60 KB
5	doubleclick.net 1 redirects 8443343.fls.doubleclick.net googleads.g.doubleclick.net stats.g.doubleclick.net	3 KB
4	google.de www.google.de adservice.google.de	1 KB
4	google.com www.google.com adservice.google.com	2 KB
4	google-analytics.com www.google-analytics.com	19 KB
3	googleapis.com fonts.googleapis.com	2 KB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	3 KB
3	salesforceliveagent.com c.la2c2.salesforceliveagent.com d.la2c2.salesforceliveagent.com d.la1-c1-ia5.salesforceliveagent.com	42 KB
2	gstatic.com fonts.gstatic.com	18 KB
2	yimg.com s.yimg.com	7 KB
2	bidr.io 1 redirects segment.prod.bidr.io	1 KB
2	facebook.com www.facebook.com	219 B
2	adnxs.com 2 redirects secure.adnxs.com	2 KB
2	marketo.net munchkin.marketo.net	7 KB
2	facebook.net connect.facebook.net	92 KB
2	bing.com bat.bing.com	9 KB
2	maxmind.com js.maxmind.com	2 KB
2	addthis.com s7.addthis.com	190 KB
1	driftcdn.com embeds.driftcdn.com	8 KB
1	omtrdc.net fireeye.tt.omtrdc.net	726 B
1	yahoo.co.jp b91.yahoo.co.jp	948 B
1	yimg.jp s.yimg.jp	2 KB
1	cloudflare.com cdnjs.cloudflare.com	24 KB
1	addthisedge.com v1.addthisedge.com	1 KB
1	twitter.com analytics.twitter.com	652 B
1	moatads.com z.moatads.com	1 KB
1	t.co t.co	449 B
1	bootstrapcdn.com maxcdn.bootstrapcdn.com	7 KB
1	microsoft.com g.microsoft.com	356 B
1	leadfeeder.com lftracker.leadfeeder.com	7 KB
1	ml-api.io attr.ml-api.io	485 B
1	ml-attr.com 1 redirects s.ml-attr.com	276 B
1	lookbookhq.com app.cdn.lookbookhq.com	192 KB
1	googleadservices.com www.googleadservices.com	13 KB
1	ads-twitter.com static.ads-twitter.com	2 KB
1	licdn.com snap.licdn.com	2 KB
1	googletagmanager.com www.googletagmanager.com	95 KB
1	typography.com 1 redirects cloud.typography.com	464 B
183	42

	Domain	Requested by
68	js.driftt.com	www.fireeye.com js.driftt.com
24	www.fireeye.com	www.fireeye.com
8	jukebox.pathfactory.com	www.fireeye.com
6	metrics.api.drift.com	js.driftt.com
6	www2.fireeye.com	www.fireeye.com www2.fireeye.com
4	abm2.listenloop.com	www.fireeye.com
4	www.google-analytics.com	www.googletagmanager.com www.fireeye.com
3	www.google.de	www.fireeye.com
3	www.google.com	www.fireeye.com
3	fonts.googleapis.com	www.fireeye.com js.driftt.com
2	fonts.gstatic.com	fonts.googleapis.com
2	event.api.drift.com	js.driftt.com
2	targeting.api.drift.com	js.driftt.com
2	s.yimg.com	www.fireeye.com
2	spcollector.pathfactory.com	www.fireeye.com
2	segment.prod.bidr.io	1 redirects www.fireeye.com
2	stats.g.doubleclick.net	www.fireeye.com
2	www.facebook.com	www.fireeye.com connect.facebook.net
2	px.ads.linkedin.com	1 redirects www.fireeye.com
2	secure.adnxs.com	2 redirects
2	munchkin.marketo.net	www.googletagmanager.com munchkin.marketo.net
2	connect.facebook.net	www.fireeye.com connect.facebook.net
2	8443343.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	bat.bing.com	www.googletagmanager.com www.fireeye.com
2	js.maxmind.com	www.fireeye.com
2	s7.addthis.com	www.fireeye.com
1	bootstrap.api.drift.com	js.driftt.com
1	embeds.driftcdn.com	js.driftt.com
1	fireeye.tt.omtrdc.net	www.fireeye.com
1	b91.yahoo.co.jp	www.fireeye.com
1	d.la1-c1-ia5.salesforceliveagent.com	www.fireeye.com
1	adservice.google.de	adservice.google.com
1	s.yimg.jp	www.googletagmanager.com
1	cdnjs.cloudflare.com	www.fireeye.com
1	v1.addthisedge.com	s7.addthis.com
1	d.la2c2.salesforceliveagent.com	www.fireeye.com
1	analytics.twitter.com	www.fireeye.com
1	z.moatads.com	s7.addthis.com
1	adservice.google.com	8443343.fls.doubleclick.net
1	t.co	www.fireeye.com
1	maxcdn.bootstrapcdn.com	www.fireeye.com
1	googleads.g.doubleclick.net	www.fireeye.com
1	g.microsoft.com	www.fireeye.com
1	www.linkedin.com	1 redirects
1	lftracker.leadfeeder.com	www.fireeye.com
1	attr.ml-api.io	www.fireeye.com
1	s.ml-attr.com	1 redirects
1	v2.listenloop.com	www.fireeye.com
1	app.cdn.lookbookhq.com	www.fireeye.com
1	www.googleadservices.com	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	www.googletagmanager.com	www.fireeye.com
1	c.la2c2.salesforceliveagent.com	www.fireeye.com
1	cloud.typography.com	1 redirects
183	55

This site contains links to these domains. Also see Links.

Domain
fireeyecommunity.force.com
community.fireeye.com
docs.fireeye.com
partners.fireeye.com
training.fireeye.com
www2.fireeye.com
vision.fireeye.com
fireeye.market
investors.fireeye.com
www.accellion.com
nvd.nist.gov
csportal.fireeye.com
www.linkedin.com
twitter.com
www.facebook.com
www.youtube.com
itunes.apple.com
www.fireeye.fr
www.fireeye.de
www.fireeye.jp
www.fireeye.kr
www.addthis.com

Subject Issuer	Validity	Valid
fireeye.com Cloudflare Inc ECC CA-3	`2021-01-07` - `2022-01-06`	a year	crt.sh
la1-c2-ord.salesforceliveagent.com DigiCert SHA2 Secure Server CA	`2020-07-09` - `2021-07-06`	a year	crt.sh
www2.fireeye.com Cloudflare Inc ECC CA-3	`2020-07-05` - `2021-07-05`	a year	crt.sh
odc-prod-01.oracle.com DigiCert SHA2 Secure Server CA	`2021-01-10` - `2021-04-07`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2021-02-17` - `2021-05-12`	3 months	crt.sh
*.maxmind.com Sectigo RSA Organization Validation Secure Server CA	`2020-10-07` - `2021-11-06`	a year	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
www.bing.com Microsoft RSA TLS CA 02	`2021-01-19` - `2021-07-19`	6 months	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-14` - `2021-08-19`	a year	crt.sh
www.googleadservices.com GTS CA 1O1	`2021-02-17` - `2021-05-12`	3 months	crt.sh
*.doubleclick.net GTS CA 1O1	`2021-02-17` - `2021-05-12`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-02-10` - `2021-05-10`	3 months	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2020-03-14` - `2021-04-13`	a year	crt.sh
cdn.lookbookhq.com Amazon	`2020-11-08` - `2021-12-07`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-05` - `2021-08-05`	a year	crt.sh
drift.com Amazon	`2020-09-21` - `2021-10-23`	a year	crt.sh
*.ml-api.io Amazon	`2021-01-20` - `2022-02-17`	a year	crt.sh
*.leadfeeder.com Amazon	`2021-02-13` - `2022-03-14`	a year	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2021-01-06` - `2021-07-05`	6 months	crt.sh
g.msn.com Microsoft RSA TLS CA 01	`2020-10-06` - `2021-10-06`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2021-01-26` - `2021-04-20`	3 months	crt.sh
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA	`2020-09-22` - `2021-10-12`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-02-17` - `2021-05-12`	3 months	crt.sh
*.pathfactory.com Amazon	`2020-04-05` - `2021-05-05`	a year	crt.sh
t.co DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
*.listenloop.com RapidSSL RSA CA 2018	`2019-06-14` - `2021-06-17`	2 years	crt.sh
www.google.com GTS CA 1O1	`2021-01-26` - `2021-04-20`	3 months	crt.sh
www.google.de GTS CA 1O1	`2021-01-26` - `2021-04-20`	3 months	crt.sh
*.google.com GTS CA 1O1	`2021-02-17` - `2021-05-12`	3 months	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2021-01-21` - `2022-01-25`	a year	crt.sh
*.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
*.segment.prod.bidr.io Amazon	`2021-02-26` - `2022-03-27`	a year	crt.sh
edge01.yahoo.co.jp Cybertrust Japan SureServer CA G4	`2021-02-10` - `2022-03-09`	a year	crt.sh
*.google.de GTS CA 1O1	`2021-01-26` - `2021-04-20`	3 months	crt.sh
la1-c1-ia5.salesforceliveagent.com DigiCert SHA2 Secure Server CA	`2019-05-14` - `2021-05-13`	2 years	crt.sh
mscedge01.yahoo.co.jp Cybertrust Japan SureServer CA G4	`2020-08-04` - `2021-09-03`	a year	crt.sh
*.yahoo.com DigiCert SHA2 High Assurance Server CA	`2021-02-21` - `2021-04-06`	a month	crt.sh
*.tt.omtrdc.net DigiCert SHA2 Secure Server CA	`2020-11-02` - `2021-11-09`	a year	crt.sh
*.driftcdn.com Amazon	`2020-04-10` - `2021-05-10`	a year	crt.sh
*.gstatic.com GTS CA 1O1	`2021-02-17` - `2021-05-12`	3 months	crt.sh

This page contains 7 frames:

Primary Page: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
Frame ID: F57DBD61379CAC8BE9C046183E156CDF
Requests: 98 HTTP requests in this frame

Frame: https://8443343.fls.doubleclick.net/activityi;dc_pre=CPvcvNLVlu8CFZC61QodW9YI9g;src=8443343;type=sitew0;cat=firee0;ord=7330328966427;gtm=2wg2o0;auiddc=1630147819.1614861974;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html;u2=Cyber%20Criminals%20Exploit%20Accellion%20FTA%20for%20Data%20Theft%20and%20Extortion%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html
Frame ID: 7276C6922F2E0D537B9B84CA21342926
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CPvcvNLVlu8CFZC61QodW9YI9g;src=8443343;type=sitew0;cat=firee0;ord=7330328966427;gtm=2wg2o0;auiddc=1630147819.1614861974;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html;u2=Cyber%20Criminals%20Exploit%20Accellion%20FTA%20for%20Data%20Theft%20and%20Extortion%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html
Frame ID: 5AD03B4D9E68E99E5F95A918ADDE1047
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.de/ddm/fls/i/dc_pre=CPvcvNLVlu8CFZC61QodW9YI9g;src=8443343;type=sitew0;cat=firee0;ord=7330328966427;gtm=2wg2o0;auiddc=1630147819.1614861974;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html;u2=Cyber%20Criminals%20Exploit%20Accellion%20FTA%20for%20Data%20Theft%20and%20Extortion%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html
Frame ID: 8AE4AC8B141F5B9EB945E7C3B5B387E3
Requests: 1 HTTP requests in this frame

Frame: https://www2.fireeye.com/index.php/form/XDFrame
Frame ID: A2007D2D2F2F9062FC15C22BE99AEA07
Requests: 2 HTTP requests in this frame

Frame: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
Frame ID: 7A4A965473533AEA9DE63CC25EDEC1EE
Requests: 36 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat
Frame ID: 5950FF9EBB84B3D4F69D0DB6A708DDCD
Requests: 42 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

script /\/etc\/designs\//i
script /\/etc.clientlibs\//i

Java (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

script /\/etc\/designs\//i
script /\/etc.clientlibs\//i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

183
Requests

99 %
HTTPS

41 %
IPv6

42
Domains

55
Subdomains

51
IPs

7
Countries

2457 kB
Transfer

6811 kB
Size

8
Cookies

28 Outgoing links

These are links going to different origins than the main page.

URL: https://fireeyecommunity.force.com/CustomerCommunity/s/
Title: Customer Portal

Search URL Search Domain Scan URL

URL: https://community.fireeye.com/s/support-community
Title: Communities

Search URL Search Domain Scan URL

URL: https://docs.fireeye.com/
Title: Documentation Portal

Search URL Search Domain Scan URL

URL: https://partners.fireeye.com/directory/
Title: Partner Locator

Search URL Search Domain Scan URL

URL: http://training.fireeye.com/
Title: Partner Education Center

Search URL Search Domain Scan URL

URL: https://www2.fireeye.com/Partner-Request-LP-New.html
Title: Become a Partner

Search URL Search Domain Scan URL

URL: https://partners.fireeye.com/
Title: Partner Portal

Search URL Search Domain Scan URL

URL: https://vision.fireeye.com/
Title: The Vision – Digital Magazine

Search URL Search Domain Scan URL

URL: https://fireeye.market/
Title: FireEye Market

Search URL Search Domain Scan URL

URL: http://investors.fireeye.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://www.accellion.com/company/press-releases/accellion-provides-update-to-recent-fta-security-incident/
Title: Accellion has patched all FTA vulnerabilities

Search URL Search Domain Scan URL

URL: https://www.accellion.com/products/fta/
Title: FTA customers migrate to kiteworks

Search URL Search Domain Scan URL

URL: https://www.accellion.com/
Title: enterprise content firewall

Search URL Search Domain Scan URL

URL: https://nvd.nist.gov/vuln/detail/CVE-2021-27101
Title: CVE-2021-27101

Search URL Search Domain Scan URL

URL: https://nvd.nist.gov/vuln/detail/CVE-2021-27102
Title: CVE-2021-27102

Search URL Search Domain Scan URL

URL: https://nvd.nist.gov/vuln/detail/CVE-2021-27103
Title: CVE-2021-27103

Search URL Search Domain Scan URL

URL: https://nvd.nist.gov/vuln/detail/CVE-2021-27104
Title: CVE-2021-27104

Search URL Search Domain Scan URL

URL: https://csportal.fireeye.com/secur/login_portal.jsp?orgId=00D3000000063LS&portalId=06030000000pSNE
Title: Customer Portal

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/fireeye
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://twitter.com/fireeye
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/FireEye
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/FireEyeInc
Title: YouTube

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/us/podcast/eye-on-security/id1073779629?mt=2
Title: Podcast

Search URL Search Domain Scan URL

URL: https://www.fireeye.fr/
Title: French (Français)

Search URL Search Domain Scan URL

URL: https://www.fireeye.de/
Title: German (Deutsch)

Search URL Search Domain Scan URL

URL: https://www.fireeye.jp/
Title: Japanese (日本語)

Search URL Search Domain Scan URL

URL: https://www.fireeye.kr/
Title: Korean (한국어)

Search URL Search Domain Scan URL

URL: https://www.addthis.com/website-tools/overview?utm_source=AddThis%20Tools&utm_medium=image
Title: AddThis

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

https://cloud.typography.com/6746836/6977592/css/fonts.css HTTP 302
https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/3982EDB9831683D51.css

Request Chain 28

https://8443343.fls.doubleclick.net/activityi;src=8443343;type=sitew0;cat=firee0;ord=7330328966427;gtm=2wg2o0;auiddc=1630147819.1614861974;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html;u2=Cyber%20Criminals%20Exploit%20Accellion%20FTA%20for%20Data%20Theft%20and%20Extortion%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html HTTP 302
https://8443343.fls.doubleclick.net/activityi;dc_pre=CPvcvNLVlu8CFZC61QodW9YI9g;src=8443343;type=sitew0;cat=firee0;ord=7330328966427;gtm=2wg2o0;auiddc=1630147819.1614861974;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html;u2=Cyber%20Criminals%20Exploit%20Accellion%20FTA%20for%20Data%20Theft%20and%20Extortion%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html

Request Chain 34

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dfireeye.com%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dfireeye.com%26pId%3d%24UID HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dfireeye.com%2526pId%253d%2524UID HTTP 302
https://attr.ml-api.io/?domain=fireeye.com&pId=8878082128330056446

Request Chain 39

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&time=1614861973888&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D6572%26time%3D1614861973888%26url%3Dhttps%253A%252F%252Fwww.fireeye.com%252Fblog%252Fthreat-research%252F2021%252F02%252Faccellion-fta-exploited-for-data-theft-and-extortion.html%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&time=1614861973888&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html&liSync=true

Request Chain 79

https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value= HTTP 303
https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=&_bee_ppp=1

183 HTTP transactions
10 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request accellion-fta-exploited-for-data-theft-and-extortion.html Show response
www.fireeye.com/blog/threat-research/2021/02/ 90 KB
25 KB 875ms
851ms Document
text/html 2606:4700:300b::a29f:f67d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

185eea1826de12c3127604e8f6c8ac493c80c73f702beef7692e0f1cec7f2d1d

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.fireeye.com
:scheme: https
:path: /blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 12:46:13 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=dc98b187838dbf7fec8c6df149d58890c1614861972; expires=Sat, 03-Apr-21 12:46:12 GMT; path=/; domain=.fireeye.com; HttpOnly; SameSite=Lax; Secure
cf-ray: 62ab34c0ad0905bb-FRA
cache-control: public, max-age=691200
expires: Fri, 12 Mar 2021 12:46:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding,User-Agent
cf-cache-status: MISS
cf-request-id: 089edf4c69000005bb9106b000000001
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-content-type-options: nosniff
x-dispatcher: dispatcher2uswest1
x-frame-options: ALLOW-FROM https://content.fireeye.com
x-vhost: publish
x-xss-protection: 1; mode=block
server: cloudflare
content-encoding: gzip

GET
H2 200 jquery.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/ 111 KB
38 KB 34ms
24ms Script
application/javascript 2606:4700:300b::a29f:f67d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b397476bcbcf8c9eae3f82007cc4f9495661b367e02e6d3dea6e15f0610ef20a

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Thu, 04 Mar 2021 12:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 11965
x-vhost: publish
vary: Accept-Encoding,User-Agent
content-length: 38305
cf-request-id: 089edf4fd7000005bbb6a9b000000001
last-modified: Wed, 03 Mar 2021 21:23:40 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "1baa2-5bca876f77658-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: public, max-age=691200
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 62ab34c62dcd05bb-FRA
expires: Fri, 12 Mar 2021 12:46:13 GMT

GET
H2 200 csrf.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/ 4 KB
2 KB 41ms
32ms Script
application/javascript 2606:4700:300b::a29f:f67d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fbcc2c7d4dfbc5d0251c789843b8d7edf25306dfa23188ad267e2786357233c0

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Thu, 04 Mar 2021 12:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 11011
x-vhost: publish
vary: Accept-Encoding,User-Agent
content-length: 1676
cf-request-id: 089edf4fd8000005bbca3b3000000001
last-modified: Wed, 03 Mar 2021 21:29:55 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "f3e-5bca88d60572a-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: public, max-age=691200
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 62ab34c62dd005bb-FRA
expires: Fri, 12 Mar 2021 12:46:13 GMT

GET
H2 200 clientlibs_nav.min.js Show response
www.fireeye.com/etc/designs/fireeye-www/ 12 KB
4 KB 38ms
29ms Script
application/javascript 2606:4700:300b::a29f:f67d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_nav.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84a91ff2a1a995e3816750f53342b4499bfefc817a8ee1a5d4b401433692d510

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Thu, 04 Mar 2021 12:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 11006
x-vhost: publish
vary: Accept-Encoding,User-Agent
content-length: 3882
cf-request-id: 089edf4fd8000005bbb39c9000000001
last-modified: Wed, 03 Mar 2021 21:29:55 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "2f77-5bca88d607855-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: public, max-age=691200
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 62ab34c62dd205bb-FRA
expires: Fri, 12 Mar 2021 12:46:13 GMT

GET
H2

200

3982EDB9831683D51.css
www.fireeye.com/content/dam/fireeye-www/fw/f/775489/
Redirect Chain

https://cloud.typography.com/6746836/6977592/css/fonts.css
https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/3982EDB9831683D51.css

293 KB
219 KB

31ms
25ms

Stylesheet
text/css

2606:4700:300b::a29f:f67d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/3982EDB9831683D51.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a0a0933f843198c607baaf63f153e3fb5fd900d91f31d37d0f71b53ca66c4ab9

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Thu, 04 Mar 2021 12:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18661
cf-polished: origSize=301416
x-vhost: publish
cf-bgj: minify
vary: Accept-Encoding,User-Agent
x-xss-protection: 1; mode=block
last-modified: Wed, 03 Mar 2021 21:24:57 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: W/"49968-5bca87b9613fe-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
cache-control: public, max-age=691200
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-request-id: 089edf5065000005bb61b88000000001
cf-ray: 62ab34c70f5905bb-FRA
expires: Fri, 12 Mar 2021 12:46:13 GMT

Redirect headers

Date: Thu, 04 Mar 2021 12:46:13 GMT
Last-Modified: Wed, 01 Apr 2020 20:12:09 GMT
Server: AkamaiNetStorage
ETag: "d0795af83d79e23ccaffb60b4a75e364:1608661510.648217"
Content-Type: text/html
Location: https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/3982EDB9831683D51.css
Cache-Control: must-revalidate, private
Connection: keep-alive
X-HCo-pid: 14
Content-Length: 154
Expires: Thu, 04 March 2021 12:46:13 GMT

GET
H2 200 patch.css
www.fireeye.com/content/dam/fireeye-www/fw/css/ 6 KB
2 KB 48ms
40ms Stylesheet
text/css 2606:4700:300b::a29f:f67d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/content/dam/fireeye-www/fw/css/patch.css?v=1

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d78bfcf1f62b6a4a6c403372ad3a4f46fcf2bda72822ae206129d38de72f4d84

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Thu, 04 Mar 2021 12:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 9338
cf-polished: origSize=6112
x-vhost: publish
cf-bgj: minify
vary: Accept-Encoding,User-Agent
x-xss-protection: 1; mode=block
last-modified: Fri, 18 Dec 2020 19:29:31 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
cache-control: public, max-age=691200
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-request-id: 089edf4fd7000005bb74b10000000001
cf-ray: 62ab34c62dcc05bb-FRA
expires: Fri, 12 Mar 2021 12:46:13 GMT

GET
H2 200 clientlibs_fw-2019.min.css
www.fireeye.com/etc/designs/fireeye-www/ 211 KB
41 KB 44ms
34ms Stylesheet
text/css 2606:4700:300b::a29f:f67d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw-2019.min.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9f63d2f7e82142027bc7af4bb8ac91874a40e954548ae99f8339fedf2195b16c

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Thu, 04 Mar 2021 12:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 9337
x-vhost: publish
vary: Accept-Encoding,User-Agent
content-length: 41586
cf-request-id: 089edf4fd9000005bbd40f3000000001
last-modified: Wed, 03 Mar 2021 21:32:53 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "34c91-5bca897f0e519-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-xss-protection: 1; mode=block
cache-control: public, max-age=691200
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 62ab34c62dd605bb-FRA
expires: Fri, 12 Mar 2021 12:46:13 GMT

GET
H2 200 clientlibs_base.min.css
www.fireeye.com/etc/clientlibs/fireeye-blog/ 5 KB
2 KB 50ms
40ms Stylesheet
text/css 2606:4700:300b::a29f:f67d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/clientlibs/fireeye-blog/clientlibs_base.min.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

757eb886edd9a887fc95b701c88b08191eb743657027636c0c9d4973547ebb4a

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Thu, 04 Mar 2021 12:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 11276
x-vhost: publish
vary: Accept-Encoding,User-Agent
content-length: 1501
cf-request-id: 089edf4fd9000005bb4c0fd000000001
last-modified: Wed, 03 Mar 2021 21:42:48 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "1507-5bca8bb6ef188-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-xss-protection: 1; mode=block
cache-control: public, max-age=691200
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 62ab34c62dd805bb-FRA
expires: Fri, 12 Mar 2021 12:46:13 GMT

GET
H2 200 utils.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/ 10 KB
4 KB 33ms
24ms Script
application/javascript 2606:4700:300b::a29f:f67d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/utils.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Thu, 04 Mar 2021 12:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 11006
x-vhost: publish
vary: Accept-Encoding,User-Agent
content-length: 3706
cf-request-id: 089edf4fd9000005bb80be5000000001
last-modified: Wed, 03 Mar 2021 21:23:42 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "26ad-5bca877175cd6-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: public, max-age=691200
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 62ab34c62dda05bb-FRA
expires: Fri, 12 Mar 2021 12:46:13 GMT

GET
H2 200 granite.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/ 4 KB
2 KB 31ms
22ms Script
application/javascript 2606:4700:300b::a29f:f67d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c986afd07a4082d65befeef18869a4cd5e00f3ac6e8228d49658802c7453a1b8

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Thu, 04 Mar 2021 12:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 11006
x-vhost: publish
vary: Accept-Encoding,User-Agent
content-length: 1702
cf-request-id: 089edf4fda000005bbb5aa3000000001
last-modified: Wed, 03 Mar 2021 21:23:40 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "f90-5bca876f79598-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: public, max-age=691200
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 62ab34c62ddb05bb-FRA
expires: Fri, 12 Mar 2021 12:46:13 GMT

GET
H2 200 jquery.min.js Show response
www.fireeye.com/etc.clientlibs/foundation/clientlibs/ 16 B
146 B 34ms
25ms Script
application/javascript 2606:4700:300b::a29f:f67d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/foundation/clientlibs/jquery.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c084b47104c493fb377b6d35d8c08df67d773f6dcf8294c0a7360710cd8cacbd

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Thu, 04 Mar 2021 12:46:13 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 11006
x-vhost: publish
vary: User-Agent, Accept-Encoding
content-length: 16
cf-request-id: 089edf4fda000005bbac2fb000000001
last-modified: Wed, 03 Mar 2021 21:23:42 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "10-5bca8771760be"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: public, max-age=691200
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 62ab34c62ddd05bb-FRA
expires: Fri, 12 Mar 2021 12:46:13 GMT

GET
H2 200 shared.min.js Show response
www.fireeye.com/etc.clientlibs/foundation/clientlibs/ 24 KB
7 KB 46ms
31ms Script
application/javascript 2606:4700:300b::a29f:f67d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/foundation/clientlibs/shared.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4086c8cd4c3361452c1c1da9af3034fc90f4a375c4f6195f31d6dcf1c7b56f00

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Thu, 04 Mar 2021 12:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 11006
x-vhost: publish
vary: Accept-Encoding,User-Agent
content-length: 6920
cf-request-id: 089edf4fdb000005bb69a64000000001
last-modified: Wed, 03 Mar 2021 21:23:40 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "5e7e-5bca876f7dfd0-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: public, max-age=691200
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 62ab34c62ddf05bb-FRA
expires: Fri, 12 Mar 2021 12:46:13 GMT

GET
H2 200 modern.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/lodash/ 34 KB
12 KB 34ms
19ms Script
application/javascript 2606:4700:300b::a29f:f67d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/lodash/modern.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

355604a949ef95ceffcd21a7e9b5ed27c95d847f95127e0ddad5aa1793f1bb74

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Thu, 04 Mar 2021 12:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 11006
x-vhost: publish
vary: Accept-Encoding,User-Agent
content-length: 11784
cf-request-id: 089edf4fde000005bbb39cb000000001
last-modified: Wed, 03 Mar 2021 21:25:27 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "87c8-5bca87d5b4bdf-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: public, max-age=691200
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 62ab34c62de005bb-FRA
expires: Fri, 12 Mar 2021 12:46:13 GMT

GET
H2 200 kernel.min.js Show response
www.fireeye.com/etc.clientlibs/cq/personalization/clientlib/personalization/ 119 KB
26 KB 44ms
34ms Script
application/javascript 2606:4700:300b::a29f:f67d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/cq/personalization/clientlib/personalization/kernel.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

79b2448738716f0daf11d4a206e105e3b79e9d082f9c9bf4ad2bd55e591a1a3c

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Thu, 04 Mar 2021 12:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 11005
x-vhost: publish
vary: Accept-Encoding,User-Agent
content-length: 26194
cf-request-id: 089edf4fe1000005bbbbb5f000000001
last-modified: Wed, 03 Mar 2021 21:25:27 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "1dd96-5bca87d5ce68a-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: public, max-age=691200
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 62ab34c63dec05bb-FRA
expires: Fri, 12 Mar 2021 12:46:13 GMT

GET
H/1.1 200
OK deployment.js Show response
c.la2c2.salesforceliveagent.com/content/g/js/34.0/ 40 KB
41 KB 542ms
132ms Script
application/javascript 13.108.248.135
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL: https://c.la2c2.salesforceliveagent.com/content/g/js/34.0/deployment.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.108.248.135 , United States, ASN14340 (SALESFORCE, US),
Reverse DNS: dcl2-ord.la1-c2-ord.salesforceliveagent.com
Software: Jetty /
Resource Hash: 3aadac47cf44df595934bec631a78bf2ba62081ab95528e684a85b4c74453e77

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 04 Mar 2021 12:46:13 GMT
Cache-Control: max-age=60, must-revalidate
Last-Modified: Sat, 20 Feb 2021 00:42:48 GMT
Server: Jetty
Accept-Ranges: bytes
Content-Length: 41338
Content-Type: application/javascript

GET
H2 200 fe-logo-color.svg
www.fireeye.com/content/dam/fireeye-www/fw/images/ 3 KB
2 KB 30ms
26ms Image
image/svg+xml 2606:4700:300b::a29f:f67d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/fw/images/fe-logo-color.svg

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f684d50dc9b24df0a4845f688a45b856d945f79d79549240187e171e1655f236

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Thu, 04 Mar 2021 12:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 3441
x-vhost: publish
vary: Accept-Encoding,User-Agent
content-length: 1239
cf-request-id: 089edf5029000005bb90b77000000001
last-modified: Wed, 03 Mar 2021 21:27:40 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "cec-5bca8854b31ec-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/svg+xml
x-xss-protection: 1; mode=block
cache-control: public, max-age=691200
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 62ab34c6aebb05bb-FRA
expires: Fri, 12 Mar 2021 12:46:13 GMT

GET
H2 200 fig4.png
www.fireeye.com/content/dam/fireeye-www/blog/images/accellion-fta/ 110 KB
110 KB 28ms
24ms Image
image/png 2606:4700:300b::a29f:f67d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/accellion-fta/fig4.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ec44afb38e3d06cd15bcf6eab1b1197b4c26d5aaefbe1f72192585c3e90ded35

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Thu, 04 Mar 2021 12:46:13 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 11110
cf-polished: origSize=160686
x-vhost: publish
cf-bgj: imgq:85,h2pri
vary: Accept-Encoding
content-length: 112871
x-xss-protection: 1; mode=block
last-modified: Wed, 03 Mar 2021 21:25:52 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "273ae-5bca87edfd177"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
cache-control: public, max-age=691200
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-request-id: 089edf5029000005bbac301000000001
accept-ranges: bytes
cf-ray: 62ab34c6aebd05bb-FRA
expires: Fri, 12 Mar 2021 12:46:13 GMT

GET
H2 200 email-decode.min.js Show response
www.fireeye.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
834 B 12ms
7ms Script
application/javascript 2606:4700:300b::a29f:f67d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 12:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 18 Feb 2021 13:46:54 GMT
server: cloudflare
etag: W/"602e6fce-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 62ab34c6aeac05bb-FRA
vary: Accept-Encoding
cf-request-id: 089edf5027000005bbb39d1000000001
expires: Sat, 06 Mar 2021 12:46:13 GMT

GET
H2 200 bnr-mandiant-advantage-v3-315x315.png
www.fireeye.com/content/dam/fireeye-www/services/images/ 55 KB
55 KB 24ms
21ms Image
image/png 2606:4700:300b::a29f:f67d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/services/images/bnr-mandiant-advantage-v3-315x315.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a83836ec8efa8e402e410455200c7a01b33e8e390c7b9ddfa5ab3224a0d44286

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Thu, 04 Mar 2021 12:46:13 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 4891
cf-polished: origSize=57113
x-vhost: publish
cf-bgj: imgq:85,h2pri
vary: Accept-Encoding
content-length: 56255
x-xss-protection: 1; mode=block
last-modified: Wed, 03 Mar 2021 21:31:17 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "df19-5bca8923ffed3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
cache-control: public, max-age=691200
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-request-id: 089edf502a000005bbce022000000001
accept-ranges: bytes
cf-ray: 62ab34c6aec005bb-FRA
expires: Fri, 12 Mar 2021 12:46:13 GMT

GET
H2 200 forms2.min.js Show response
www2.fireeye.com/js/forms2/js/ 204 KB
68 KB 112ms
48ms Script
application/x-javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/js/forms2/js/forms2.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

014de295141a456ceda8e3c4762085e53dca50f91ddf65906d227f70cf0b1a55

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 12:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Sat, 16 Jan 2021 05:50:46 GMT
server: cloudflare
age: 3884
etag: "242465-33187-5b8fe11fd4b5e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 62ab34c71fbb1d02-CPH
cf-request-id: 089edf507200001d0206a14000000001
expires: Thu, 04 Mar 2021 16:46:13 GMT

GET
H2 200 clientlibs_fw.min.js Show response
www.fireeye.com/etc/designs/fireeye-www/ 165 KB
50 KB 32ms
27ms Script
application/javascript 2606:4700:300b::a29f:f67d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b82c98e8c4f4a5c771ef6f061634b0fe49da9f53f915cdf0f576b1cf655db0c1

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Thu, 04 Mar 2021 12:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 11004
x-vhost: publish
vary: Accept-Encoding,User-Agent
content-length: 50685
cf-request-id: 089edf502c000005bbbf2ab000000001
last-modified: Wed, 03 Mar 2021 21:25:00 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "29217-5bca87bc041ab-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: public, max-age=691200
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 62ab34c6aeb705bb-FRA
expires: Fri, 12 Mar 2021 12:46:13 GMT

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/300/ 353 KB
114 KB 93ms
89ms Script
application/javascript 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/300/addthis_widget.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Mon, 26 Oct 2020 18:11:48 GMT
server: nginx/1.15.8
etag: W/"5f971164-5834c"
vary: Accept-Encoding
x-distribution: 99
content-type: application/javascript
cache-control: public, max-age=600
date: Thu, 04 Mar 2021 12:46:13 GMT
x-host: s7.addthis.com
content-length: 116330

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 318 KB
95 KB 36ms
32ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

21e22194e6431ec7de2a9a80aa0dc9b8a9ed4eb20090f08ea587592056719dcd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 12:46:13 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 97247
x-xss-protection: 0
last-modified: Thu, 04 Mar 2021 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 04 Mar 2021 12:46:13 GMT

GET
H2 200 token.json Show response
www.fireeye.com/libs/granite/csrf/ 2 B
180 B 696ms
695ms XHR
application/json 2606:4700:300b::a29f:f67d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/libs/granite/csrf/token.json

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Thu, 04 Mar 2021 12:46:14 GMT
x-content-type-options: nosniff, nosniff
cf-cache-status: DYNAMIC
x-vhost: publish
vary: User-Agent, Accept-Encoding
content-length: 2
cf-request-id: 089edf5023000005bbc6851000000001
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/json;charset=iso-8859-1
x-xss-protection: 1; mode=block
cache-control: no-cache
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-ray: 62ab34c69e9605bb-FRA
expires: -1

GET
H2 200 me Show response
js.maxmind.com/geoip/v2.1/country/ 771 B
1 KB 90ms
67ms XHR
application/vnd.maxmind.com-country+json 2606:4700::6810:262f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.maxmind.com/geoip/v2.1/country/me?referrer=https%3A%2F%2Fwww.fireeye.com
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:262f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 64eeca223bd8f3fb9a22d9f6c43548ebdcd69860225972625aadb8700f1081e9

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 12:46:13 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: application/vnd.maxmind.com-country+json; charset=UTF-8; version=2.1
access-control-allow-origin: *
cf-ray: 62ab34c6cc6e16ea-FRA
content-length: 771
cf-request-id: 089edf503c000016ea620dc000000001

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 4 KB
2 KB 50ms
11ms Script
application/x-javascript 2a02:26f0:6c00:28c::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:28c::25ea Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 5f3b103a1268f862a5e432d607f8e5220dea9d301d13565b0ecded3ad9c25ab2

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 04 Mar 2021 12:46:13 GMT
Content-Encoding: gzip
Last-Modified: Mon, 04 Jan 2021 22:14:03 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
X-Check-Cacheable: YES
Cache-Control: max-age=24262
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1855

GET
H2 200 bat.js Show response
bat.bing.com/ 28 KB
9 KB 57ms
31ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: bbb4cc2dcde1b446e1e944793a5cb11ff8dcec18fd942a49d6161c6750daf396

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 12:46:13 GMT
content-encoding: gzip
last-modified: Tue, 02 Mar 2021 07:20:28 GMT
x-msedge-ref: Ref A: 02A83866544B474A807554F66DBAEC7C Ref B: FRAEDGE1512 Ref C: 2021-03-04T12:46:13Z
etag: "0464f8534fd71:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 8592

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 104ms
33ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4cf52cc73734aa71f26f6a10be9aeec89602af45bf0f9abd5c8445a076c1ae1a

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 12:46:13 GMT
via: 1.1 varnish
last-modified: Fri, 04 Dec 2020 00:21:46 GMT
age: 46039
etag: "cbc512946c8abb461c6215ed5b454e5f+gzip"
vary: Accept-Encoding,Host
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-encoding: gzip
cache-control: no-cache
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 1957
x-timer: S1614861974.753201,VS0,VE0
x-served-by: cache-fra19160-FRA

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 32 KB
13 KB 124ms
43ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

0fadbe1e06ca947cfe99260be96d47e427e047adb36abc1569b6650969de845c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 12:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12508
x-xss-protection: 0
server: cafe
etag: 14827443887830809553
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 04 Mar 2021 12:46:13 GMT

GET
H3-Q050

200

activityi;dc_pre=CPvcvNLVlu8CFZC61QodW9YI9g;src=8443343;type=sitew0;cat=firee0;ord=7330328966427;gtm=2wg2o0;auiddc=1630147819.1614861974;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F... Show response
8443343.fls.doubleclick.net/ Frame 7276
Redirect Chain

https://8443343.fls.doubleclick.net/activityi;src=8443343;type=sitew0;cat=firee0;ord=7330328966427;gtm=2wg2o0;auiddc=1630147819.1614861974;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%...
https://8443343.fls.doubleclick.net/activityi;dc_pre=CPvcvNLVlu8CFZC61QodW9YI9g;src=8443343;type=sitew0;cat=firee0;ord=7330328966427;gtm=2wg2o0;auiddc=1630147819.1614861974;u1=https%3A%2F%2Fwww.fir...

814 B
1 KB

121ms
70ms

Document
text/html

142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8443343.fls.doubleclick.net/activityi;dc_pre=CPvcvNLVlu8CFZC61QodW9YI9g;src=8443343;type=sitew0;cat=firee0;ord=7330328966427;gtm=2wg2o0;auiddc=1630147819.1614861974;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html;u2=Cyber%20Criminals%20Exploit%20Accellion%20FTA%20for%20Data%20Theft%20and%20Extortion%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f6.1e100.net

Software

cafe /

Resource Hash

9ea676fe4ccc25f0dbbdf6ac9e58070d359b1c692a93f3647c53807a421f64ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 8443343.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CPvcvNLVlu8CFZC61QodW9YI9g;src=8443343;type=sitew0;cat=firee0;ord=7330328966427;gtm=2wg2o0;auiddc=1630147819.1614861974;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html;u2=Cyber%20Criminals%20Exploit%20Accellion%20FTA%20for%20Data%20Theft%20and%20Extortion%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fireeye.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: about:blank

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Thu, 04 Mar 2021 12:46:13 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 505
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 04-Mar-2021 13:01:13 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Thu, 04 Mar 2021 12:46:13 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://8443343.fls.doubleclick.net/activityi;dc_pre=CPvcvNLVlu8CFZC61QodW9YI9g;src=8443343;type=sitew0;cat=firee0;ord=7330328966427;gtm=2wg2o0;auiddc=1630147819.1614861974;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html;u2=Cyber%20Criminals%20Exploit%20Accellion%20FTA%20for%20Data%20Theft%20and%20Extortion%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 91 KB
23 KB 17ms
1ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9e7ea2b4ba8e2bcc4a964d6192e4671dc5f6863a1c7e35b52b229a3c1e67a68d

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 23762
x-fb-rlafr: 0
pragma: public
x-fb-debug: cvN0VZnus9x5lxFtYmR6qD7c4FdLxF7Rkh6yioraM35rjOxDQK7RUGWb1EdifbK1vgyzT+6+8GGG2fcsmOA0pQ==
x-fb-trip-id: 686109401
x-frame-options: DENY
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Thu, 04 Mar 2021 12:46:13 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"group":"coop_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}, {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
origin-trial: AqUfQvNe9Mod+kZ3Qx78GGg2ul4TtHv3l126BaOQCbywgYxRUP0y9rs8/el96V62SmT7ue9StD9aXvYmT3UAAQcAAAB5eyJvcmlnaW4iOiJodHRwczovL2ZhY2Vib29rLmNvbTo0NDMiLCJmZWF0dXJlIjoiQ3Jvc3NPcmlnaW5PcGVuZXJQb2xpY3lSZXBvcnRpbmciLCJleHBpcnkiOjE2MTM0MTE1NzMsImlzU3ViZG9tYWluIjp0cnVlfQ==
cross-origin-opener-policy-report-only: same-origin-allow-popups;report-to="coop_report"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 114ms
32ms Script
application/x-javascript 23.79.148.198
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.79.148.198 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-79-148-198.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 04 Mar 2021 12:46:13 GMT
Content-Encoding: gzip
Last-Modified: Wed, 05 Aug 2020 03:11:00 GMT
Server: AkamaiNetStorage
ETag: "a67ed8ce0a86706b9f73a86806ce5bd3:1596597060.25158"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 752

GET
H2 200 jukebox.js Show response
app.cdn.lookbookhq.com/production/jukebox/current/ 699 KB
192 KB 119ms
37ms Script
text/javascript 13.32.24.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://app.cdn.lookbookhq.com/production/jukebox/current/jukebox.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.102 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-102.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 92168f9c582b93d5be39f76128f2f1bb1bc99f299d6b86a3c43bba56531ab6be

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
last-modified: Wed, 03 Mar 2021 03:35:20 GMT
server: AmazonS3
age: 33044
etag: W/"3eb04cc6a902fa7e46203de5e080bc34"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
via: 1.1 0a4e8f7c3d348e526848328c55dd452b.cloudfront.net (CloudFront)
cache-control: max-age=43200
date: Thu, 04 Mar 2021 03:38:07 GMT
x-amz-cf-pop: FRA56-C2
x-amz-cf-id: idp04DKU1IbwGCERQSOCnvHGovze5LOacMqB_Vep_1_uNLPBB_O5NA==

GET
H2 200 loop.bundle.js Show response
v2.listenloop.com/ 175 KB
57 KB 64ms
25ms Script
application/javascript 2606:4700:3036::ac43:dfcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://v2.listenloop.com/loop.bundle.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:dfcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ec6c227c1ada277214116eaef4c092b26a3b33cf6427ec2a370788a7505094f7

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 12:46:13 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"max_age":604800,"report_to":"cf-nel"}
age: 5529
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 2SZ7T5B2EP1R7Z8X
x-amz-id-2: 79rt1RjzEidRyZFSR4RkGH4TvIyClOAAOXW/rO1oztq/Ldh76BZmjLU6V26g+64ZOWxCfoWbRws=
last-modified: Thu, 04 Mar 2021 09:09:33 GMT
server: cloudflare
etag: W/"eeb225696e9180cf7f3f182937f973d8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=bFAxKV3VFuoc6RkqjOtwZTlZaQdKLthcXRNM4jzMcO9wV3lSaYbwuo0pezYuVH24UXYyN520JO4R37HgmwRCd48r8I1rmrKymznFf3DMUoWX07IP9QmAx50OdWF2Vw%3D%3D"}],"max_age":604800}
content-type: application/javascript
cache-control: max-age=1800
cf-request-id: 089edf50eb0000dff3d99a4000000001
cf-ray: 62ab34c7d867dff3-FRA

GET
H2 200 wm3vc3smix6y.js Show response
js.driftt.com/include/1614862200000/ 204 KB
59 KB 238ms
151ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1614862200000/wm3vc3smix6y.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

f860c06834d62704936c27cf6437bf5ea3ed1500eccdf037012e353a22fd6c7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: khcmmNvYoni08RW9CugdLVGj594DddX5
content-encoding: gzip
etag: W/"6bcc834fc71b42e447ea56d220f18d2f"
x-amz-cf-pop: FRA2-C1
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 03 Mar 2021 17:58:25 GMT
server: nginx
date: Thu, 04 Mar 2021 12:46:13 GMT
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: N45P7EAWLV20Xbav6APFXySKzPKDbiDFQ3vF6yXcPWLITK1bhmAabw==

GET
H/1.1

200
OK

/
attr.ml-api.io/
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dfireeye.com%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dfireeye.com%26pId%3d%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dfireeye.com%2526pId%253d%2524UID
https://attr.ml-api.io/?domain=fireeye.com&pId=8878082128330056446

4 B
485 B

436ms
342ms

Image
image/jpeg

65.9.58.81
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=fireeye.com&pId=8878082128330056446
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.58.81 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 04 Mar 2021 12:46:15 GMT
Via: 1.1 120ade321ed0e3697c81eb1eb19b5f62.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-C1
x-amzn-RequestId: f4332b05-d3eb-469f-bd2f-4b597bafb592
X-Cache: Miss from cloudfront
Content-Type: image/jpeg
X-Amzn-Trace-Id: Root=1-6040d697-4d2f8d9149662986439080e5;Sampled=0
Connection: keep-alive
x-amz-apigw-id: bqZ3nG6vIAMFj2g=
Content-Length: 4
X-Amz-Cf-Id: 1yQJ2i90CIAs2Bo3g5rBjfF5hpfCblMEc6iRx80dfnjjvPnhLf_HzA==

Redirect headers

Pragma: no-cache
Date: Thu, 04 Mar 2021 12:46:14 GMT
X-Proxy-Origin: 82.102.20.235; 82.102.20.235; 730.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.144:80
AN-X-Request-Uuid: 0af2c94e-9d82-460f-9106-2561734be701
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://attr.ml-api.io/?domain=fireeye.com&pId=8878082128330056446
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 46 KB
19 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 05 Feb 2021 21:33:27 GMT
server: Golfe2
age: 3536
date: Thu, 04 Mar 2021 11:47:17 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18980
expires: Thu, 04 Mar 2021 13:47:17 GMT

GET
H2 200 lftracker_v1_3P1w24dgrmJ7mY5n.js Show response
lftracker.leadfeeder.com/ 18 KB
7 KB 116ms
35ms Script
application/javascript 65.9.58.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://lftracker.leadfeeder.com/lftracker_v1_3P1w24dgrmJ7mY5n.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.58.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a965f26b036c4084eec09f133dd99f5c1755015cc4b473fc4ec4c43c10d13acc

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: n0gB1oI3z4FTqA5GVRV4Vx_dCIxl2cdt
content-encoding: gzip
last-modified: Thu, 11 Feb 2021 14:20:25 GMT
server: AmazonS3
age: 1367
etag: W/"f752102374752b539b49c27afd59a7d0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 e39402e2cf62b31f7774452c905f38f3.cloudfront.net (CloudFront)
cache-control: max-age=3600
date: Thu, 04 Mar 2021 12:23:27 GMT
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: kcqGStv2v_jgsp1Iz-s7xDTVIH-k_Sn0glyh19rL-9y4N_J_67sxqw==

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f20b7aacff69fbfc6fc0aaff9220bab48d3ce87c45bd077fea61e5d9e7662c2c

Request headers

Origin: https://www.fireeye.com
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

GET
H2 200 fireicons.woff
www.fireeye.com/content/dam/fireeye-www/fw/f/ 72 KB
36 KB 21ms
21ms Font
application/x-font-woff 2606:4700:300b::a29f:f67d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/content/dam/fireeye-www/fw/f/fireicons.woff?mva1rk

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw-2019.min.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1de5a2b057fc1fd85e8b3ccffa91101c8304a88b32fccb33e19d7657a1460dae

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Origin: https://www.fireeye.com
Referer: https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw-2019.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Thu, 04 Mar 2021 12:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 37496
x-vhost: publish
vary: Accept-Encoding,User-Agent
content-length: 36804
cf-request-id: 089edf515e000005bbb6ab7000000001
last-modified: Tue, 24 Sep 2019 21:47:18 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-font-woff
x-xss-protection: 1; mode=block
cache-control: public, max-age=691200
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 62ab34c899a405bb-FRA
expires: Fri, 12 Mar 2021 12:46:13 GMT

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&time=1614861973888&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extort...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D6572%26time%3D1614861973888%26url%3Dhttps%253A%252F%252Fwww.fireeye.com%252Fblog%...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&time=1614861973888&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extort...

0
57 B

141ms
141ms

Image
application/javascript

2620:119:50e3:101::6cae:b45
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&time=1614861973888&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html&liSync=true
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:119:50e3:101::6cae:b45 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 12:46:14 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-ltx1
x-li-proto: http/2
x-li-pop: prod-eda6
content-type: application/javascript
content-length: 0
x-li-uuid: ciAJA2kkaRZAW9hzbCsAAA==

Redirect headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
linkedin-action: 1
content-length: 0
x-li-uuid: uv1m9GgkaRYQLuvomCsAAA==
pragma: no-cache
x-li-pop: afd-prod-ltx1
x-msedge-ref: Ref A: 3EF7AADE462449D2AB7A047E35111090 Ref B: FRAEDGE0922 Ref C: 2021-03-04T12:46:14Z
date: Thu, 04 Mar 2021 12:46:14 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
x-frame-options: sameorigin
x-li-fabric: prod-ltx1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&time=1614861973888&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html&liSync=true
cache-control: no-cache, no-store
content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 204 0 Show response
g.microsoft.com/clarity/ 0
356 B 170ms
47ms Script
text/plain 52.142.114.176
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.microsoft.com/clarity/0?test=1&ti=5870833
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.142.114.176 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Origin: https://www.fireeye.com
Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Thu, 04 Mar 2021 12:46:13 GMT
cache-control: no-cache, must-revalidate
server: Microsoft-IIS/10.0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 313630683245423 Show response
connect.facebook.net/signals/config/ 241 KB
69 KB 17ms
16ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/313630683245423?v=2.9.33&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

561b79715e1ae709c1e4a028d11fed5ef303dd59e9449955aed54b5f55f87e06

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 70607
x-fb-rlafr: 0
pragma: public
x-fb-debug: LkVs3TEJfOYh8z/ycDOUBvFbDzkebyLoAgppyfcSmqm+rJg36vUNYqM8fHIsQ0w+zN8VMsMyc+R0QQz3m/bd0g==
x-fb-trip-id: 686109401
x-frame-options: DENY
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Thu, 04 Mar 2021 12:46:13 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
DATA 200
OK truncated
/ 5 KB
5 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1c7c6cbe8b5beb7e138cfcc8f6301d21b35437e5559be7afd0afe3f536d5fc02

Request headers

Origin: https://www.fireeye.com
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 2 B
388 B 53ms
13ms XHR
text/plain 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j88&a=968746142&t=pageview&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html&ul=en-us&de=UTF-8&dt=Cyber%20Criminals%20Exploit%20Accellion%20FTA%20for%20Data%20Theft%20and%20Extortion%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=108604611&gjid=93392245&cid=668634536.1614861974&tid=UA-363943-1&_gid=1352279183.1614861974&_r=1&gtm=2wg2o0MVGC8KK&cd39=668634536.1614861974&z=377870685

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 04 Mar 2021 12:46:14 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.fireeye.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/968899429/ 2 KB
1 KB 24ms
22ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/968899429/?random=1614861974018&cv=9&fst=1614861974018&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg2o0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html&tiba=Cyber%20Criminals%20Exploit%20Accellion%20FTA%20for%20Data%20Theft%20and%20Extortion%20%7C%20FireEye%20Inc&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0ee4b65b9b48a7df2e164fa20a74dc412fe4e439751a24aa5b4eb44f0dc7a141

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Mar 2021 12:46:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1101
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 init
jukebox.pathfactory.com/api/public/v1/ Frame 0
0 356ms
122ms Preflight
text/plain 34.194.181.251
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jukebox.pathfactory.com/api/public/v1/init?clientId=LB-9AC90F09-10427&image=https%3A%2F%2Fwww.fireeye.com%2Fcontent%2Fdam%2Ffireeye-www%2Ffw%2Fimages%2Ffireeye-2-color-square.png&title=Cyber%20Criminals%20Exploit%20Accellion%20FTA%20for%20Data%20Theft%20and%20Extortion&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html
Protocol: H2
Server: 34.194.181.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-194-181-251.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: https://www.fireeye.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Thu, 04 Mar 2021 12:46:14 GMT
content-type: text/plain
access-control-allow-origin: https://www.fireeye.com
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-expose-headers
access-control-max-age: 1728000
access-control-allow-credentials: true
access-control-allow-headers: content-type
content-encoding: gzip
vary: Accept-Encoding

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/ 28 KB
7 KB 32ms
12ms Stylesheet
text/css 2001:4de0:ac19::1:b:1a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:1a , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

Resource Hash

b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 12:46:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 12 Dec 2018 18:35:20 GMT
etag: "1544639720"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 6591

GET
H2 200 css
fonts.googleapis.com/ 4 KB
725 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

083be3c59862e11bbcda4128a12a7d9934f461ac881ed75af92b1c1b3615c576

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 04 Mar 2021 11:21:04 GMT
server: ESF
date: Thu, 04 Mar 2021 12:46:14 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 04 Mar 2021 12:46:14 GMT

GET
H2 200 init Show response
jukebox.pathfactory.com/api/public/v1/ 354 B
863 B 343ms
126ms XHR
application/json 34.194.181.251
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v1/init?clientId=LB-9AC90F09-10427&image=https%3A%2F%2Fwww.fireeye.com%2Fcontent%2Fdam%2Ffireeye-www%2Ffw%2Fimages%2Ffireeye-2-color-square.png&title=Cyber%20Criminals%20Exploit%20Accellion%20FTA%20for%20Data%20Theft%20and%20Extortion&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.194.181.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-194-181-251.compute-1.amazonaws.com

Software

Resource Hash

ddeec9dced8be575598e18285dac68896a44a1a39645c772ec6bebd284384067

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 04 Mar 2021 12:46:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-request-id: 8b415ba3-df6a-4832-b545-fcbd6c444b92
x-runtime: 0.015645
referrer-policy: no-referrer-when-downgrade
etag: W/"ddeec9dced8be575598e18285dac6889"
access-control-max-age: 1728000
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.fireeye.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true

GET
H2 200 /
www.facebook.com/tr/ 44 B
147 B 7ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=313630683245423&ev=PageView&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html&rl=&if=false&ts=1614861974337&sw=1600&sh=1200&v=2.9.33&r=stable&ec=0&o=30&fbp=fb.1.1614861974313.2040462067&it=1614861973920&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=GET

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 12:46:14 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Thu, 04 Mar 2021 12:46:14 GMT

GET
H2 200 adsct
t.co/i/ 43 B
449 B 250ms
162ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0&txn_id=nw2v7&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 12:46:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 113
pragma: no-cache
last-modified: Thu, 04 Mar 2021 12:46:14 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 5feb70ee5f52d3be9f710b75d727dcfb
x-transaction: 0016915d00513845
expires: Tue, 31 Mar 1981 05:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
90 B 17ms
16ms XHR
text/plain 2a00:1450:400c:c1b::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j88&tid=UA-363943-1&cid=668634536.1614861974&jid=108604611&gjid=93392245&_gid=1352279183.1614861974&_u=YEBAAEAAAAAAAC~&z=1175326091

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c1b::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 04 Mar 2021 12:46:14 GMT
content-type: text/plain
access-control-allow-origin: https://www.fireeye.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK me Show response
abm2.listenloop.com/api/v1/public/organizations/ 574 B
1 KB 466ms
113ms XHR
application/json 54.85.197.191
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://abm2.listenloop.com/api/v1/public/organizations/me?public_key=MRxJc5qdz5T-wKxBNsh4
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.85.197.191 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-197-191.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 56bf97572cc7de5a19131a062e5e0e64ffa38dc71e87cdfa7c0e481e15f2d628

Request headers

Accept: */*
Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Runtime: 0.005148
Date: Thu, 04 Mar 2021 12:46:14 GMT
Content-Encoding: gzip
Server: nginx
ETag: W/"f5412232fb319fe468a4c8d2e590d241"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, POST, DELETE, PUT, PATCH, OPTIONS, HEAD
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.fireeye.com
Cache-Control: max-age=0, private, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Access-Control-Request-Headers,X-User-Token,X-User-email,content-type,X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset,Authorization
Content-Length: 361
X-Request-Id: 328461b7-0641-40f1-be3a-b8ae79558545

POST
H/1.1 200
OK retargeting_segments Show response
abm2.listenloop.com/api/v1/public/ 27 B
774 B 457ms
114ms XHR
application/json 54.85.197.191
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://abm2.listenloop.com/api/v1/public/retargeting_segments
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.85.197.191 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-197-191.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1cddcd88d3332d560856627ab2cecc7d9aa6c9d616729701ae13902d1671d0b0

Request headers

Accept: */*
Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

X-Runtime: 0.005772
Date: Thu, 04 Mar 2021 12:46:14 GMT
Content-Encoding: gzip
Server: nginx
ETag: W/"60f61ddcfe8d9aeefd8f0952e8147370"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, POST, DELETE, PUT, PATCH, OPTIONS, HEAD
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.fireeye.com
Cache-Control: max-age=0, private, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Access-Control-Request-Headers,X-User-Token,X-User-email,content-type,X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset,Authorization
Content-Length: 53
X-Request-Id: a704e74d-50f5-417f-886b-e8ea82b47c46

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 18ms
17ms Image
image/gif 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-363943-1&cid=668634536.1614861974&jid=108604611&_u=YEBAAEAAAAAAAC~&z=626892749

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Mar 2021 12:46:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 19ms
18ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-363943-1&cid=668634536.1614861974&jid=108604611&_u=YEBAAEAAAAAAAC~&z=626892749

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Mar 2021 12:46:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/968899429/ 42 B
108 B 21ms
20ms Image
image/gif 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/968899429/?random=1614861974018&cv=9&fst=1614859200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg2o0&sendb=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html&tiba=Cyber%20Criminals%20Exploit%20Accellion%20FTA%20for%20Data%20Theft%20and%20Extortion%20%7C%20FireEye%20Inc&async=1&fmt=3&is_vtc=1&random=305787427&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Mar 2021 12:46:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/968899429/ 42 B
108 B 21ms
20ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/968899429/?random=1614861974018&cv=9&fst=1614859200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg2o0&sendb=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html&tiba=Cyber%20Criminals%20Exploit%20Accellion%20FTA%20for%20Data%20Theft%20and%20Extortion%20%7C%20FireEye%20Inc&async=1&fmt=3&is_vtc=1&random=305787427&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Mar 2021 12:46:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pre=CPvcvNLVlu8CFZC61QodW9YI9g;src=8443343;type=sitew0;cat=firee0;ord=7330328966427;gtm=2wg2o0;auiddc=1630147819.1614861974;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%... Show response
adservice.google.com/ddm/fls/i/ Frame 5AD0 813 B
979 B 67ms
42ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/i/dc_pre=CPvcvNLVlu8CFZC61QodW9YI9g;src=8443343;type=sitew0;cat=firee0;ord=7330328966427;gtm=2wg2o0;auiddc=1630147819.1614861974;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html;u2=Cyber%20Criminals%20Exploit%20Accellion%20FTA%20for%20Data%20Theft%20and%20Extortion%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html

Requested by

Host: 8443343.fls.doubleclick.net
URL: https://8443343.fls.doubleclick.net/activityi;dc_pre=CPvcvNLVlu8CFZC61QodW9YI9g;src=8443343;type=sitew0;cat=firee0;ord=7330328966427;gtm=2wg2o0;auiddc=1630147819.1614861974;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html;u2=Cyber%20Criminals%20Exploit%20Accellion%20FTA%20for%20Data%20Theft%20and%20Extortion%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bb14942536ec7dcd2374fce90c6f5d1b61d2ae0122d3a1c23bf80a3e65092b8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: adservice.google.com
:scheme: https
:path: /ddm/fls/i/dc_pre=CPvcvNLVlu8CFZC61QodW9YI9g;src=8443343;type=sitew0;cat=firee0;ord=7330328966427;gtm=2wg2o0;auiddc=1630147819.1614861974;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html;u2=Cyber%20Criminals%20Exploit%20Accellion%20FTA%20for%20Data%20Theft%20and%20Extortion%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8443343.fls.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://8443343.fls.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Thu, 04 Mar 2021 12:46:14 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 506
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ac8511a575f9ff43c005f8be9f0fb7b81b8aebf2fd2e1df8df7809df4b77cc07

Request headers

Origin: https://www.fireeye.com
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7d6fd646e0efeb5d1209c2d9008343cb061cc7d70408fbd108f683dbc4d17fa8

Request headers

Origin: https://www.fireeye.com
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9b935949913b686e1e44928fb476ad5611303afc06e844ff620f59370d9c77bd

Request headers

Origin: https://www.fireeye.com
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 18 KB
18 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3091b6187cdf72d32615fd3df8c882e3cf6ca0f3e8b010d5f4f937ab2d619d94

Request headers

Origin: https://www.fireeye.com
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 4 KB
4 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b701db4813b82b18ad7f0db593b1dcc5c435f7be396ef3a937f8ed1ec7b343d

Request headers

Origin: https://www.fireeye.com
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 4 KB
4 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: aeb54739ad664ca0dde2785d1a4c64495b8d91e7eee6ab4d7788769655746f88

Request headers

Origin: https://www.fireeye.com
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 5 KB
5 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 325788f630aa3ff90d75e60d764ebba3adf2d304671b57e327fe3801bbdad9de

Request headers

Origin: https://www.fireeye.com
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 5 KB
5 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0e28cd255cac05ac63cb7b021b9436cbf1bd24b34218edefc7b9675bbcb6dec7

Request headers

Origin: https://www.fireeye.com
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

GET
H2 200 getForm Show response
www2.fireeye.com/index.php/form/ 8 KB
3 KB 604ms
602ms Script
application/javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/index.php/form/getForm?munchkinId=848-DID-242&form=3353&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html&callback=jQuery1124001452493434199953_1614861974813&_=1614861974814

Requested by

Host: www2.fireeye.com
URL: https://www2.fireeye.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3f05c4e7ede408c51e0eb199f9faa8e96d65b20d7c912620cbc9e6638ac2ad56

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 12:46:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cached: false
cf-ray: 62ab34ced9f81d02-CPH
cf-request-id: 089edf554c00001d0208a01000000001

GET
H2 200 moatframe.js Show response
z.moatads.com/addthismoatframe568911941483/ 2 KB
1 KB 35ms
33ms Script
application/x-javascript 184.30.21.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-21-162.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 12:46:15 GMT
content-encoding: gzip
last-modified: Fri, 08 Nov 2019 20:13:52 GMT
server: AmazonS3
x-amz-request-id: B402EDC6F7271ED7
etag: "f14b4e1f799b14f798a195f43cf58376"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=9800
accept-ranges: bytes
content-length: 948
x-amz-id-2: 3ZiQcYtRTuh4WJ4BUq+mWoVqgQk4EdHwIkUrSZre2GxPFo/4IUZsv5aBqLknQUvSl0wjR3iM+HQ=

GET
H2 200 me Show response
js.maxmind.com/geoip/v2.1/country/ 771 B
979 B 58ms
58ms XHR
application/vnd.maxmind.com-country+json 2606:4700::6810:262f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.maxmind.com/geoip/v2.1/country/me?referrer=https%3A%2F%2Fwww.fireeye.com
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:262f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eb65531710810f4faff6e7a2e8e0ef1eeff7134b3f1acf6f9eab6954928add3e

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 12:46:15 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: application/vnd.maxmind.com-country+json; charset=UTF-8; version=2.1
access-control-allow-origin: *
cf-ray: 62ab34d01e6016ea-FRA
content-length: 771
cf-request-id: 089edf560b000016eaf6ac3000000001

GET
H2 200 segmentation.segment.js Show response
www.fireeye.com/etc/ 0
147 B 710ms
710ms XHR
application/x-javascript 2606:4700:300b::a29f:f67d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/segmentation.segment.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Thu, 04 Mar 2021 12:46:15 GMT
x-content-type-options: nosniff, nosniff
cf-cache-status: MISS
x-vhost: publish
vary: User-Agent, Accept-Encoding
content-length: 0
cf-request-id: 089edf561d000005bbb6b09000000001
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "d41d8cd98f00b204e9800998ecf8427e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-xss-protection: 1; mode=block
cache-control: public, max-age=691200
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 62ab34d02e2305bb-FRA
expires: Fri, 12 Mar 2021 12:46:15 GMT

GET
H2 403 stores.init.js Show response
www.fireeye.com/etc/clientcontext/default/content/jcr:content/ 3 KB
1 KB 18ms
15ms XHR
text/html 2606:4700:300b::a29f:f67d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/clientcontext/default/content/jcr:content/stores.init.js?path=%2Fcontent%2Ffireeye-www%2Fen_US%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion&_=1614861973531

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7890a581466568a8c35161d8ef506e5b89ee96de3f9fa1a236282d2b2d21d849

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 12:46:15 GMT
content-encoding: gzip
vary: Accept-Encoding
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 62ab34d02e2405bb-FRA
cf-request-id: 089edf561d000005bb74b76000000001
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/159/ 11 KB
5 KB 40ms
39ms Script
application/x-javascript 23.79.148.198
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/159/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.79.148.198 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-79-148-198.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 04 Mar 2021 12:46:15 GMT
Content-Encoding: gzip
Last-Modified: Fri, 08 May 2020 02:24:14 GMT
Server: AkamaiNetStorage
ETag: "79274ffc293e4f76fc372b953f780d16:1588904654.430334"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4810
Expires: Sat, 12 Jun 2021 12:46:15 GMT

GET
H2 200 read-blogentries Show response
www.fireeye.com/bin/www-blogs/ 100 KB
18 KB 1104ms
1101ms XHR
text/plain 2606:4700:300b::a29f:f67d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/bin/www-blogs/read-blogentries?categoryPath=%2Fcontent%2Ffireeye-www%2Fen_US%2Fblog%2Fthreat-research

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

45ca09e03879a2cb24fa5ac0a5ab4b783745dd5a7cb6094ce83ce6d12fc2cf70

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Thu, 04 Mar 2021 12:46:16 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: DYNAMIC
x-vhost: publish
vary: Accept-Encoding,User-Agent
content-length: 17828
x-xss-protection: 1; mode=block
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-request-id: 089edf5626000005bbce087000000001
cf-ray: 62ab34d03e3305bb-FRA

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
652 B 262ms
157ms Script
application/javascript 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0&txn_id=nw2v7&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 12:46:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 116
pragma: no-cache
last-modified: Thu, 04 Mar 2021 12:46:16 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 6bca97da9754d854b7405a822f3873ae
x-transaction: 006e6a7300657d09
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1 200
OK MultiNoun.jsonp Show response
d.la2c2.salesforceliveagent.com/chat/rest/System/ 226 B
590 B 547ms
133ms Script
text/javascript 13.108.248.7
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://d.la2c2.salesforceliveagent.com/chat/rest/System/MultiNoun.jsonp?nouns=VisitorId,Settings&VisitorId.prefix=Visitor&Settings.prefix=Visitor&Settings.buttonIds=[573a00000008kP3]&Settings.updateBreadcrumb=1&Settings.urlPrefix=undefined&callback=liveagent._.handlePing&deployment_id=572a0000000H8aJ&org_id=00D3000000063LS&version=34

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.108.248.7 , United States, ASN14340 (SALESFORCE, US),

Reverse DNS

dcl1-ord.la1-c2-ord.salesforceliveagent.com

Software

Resource Hash

f07f057501bc4abe6b55685f023eaf5e74dc8cc33a74339e273e224b3a05baf3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: close
Expires: -1

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/fewebadmin/ 4 KB
1 KB 219ms
218ms Script
application/javascript 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/fewebadmin/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.75.88.112 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-112.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 5cd804ec7036cddeb6403cd02cb908ebc248fe66e865dfc205df718463e3167c

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 12:46:16 GMT
content-encoding: gzip
etag: -1477460652--gzip
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: public, max-age=60, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-length: 899

POST
H2 200 /
www.facebook.com/tr/ 0
72 B 21ms
21ms Other
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryHxOrT8Lq9PijEte5

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Thu, 04 Mar 2021 12:46:16 GMT
content-type: text/plain
access-control-allow-origin: https://www.fireeye.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0

GET
H2 204 0
bat.bing.com/action/ 0
171 B 30ms
29ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=5870833&tm=gtm001&Ver=2&mid=aa2cf815-5722-4f4d-8d3e-1966437d3bff&sid=9c2287807ce711ebab3f01bf9845adc6&vid=9c2999807ce711eba7c6ebd99cc6f2ff&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Cyber%20Criminals%20Exploit%20Accellion%20FTA%20for%20Data%20Theft%20and%20Extortion%20%7C%20FireEye%20Inc&p=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html&r=&lt=3711&evt=pageLoad&msclkid=N&sv=1&rn=5439
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Thu, 04 Mar 2021 12:46:16 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: 19B0D32B77B9451C84E678086D3ECB7C Ref B: FRAEDGE1512 Ref C: 2021-03-04T12:46:16Z
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

associate-segment
segment.prod.bidr.io/
Redirect Chain

https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=
https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=&_bee_ppp=1

43 B
793 B

60ms
54ms

Image
image/gif

54.155.47.148
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=&_bee_ppp=1

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.155.47.148 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-155-47-148.eu-west-1.compute.amazonaws.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
Date: Thu, 04 Mar 2021 12:46:16 GMT
Server: nginx
strict-transport-security: max-age=2592000; includeSubDomains
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
content-type: image/gif
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=&_bee_ppp=1
Date: Thu, 04 Mar 2021 12:46:16 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
strict-transport-security: max-age=2592000; includeSubDomains

OPTIONS
H2 200 website_experience
jukebox.pathfactory.com/api/public/v1/ Frame 0
0 111ms
111ms Preflight
text/plain 34.194.181.251
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jukebox.pathfactory.com/api/public/v1/website_experience?clientId=LB-9AC90F09-10427&visitorUuid=0b9bd797-16e2-485d-bd22-06ce1f62be48&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html
Protocol: H2
Server: 34.194.181.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-194-181-251.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: https://www.fireeye.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Thu, 04 Mar 2021 12:46:16 GMT
content-type: text/plain
access-control-allow-origin: https://www.fireeye.com
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-expose-headers
access-control-max-age: 1728000
access-control-allow-credentials: true
access-control-allow-headers: content-type
content-encoding: gzip
vary: Accept-Encoding

GET
H2 200 sp.js Show response
cdnjs.cloudflare.com/ajax/libs/snowplow/2.16.2/ 77 KB
24 KB 15ms
14ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/snowplow/2.16.2/sp.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e791cea0b4e689b8d862850ce773d23b07402255ace1c27e1a55e90cccd88f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 12:46:16 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"max_age":604800,"report_to":"cf-nel"}
age: 3686309
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 23741
cf-request-id: 089edf5b7f00004e37d0877000000001
timing-allow-origin: *
last-modified: Mon, 19 Oct 2020 20:35:00 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f8df874-134e9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=EWdZzRWNY88KDluV9t3mURfg7z16S%2Fr3RyAsmXzc9UuZxlQdIPsZ%2Flx9iqLyypEtq6dSM7KiWOSQAdZK8RjxFUL7uY85jdif2eKddM8zZkGhSzbk6w8KylNS5lW681%2B4hQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 62ab34d8c90e4e37-FRA
expires: Tue, 22 Feb 2022 12:46:16 GMT

GET
H2 200 website_experience Show response
jukebox.pathfactory.com/api/public/v1/ 3 KB
2 KB 161ms
152ms XHR
application/json 34.194.181.251
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v1/website_experience?clientId=LB-9AC90F09-10427&visitorUuid=0b9bd797-16e2-485d-bd22-06ce1f62be48&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.194.181.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-194-181-251.compute-1.amazonaws.com

Software

Resource Hash

d296982cdbe646ba29da5e0904939812bcf9e6f38dde316289112b780462352f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 04 Mar 2021 12:46:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-request-id: 723f7a1a-ff16-48f1-bd9c-e8275cd3b4bb
x-runtime: 0.048823
referrer-policy: no-referrer-when-downgrade
etag: W/"d296982cdbe646ba29da5e0904939812"
access-control-max-age: 1728000
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.fireeye.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true

GET
H2 200 conversion.js Show response
s.yimg.jp/images/listing/tool/cv/ 6 KB
2 KB 1366ms
280ms Script
application/javascript 182.22.24.252
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.yimg.jp/images/listing/tool/cv/conversion.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 182.22.24.252 , Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: ATS /
Resource Hash: 9e3a9103c80346b1b39bea3de46f44a462b3f594fa45e7206252bc41d7e3e855

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Thu, 04 Mar 2021 12:42:51 GMT
content-encoding: gzip
last-modified: Wed, 30 Sep 2020 06:06:44 GMT
server: ATS
age: 206
vary: Accept-Encoding
p3p: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
via: http/1.1 edge1344.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ]), http/1.1 edge1367.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ]), http/1.1 edge1353.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ])
cache-control: public, max-age=600
accept-ranges: bytes
content-type: application/javascript
content-length: 1997
expires: Thu, 04 Mar 2021 12:52:51 GMT

GET
H2 200 dc_pre=CPvcvNLVlu8CFZC61QodW9YI9g;src=8443343;type=sitew0;cat=firee0;ord=7330328966427;gtm=2wg2o0;auiddc=1630147819.1614861974;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%... Show response
adservice.google.de/ddm/fls/i/ Frame 8AE4 194 B
877 B 77ms
51ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/ddm/fls/i/dc_pre=CPvcvNLVlu8CFZC61QodW9YI9g;src=8443343;type=sitew0;cat=firee0;ord=7330328966427;gtm=2wg2o0;auiddc=1630147819.1614861974;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html;u2=Cyber%20Criminals%20Exploit%20Accellion%20FTA%20for%20Data%20Theft%20and%20Extortion%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html

Requested by

Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CPvcvNLVlu8CFZC61QodW9YI9g;src=8443343;type=sitew0;cat=firee0;ord=7330328966427;gtm=2wg2o0;auiddc=1630147819.1614861974;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html;u2=Cyber%20Criminals%20Exploit%20Accellion%20FTA%20for%20Data%20Theft%20and%20Extortion%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: adservice.google.de
:scheme: https
:path: /ddm/fls/i/dc_pre=CPvcvNLVlu8CFZC61QodW9YI9g;src=8443343;type=sitew0;cat=firee0;ord=7330328966427;gtm=2wg2o0;auiddc=1630147819.1614861974;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html;u2=Cyber%20Criminals%20Exploit%20Accellion%20FTA%20for%20Data%20Theft%20and%20Extortion%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://adservice.google.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://adservice.google.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Thu, 04 Mar 2021 12:46:16 GMT
expires: Thu, 04 Mar 2021 12:46:16 GMT
cache-control: private, max-age=0
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 177
x-xss-protection: 0
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

POST
H/1.1 200
OK page_views Show response
abm2.listenloop.com/api/v1/public/ 360 B
968 B 1890ms
1890ms XHR
application/json 54.85.197.191
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://abm2.listenloop.com/api/v1/public/page_views
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.85.197.191 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-197-191.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 524713cc2d4e2a28cfbc20d0285d0ff41253dfd756c5855cf8d01e92f7aec303

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

X-Runtime: 1.781505
Date: Thu, 04 Mar 2021 12:46:18 GMT
Content-Encoding: gzip
Server: nginx
ETag: W/"d859620e365b62e1e3f9ba385cbb0b2f"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, POST, DELETE, PUT, PATCH, OPTIONS, HEAD
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.fireeye.com
Cache-Control: max-age=0, private, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Access-Control-Request-Headers,X-User-Token,X-User-email,content-type,X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset,Authorization
Content-Length: 246
X-Request-Id: 661a6497-2415-46a3-9048-87d62600a6c8

OPTIONS
H/1.1 204
No Content page_views
abm2.listenloop.com/api/v1/public/ Frame 0
0 435ms
108ms Preflight 54.85.197.191
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://abm2.listenloop.com/api/v1/public/page_views
Protocol: HTTP/1.1
Server: 54.85.197.191 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-197-191.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://www.fireeye.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Access-Control-Request-Headers,X-User-Token,X-User-email,content-type,X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset,Authorization
Access-Control-Allow-Methods: GET, POST, DELETE, PUT, PATCH, OPTIONS, HEAD
Access-Control-Allow-Origin: https://www.fireeye.com
Date: Thu, 04 Mar 2021 12:46:16 GMT
Server: nginx
Connection: keep-alive

GET
H2 200 forms2.css
www2.fireeye.com/js/forms2/css/ 13 KB
3 KB 32ms
31ms Stylesheet
text/css 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/js/forms2/css/forms2.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 12:46:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2793
content-length: 2623
cf-request-id: 089edf5c1f00001d0206b44000000001
last-modified: Wed, 06 Jan 2021 21:16:41 GMT
server: cloudflare
etag: "301c47-3437-5b841d6e0e040"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 62ab34d9cd001d02-CPH
expires: Thu, 04 Mar 2021 16:46:16 GMT

GET
H2 200 forms2-theme-simple.css
www2.fireeye.com/js/forms2/css/ 826 B
437 B 30ms
29ms Stylesheet
text/css 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/js/forms2/css/forms2-theme-simple.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 12:46:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2793
content-length: 242
cf-request-id: 089edf5c2000001d0208ab4000000001
last-modified: Wed, 06 Jan 2021 21:16:41 GMT
server: cloudflare
etag: "301c4d-33a-5b841d6e0e040"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 62ab34d9cd021d02-CPH
expires: Thu, 04 Mar 2021 16:46:16 GMT

GET
H2 200 layers.fa6cd1947ce26e890d3d.js Show response
s7.addthis.com/static/ 263 KB
76 KB 40ms
40ms Script
application/javascript 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/layers.fa6cd1947ce26e890d3d.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Mon, 26 Oct 2020 18:11:48 GMT
server: nginx/1.15.8
etag: W/"5f971164-41cf5"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=86313600
date: Thu, 04 Mar 2021 12:46:16 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 77617

OPTIONS
H/1.1 200
OK tp2
spcollector.pathfactory.com/com.snowplowanalytics.snowplow/ Frame 0
0 460ms
112ms Preflight 52.204.168.112
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://spcollector.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Protocol: HTTP/1.1
Server: 52.204.168.112 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: akka-http/10.0.9 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://www.fireeye.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Origin: https://www.fireeye.com
Access-Control-Max-Age: 5
Date: Thu, 04 Mar 2021 12:46:17 GMT
Server: akka-http/10.0.9
Content-Length: 0
Connection: keep-alive

POST
H/1.1 200
OK tp2 Show response
spcollector.pathfactory.com/com.snowplowanalytics.snowplow/ 2 B
460 B 431ms
108ms XHR
text/plain 52.204.168.112
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://spcollector.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.168.112 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: akka-http/10.0.9 /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

Date: Thu, 04 Mar 2021 12:46:17 GMT
Server: akka-http/10.0.9
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Access-Control-Allow-Origin: https://www.fireeye.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/plain; charset=UTF-8
Content-Length: 2

POST
H2 200 tp2 Show response
jukebox.pathfactory.com/com.snowplowanalytics.snowplow/ 0
420 B 123ms
122ms XHR
text/html 34.194.181.251
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/com.snowplowanalytics.snowplow/tp2

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.194.181.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-194-181-251.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

x-runtime: 0.006797
date: Thu, 04 Mar 2021 12:46:16 GMT
content-encoding: gzip
referrer-policy: no-referrer-when-downgrade
vary: Origin, Accept-Encoding
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
content-type: text/html
access-control-allow-origin: https://www.fireeye.com
access-control-max-age: 1728000
cache-control: no-cache
access-control-allow-credentials: true
x-content-type-options: nosniff
x-request-id: fb3312e4-069f-4666-ad8f-be691594b6be
access-control-expose-headers

OPTIONS
H2 200 tp2
jukebox.pathfactory.com/com.snowplowanalytics.snowplow/ Frame 0
0 113ms
113ms Preflight
text/plain 34.194.181.251
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jukebox.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Protocol: H2
Server: 34.194.181.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-194-181-251.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://www.fireeye.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Thu, 04 Mar 2021 12:46:16 GMT
content-type: text/plain
access-control-allow-origin: https://www.fireeye.com
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-expose-headers
access-control-max-age: 1728000
access-control-allow-credentials: true
access-control-allow-headers: content-type
content-encoding: gzip
vary: Accept-Encoding

GET
H2 204 website_forms Show response
jukebox.pathfactory.com/api/public/v1/ 0
412 B 127ms
127ms XHR
text/plain 34.194.181.251
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v1/website_forms?clientId=LB-9AC90F09-10427&visitorUuid=0b9bd797-16e2-485d-bd22-06ce1f62be48&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.194.181.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-194-181-251.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

x-runtime: 0.015125
date: Thu, 04 Mar 2021 12:46:16 GMT
referrer-policy: no-referrer-when-downgrade
access-control-max-age: 1728000
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://www.fireeye.com
access-control-expose-headers
cache-control: no-cache
access-control-allow-credentials: true
vary: Origin
x-content-type-options: nosniff
x-request-id: 6473bf4b-1c39-4459-9a58-28ce06fdd99d

OPTIONS
H2 200 website_forms
jukebox.pathfactory.com/api/public/v1/ Frame 0
0 112ms
111ms Preflight
text/plain 34.194.181.251
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jukebox.pathfactory.com/api/public/v1/website_forms?clientId=LB-9AC90F09-10427&visitorUuid=0b9bd797-16e2-485d-bd22-06ce1f62be48&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html
Protocol: H2
Server: 34.194.181.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-194-181-251.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: https://www.fireeye.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Thu, 04 Mar 2021 12:46:16 GMT
content-type: text/plain
access-control-allow-origin: https://www.fireeye.com
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-expose-headers
access-control-max-age: 1728000
access-control-allow-credentials: true
access-control-allow-headers: content-type
content-encoding: gzip
vary: Accept-Encoding

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
121 B 8ms
8ms Image
image/gif 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j88&a=968746142&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html&ul=en-us&de=UTF-8&dt=Cyber%20Criminals%20Exploit%20Accellion%20FTA%20for%20Data%20Theft%20and%20Extortion%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Page%20views%20with%20form&ea=view&el=Form&_u=aEDAAEABAAAAAC~&jid=&gjid=&cid=668634536.1614861974&tid=UA-363943-1&_gid=1352279183.1614861974&gtm=2wg2o0MVGC8KK&cd3=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html&cd17=Form&cd18=3353&cd19=Cyber%20Criminals%20Exploit%20Accellion%20FTA%20for%20Data%20Theft%20and%20Extortion%20%7C%20FireEye%20Inc&z=600765396

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Mar 2021 12:30:16 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 960
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 XDFrame Show response
www2.fireeye.com/index.php/form/ Frame A200 2 KB
784 B 212ms
211ms Document
text/html 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/index.php/form/XDFrame

Requested by

Host: www2.fireeye.com
URL: https://www2.fireeye.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4ecd284b8811543e88f4c470ba7b3fe3f4b7a458c512bb92ab41d2b491aee6ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: www2.fireeye.com
:scheme: https
:path: /index.php/form/XDFrame
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fireeye.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cfduid=dc98b187838dbf7fec8c6df149d58890c1614861972; __cf_bm=d511cbb056d5a6694bb11d4f543db9d83a32653b-1614861973-1800-AXSb/zI28ap45uvZaZLl/2L8LZEByTkBxpAxFNdNOlBtXiONZ8rjkCF1yLp/4fXhpkXJuZRjET3sEwKJhOxfOag=; _gcl_au=1.1.1630147819.1614861974; _ga=GA1.2.668634536.1614861974; _gid=GA1.2.1352279183.1614861974; _gat_UA-363943-1=1; vid=0b9bd797-16e2-485d-bd22-06ce1f62be48; _fbp=fb.1.1614861974313.2040462067; BIGipServersjiweb-nginx-app_https=!o1BDyLPImDPqoanInuzRy4alk/3R/k5ksDZlj1bgj4nu5BSTRPzGjnbTHo2nTVxLxNYTteO2/C2ETsE=; _uetsid=9c2287807ce711ebab3f01bf9845adc6; _uetvid=9c2999807ce711eba7c6ebd99cc6f2ff; _pf_ses.81ef=*; _pf_id.81ef=0b9bd797-16e2-485d-bd22-06ce1f62be48.1614861977.1.1614861977.1614861977.91a52121-bba6-4366-83c8-65327f7900fa
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fireeye.com/

Response headers

date: Thu, 04 Mar 2021 12:46:17 GMT
content-type: text/html; charset=utf-8
cache-control: max-age=3600
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: DYNAMIC
cf-request-id: 089edf5d4b00001d02d61a0000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 62ab34dba97b1d02-CPH
content-encoding: gzip

GET
H/1.1 200
OK MultiNoun.jsonp Show response
d.la1-c1-ia5.salesforceliveagent.com/chat/rest/System/ 497 B
760 B 572ms
119ms Script
text/javascript 13.110.65.53
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://d.la1-c1-ia5.salesforceliveagent.com/chat/rest/System/MultiNoun.jsonp?nouns=VisitorId,Settings&VisitorId.prefix=Visitor&Settings.prefix=Visitor&Settings.buttonIds=[573a00000008kP3]&Settings.updateBreadcrumb=1&Settings.urlPrefix=undefined&callback=liveagent._.handlePing&deployment_id=572a0000000H8aJ&org_id=00D3000000063LS&version=34

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.110.65.53 , United States, ASN14340 (SALESFORCE, US),

Reverse DNS

dcl2-ncg1-c6-iad5.la1-c1-ia5.salesforceliveagent.com

Software

Resource Hash

5a02661584f317e632282f0bfb0c07211061a64296f51b771ea504471f4a47e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: close
Expires: -1

GET
H2 200 forms2.min.js Show response
www2.fireeye.com/js/forms2/js/ Frame A200 204 KB
68 KB 46ms
45ms Script
application/x-javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/js/forms2/js/forms2.min.js

Requested by

Host: www2.fireeye.com
URL: https://www2.fireeye.com/index.php/form/XDFrame

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

014de295141a456ceda8e3c4762085e53dca50f91ddf65906d227f70cf0b1a55

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www2.fireeye.com/index.php/form/XDFrame
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 12:46:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Sat, 16 Jan 2021 05:50:46 GMT
server: cloudflare
age: 3888
etag: "242465-33187-5b8fe11fd4b5e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 62ab34dd2ce21d02-CPH
cf-request-id: 089edf5e3900001d02dda7c000000001
expires: Thu, 04 Mar 2021 16:46:17 GMT

GET
H/1.1 200
OK /
b91.yahoo.co.jp/pagead/conversion/1000244663/ 42 B
948 B 945ms
374ms Image
image/gif 182.22.30.204
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b91.yahoo.co.jp/pagead/conversion/1000244663/?random=1614861977888&cv=9&fst=1614861977888&num=1&fmt=3&value=0&label=ppcGCKvb3mcQ_c2swgM&guid=ON&disvt=true&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html&tiba=Cyber%20Criminals%20Exploit%20Accellion%20FTA%20for%20Data%20Theft%20and%20Extortion%20%7C%20FireEye%20Inc&hn=www.googleadservices.com&async=1

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

182.22.30.204 , Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),

Reverse DNS

Software

ATS /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 04 Mar 2021 12:46:18 GMT
Via: http/1.1 mscedge1101.img.bbt.yahoo.co.jp (ApacheTrafficServer [c sSf ])
X-Content-Type-Options: nosniff
Server: ATS
Timing-Allow-Origin: *
Age: 0
P3P: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Cache-Control: no-cache, must-revalidate, private
Cross-Origin-Resource-Policy: cross-origin
Connection: close
Content-Type: image/gif
Content-Length: 42
X-XSS-Protection: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 15 KB
6 KB 26ms
7ms Script
application/javascript 2a00:1288:80:800::7001
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7001 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

63896532a7015ab5b7288359c02124980a5075e9267f0ba3fbfc7c3f5038b478

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Thu, 04 Mar 2021 12:24:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1324
x-amz-server-side-encryption: AES256
vary: Origin, Accept-Encoding
content-length: 5581
x-amz-id-2: HJMYU9njCOCm8h8aJtyO+5S4/RP9DuzR6MXB9hdoMMM48OVRog7aglyQiB4qeaXaj6GznL3Tg+0=
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Sat, 30 Oct 2021 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Thu, 24 Sep 2020 23:08:16 GMT
server: ATS
etag: "49db10c8315384e8dad2e92a6841ed81-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: VBET0AT7DDDKTQM0
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
x-amz-version-id: swANRqp_TdPZf97XDKuCKoVnrp7c.h.0
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 json Show response
fireeye.tt.omtrdc.net/m2/fireeye/mbox/ 676 B
726 B 297ms
54ms XHR
application/json 52.51.251.137
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fireeye.tt.omtrdc.net/m2/fireeye/mbox/json?mbox=target-global-mbox&mboxSession=8c817fb9472841ea9586bc91739ed06f&mboxPC=&mboxPage=e25bf54a22424db6a9d88c7950350693&mboxRid=32ca63c4be9f408e8a0da73460d75f74&mboxVersion=1.7.1&mboxCount=1&mboxTime=1614865578007&mboxHost=www.fireeye.com&mboxURL=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html&mboxReferrer=&browserHeight=1200&browserWidth=1600&browserTimeOffset=60&screenHeight=1200&screenWidth=1600&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.51.251.137 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 60f2336dfa08d0c8e7ca93cb115ab859c2c39763ad4298d90815aa21e3ebd2d2

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Mar 2021 12:46:18 GMT
content-encoding: gzip
vary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.fireeye.com
cache-control: no-cache
access-control-allow-credentials: true
timing-allow-origin: *
x-request-id: 32ca63c4be9f408e8a0da73460d75f74

GET
H2 200 435600.json Show response
s.yimg.com/wi/config/ 2 B
459 B 26ms
13ms XHR
application/json 2a00:1288:80:800::7001
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/435600.json

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7001 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 11:50:39 GMT
x-content-type-options: nosniff
age: 3339
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-amz-request-id: 6KJBG8FCH7ZBTA93
x-amz-id-2: ZZY+98llu9FJq/vTpfXinL/St63P4iN2O91uagRINhNDS7YEz6vC9ga5eOMVwBTas6xfNFqKrk8=
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
content-length: 2

GET
H2 200 core Show response
js.driftt.com/ Frame 7A4A 3 KB
1 KB 89ms
76ms Document
text/html 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

68f5ba64662612eb585b4774d2b304e84ee48ef6f25c70189070d9f64b9d428a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: js.driftt.com
:scheme: https
:path: /core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fireeye.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fireeye.com/

Response headers

content-type: text/html; charset=utf-8
server: nginx
last-modified: Wed, 03 Mar 2021 17:58:35 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: qZOng5xK3_myq2H29nik_NautW2e_6bI
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
date: Thu, 04 Mar 2021 12:46:18 GMT
cache-control: no-cache
etag: W/"a49a415f118c1b00fe02e697caeb554f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: BsOqBhyujKswuIYO2EY9xPC4FHbZ6di40xJPT_eN7yb_GWojqB3u5g==

GET
H2 200 chat Show response
js.driftt.com/core/ Frame 5950 3 KB
1 KB 258ms
256ms Document
text/html 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/chat

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1614862200000/wm3vc3smix6y.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

68f5ba64662612eb585b4774d2b304e84ee48ef6f25c70189070d9f64b9d428a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: js.driftt.com
:scheme: https
:path: /core/chat
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fireeye.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fireeye.com/

Response headers

content-type: text/html; charset=utf-8
server: nginx
last-modified: Wed, 03 Mar 2021 17:58:35 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: qZOng5xK3_myq2H29nik_NautW2e_6bI
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
date: Thu, 04 Mar 2021 12:46:19 GMT
cache-control: no-cache
etag: W/"a49a415f118c1b00fe02e697caeb554f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: lKzWjgjbPade-J-47cOwc-SB-SEoPJcs-Bk7cTLtEsqvt25Ixus0dA==

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 2 B
48 B 16ms
16ms XHR
text/plain 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j88&a=968746142&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2021%2F02%2Faccellion-fta-exploited-for-data-theft-and-extortion.html&ul=en-us&de=UTF-8&dt=Cyber%20Criminals%20Exploit%20Accellion%20FTA%20for%20Data%20Theft%20and%20Extortion%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Site%20Section&ea=FireEye%20Blogs&el=Threat%20Research&ev=0&_u=aHjAAEABAAAAAC~&jid=673090874&gjid=1306879430&cid=668634536.1614861974&tid=UA-363943-1&_gid=146877455.1614861979&_r=1&gtm=2wg2o0MVGC8KK&z=117038276

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 04 Mar 2021 12:46:18 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.fireeye.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 runtime~main.845c2373.js Show response
js.driftt.com/core/assets/js/ Frame 7A4A 5 KB
3 KB 40ms
36ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

e9dbd9e7736d96ca79a74b174f2768829dd7d4da33ae7584add9fc72d1ade08e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 22:56:27 GMT
content-encoding: gzip
age: 136192
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 02 Mar 2021 22:37:12 GMT
server: nginx
etag: W/"07706558e653d2ee6e4cedf5025b83c6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 6lh9j41dX8FwjdMMm_EiyJ6IoS7VvblB
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ryG31X49__wP7krk6FOxHLSs3ATzC-QacwHJkNLjDCmDH2J7_sXvbg==

GET
H2 200 38.feef3c6b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7A4A 40 KB
12 KB 40ms
36ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

af8a20e6bd6c6de708d7aeffdd3afab1a47a00f91b53618d246cdb73410f147c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 29 Jan 2021 03:47:32 GMT
content-encoding: gzip
age: 2969927
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 28 Jan 2021 22:54:33 GMT
server: nginx
etag: W/"8a244bcbbb9c80ac041e954050101a6d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Y2xtiqOhyUagLaCd4JUdQFq9_qeHBQGq
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: dZ3_xV0k9yJnqq-qd39MBltniOWJI_Qa2k33rD966jZqHsz1Zi_z2A==

GET
H2 200 22.c3832689.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7A4A 42 KB
12 KB 49ms
43ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/22.c3832689.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

d5dd51858c25c8f35b6d808746ec3c11750d0b6796b607cf720fa3c86d6e1bb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 06 Feb 2021 01:20:27 GMT
content-encoding: gzip
age: 2287552
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:45 GMT
server: nginx
etag: W/"2b69413df831a59bc270b140595f3bee"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: iMEU9wUKynYc7wphCZL7mwA6w7CPcuFS
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: EpArVoOqYWPgu2T41IwxAne8A-g9sSlI9lcN99lKSt6ULLEzyUq8iQ==

GET
H2 200 13.a9247e5d.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7A4A 70 KB
21 KB 50ms
44ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/13.a9247e5d.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

a46a8c9098978eb78708da11a88cf5b7d8f3d691c499aa23a56938beebed5adb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 29 Jan 2021 03:47:32 GMT
content-encoding: gzip
age: 2969927
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 28 Jan 2021 22:54:33 GMT
server: nginx
etag: W/"905ca25975ecfcc9b76946365bc9cd59"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: VuhVz5c7IL2_3PBsS5Fx124ohSHZgK7i
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: aYUYQaz0yQKY88MZO4vUL66YACSC1QzSGafv9WhlrTWs6ZWL3CppoQ==

GET
H2 200 29.69384517.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7A4A 48 KB
15 KB 53ms
47ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/29.69384517.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

70bedf6699398da0f7fa3be459809c0701fe7de1de2e4fff0718be5f65600db9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 06 Feb 2021 01:30:19 GMT
content-encoding: gzip
age: 2286960
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:45 GMT
server: nginx
etag: W/"a4be40481b3d6f225b9f914e9d1e2d0f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: stuRfcIcwvNZqy8u880991iTue6.9S3G
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 871YBeC5WKT036P0duc9BGjQWaKM3Aa4DWmTfe7sMVVrpxgBvpKsTg==

GET
H2 200 12.8c7dd5ee.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7A4A 29 KB
8 KB 53ms
48ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/12.8c7dd5ee.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

7f5c6e767ba72fae587de73bc9e9ebaf14a949042332953f90662c784c007809

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 03 Feb 2021 04:02:39 GMT
content-encoding: gzip
age: 2537020
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 02 Feb 2021 22:38:12 GMT
server: nginx
etag: W/"0c6be271de03c613b6960dfc110e6734"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: j_4_MdWNRsVrXZiN07pBST1p1qio5rQm
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Dvi0Q4N6VtJdWYxgOtneOqUZz6FkMtAKaNRsdrOTYo4QiKyKYApPzQ==

GET
H2 200 15.ba891359.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7A4A 39 KB
10 KB 43ms
40ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/15.ba891359.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

2d3474f74f49ea05fe008ac0707fa6e2f3adba2b990b5c46d61f3a465023eae2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 22 Jan 2021 01:29:44 GMT
content-encoding: gzip
age: 3582995
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 21 Jan 2021 17:01:10 GMT
server: nginx
etag: W/"c35bc9563c8d6e811ec2f39f529dc431"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: g3X4lgKb9tt7RdBN2YYfNAQpmCUl3xub
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: nC2zAwFMBe82RJLlBPlsthJVbxMUH5jZWdodipYqZU_LwEce7Lzxhw==

GET
H2 200 35.9da4441f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7A4A 52 KB
18 KB 43ms
40ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/35.9da4441f.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

2a0dcc78da2fbb1fcfe754652282ee9e51a1e8b8dd2f1164ccd38ba23ea7d789

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 07 Feb 2021 00:47:42 GMT
content-encoding: gzip
age: 2203117
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:45 GMT
server: nginx
etag: W/"9abfc23518ff7d358e25cade17a2d86e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: d80aBwb04EFIcibVorbXlOyvc48kRff8
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Zq_P7JhO9O1oT0xUMcPhm7VeLzpp-wG6TzL1wN1HCANxDxol8UzAZA==

GET
H2 200 33.6dcbce8f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7A4A 24 KB
10 KB 48ms
46ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/33.6dcbce8f.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

1a613cec529d335c4758874a4b8249ddf6921d238969f33ac58289dddada5388

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 06 Feb 2021 02:22:52 GMT
content-encoding: gzip
age: 2283807
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:45 GMT
server: nginx
etag: W/"95f111c83ae06bebf035d1b81b96b8c8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: vZMR9WV7oAI.mz1BOoi7AVGpzvgbmD6I
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: k7pg7fThzeGsjchlLK7MguDUSDMvfTgYX6SBAwE1fLUJuIL8JcUY4A==

GET
H2 200 8.b94e6c9f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7A4A 60 KB
21 KB 48ms
46ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/8.b94e6c9f.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

cae6601eec3262f0496682bc1cced8b0fabc8636c4645562c4952a81d02c5283

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 08 Feb 2021 02:35:09 GMT
content-encoding: gzip
age: 2110270
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:46 GMT
server: nginx
etag: W/"367141ca772a2b6bf33a53efb589a530"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 79jSbZ8P8PlWIby_nvWympqtz7uVNA2P
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: kDaRkOqIeLR7mIYz5EO6m68EM_2OdijwB95LIsu3af11ziXiVUAoeQ==

GET
H2 200 main~493df0b3.b9402cb4.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7A4A 20 KB
7 KB 48ms
46ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~493df0b3.b9402cb4.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

1cd351f07deee99fcd89ece5c143f930e79faf83eb0111ef9b0ac1492e288277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 22:16:23 GMT
content-encoding: gzip
age: 1348196
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 16 Feb 2021 21:33:15 GMT
server: nginx
etag: W/"c0bae371615a8842bc97f3f4f26f1a1e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: G56f3Sl0CWNba70DI4sS89QRWddGg3Eb
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: OtO9-6WynVC9apbb0HDKsgp_58xevjnB8RBJEr6fh_eiE6YweA3Wlg==

GET
H2 200 main~970f9218.b407d543.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7A4A 55 KB
15 KB 53ms
51ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~970f9218.b407d543.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

f99898fbb77a8b86890a5e8d0fd1364cc55eb5764b2dd8cf899a585eb58757e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 22:09:06 GMT
content-encoding: gzip
age: 139033
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 02 Mar 2021 21:36:41 GMT
server: nginx
etag: W/"57355fac499eb22ccdeb86bc435104c2"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: No0Rvs.GcvE6h7mrZALb7jM6VIlcOYTk
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: vbuMv1baIu2L0nKHqiEG3KSaj6H3oUtKbIjl4mDSTwfqH9IJj8C5KQ==

GET
H2 200 main~89e24786.cd237a36.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7A4A 60 KB
17 KB 53ms
52ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~89e24786.cd237a36.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

4034b946d27c8d1b17b893e14085aca0784e3902ad2aca3be4f17c02c681be43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 03 Mar 2021 17:58:34 GMT
content-encoding: gzip
age: 67665
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 03 Mar 2021 17:15:03 GMT
server: nginx
etag: W/"599434ea6918e02929257bba4934759b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: JSj284z3Fi4sQsUNZ6wOSIbJfe6_IiX_
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: FMr6yi5iLBc_PKnc0DYToOcXBQ3mFI-K5Y8WZX3PgST0fjzzU18goA==

GET
H2 200 main~53ca99a6.1b3ad02f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7A4A 26 KB
9 KB 53ms
52ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~53ca99a6.1b3ad02f.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

8eb0d6befea8fe88818af0f2d7aea343202c24d935f538831bceb4e453bd4e18

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 03 Mar 2021 17:58:34 GMT
content-encoding: gzip
age: 67665
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 03 Mar 2021 17:15:03 GMT
server: nginx
etag: W/"e9f5f69dd679141b6ca6d6ebf56db206"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: MbRWxZ1J77pZPQ0amTcWb8UF62j0wKWF
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: hZ4IU7YmlM0R1HQdeQAEbK2paeyARlLhYzdulfDQl1ml_DUujTSc_g==

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
70 B 17ms
3ms XHR
text/plain 2a00:1450:400c:c1b::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j88&tid=UA-363943-1&cid=668634536.1614861974&jid=673090874&gjid=1306879430&_gid=146877455.1614861979&_u=aHjAAEABAAAAAC~&z=2067786813

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c1b::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 04 Mar 2021 12:46:19 GMT
content-type: text/plain
access-control-allow-origin: https://www.fireeye.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ga-audiences
www.google.com/ads/ 42 B
483 B 55ms
31ms Image
image/gif 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-363943-1&cid=668634536.1614861974&jid=673090874&_u=aHjAAEABAAAAAC~&z=915630915

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Mar 2021 12:46:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 27ms
21ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-363943-1&cid=668634536.1614861974&jid=673090874&_u=aHjAAEABAAAAAC~&z=915630915

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Mar 2021 12:46:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 36.56cefaf3.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7A4A 6 KB
3 KB 35ms
34ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/36.56cefaf3.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

e9f1723d153401796dcde6f2d1fbf9a6e2181ac7e94049fc88126fbff1abd38d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 06 Feb 2021 01:50:09 GMT
content-encoding: gzip
age: 2285770
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:45 GMT
server: nginx
etag: W/"199a90762d66f2a85b69771e3ad0d5d5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: QapLgE7Hrz7BOH3CyhE2UBgsF1vU.UM6
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 2p39Wo-czslqt19jVzLNVQsXYPc3mffmhtgV8qXmOJuCtfasQel8PQ==

GET
H2 200 34.fe729046.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7A4A 107 KB
34 KB 37ms
36ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/34.fe729046.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

ff04dd81bb93731c0d1f8e7d384b370f26b93f4352980404fcdc4518e386bedd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 01 Feb 2021 07:29:10 GMT
content-encoding: gzip
age: 2697429
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 29 Jan 2021 18:47:31 GMT
server: nginx
etag: W/"b75bf38c8eee61f620998bf4e506f0a8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: sSsGb8qv3FA_x9pHEEYoEYgTo0k7yLWg
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: vzvE46qiCknAE8NDPkmhu1z8Z5-xVSb_PtXKLkpWWi30uGNj1HP4og==

GET
H2 200 26.91e0f92d.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7A4A 27 KB
9 KB 41ms
41ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/26.91e0f92d.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

457b4bd3410faf074da387900f87abc1e845269e857219560bce3ead8260d103

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 13 Feb 2021 01:38:42 GMT
content-encoding: gzip
age: 1681657
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 12 Feb 2021 20:45:21 GMT
server: nginx
etag: W/"2203aa06cd7f5410d671168ef758e8ca"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: PmzBRtQDYNPhuMGNNzvx8GHWAfPbX59V
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: NTdeZUay8qcaU57jOQ43dzxtKo-Hoc_S7OECMx6LAZ9dQ1pbbL_-Ug==

GET
H2 200 32.92beb56c.chunk.css
js.driftt.com/core/assets/css/ Frame 7A4A 2 KB
1 KB 41ms
41ms Stylesheet
text/css 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/32.92beb56c.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

11c0f76b0414f025f6d8790a111f70421b4b0e816a93317188736671360192ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 24 Feb 2021 14:26:30 GMT
content-encoding: gzip
age: 685189
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 24 Feb 2021 14:05:51 GMT
server: nginx
etag: W/"1103e1501b63c165063174303b93cb83"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: y7YyIAyIDJLJEcHCBriUBL3qXrAfEiHo
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 3MrEh9v5fx9lCKIc66-59zp9LSFiaLLhm95EFIuxOEWQqErdnpbQoQ==

GET
H2 200 32.006d9a64.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7A4A 5 KB
2 KB 41ms
41ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/32.006d9a64.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

3a20dd690bb8b873e65040ac190e289a3c2d6c4debee865f4619f306cf2c9544

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 10 Feb 2021 18:20:29 GMT
content-encoding: gzip
age: 1880750
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 10 Feb 2021 16:07:16 GMT
server: nginx
etag: W/"e75834d1c478af776c281151aa135393"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: aAyVtfRdt4J4u0lrxoSzzhFObOhQBbOZ
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Dmr4dxxFiwwF_nG__GNhBnDe1ZGUFfzeVCA06aMhn17zCRGedTLRqg==

GET
H2 200 runtime~main.845c2373.js Show response
js.driftt.com/core/assets/js/ Frame 5950 5 KB
3 KB 42ms
38ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

e9dbd9e7736d96ca79a74b174f2768829dd7d4da33ae7584add9fc72d1ade08e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 22:56:27 GMT
content-encoding: gzip
age: 136192
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 02 Mar 2021 22:37:12 GMT
server: nginx
etag: W/"07706558e653d2ee6e4cedf5025b83c6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 6lh9j41dX8FwjdMMm_EiyJ6IoS7VvblB
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ZZeBexXPeVdQADtMPsj7y7VQK-RFI3LaWDtm8o7y4e3p-PtoEp1MRA==

GET
H2 200 38.feef3c6b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 40 KB
12 KB 42ms
38ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

af8a20e6bd6c6de708d7aeffdd3afab1a47a00f91b53618d246cdb73410f147c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 29 Jan 2021 03:47:32 GMT
content-encoding: gzip
age: 2969927
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 28 Jan 2021 22:54:33 GMT
server: nginx
etag: W/"8a244bcbbb9c80ac041e954050101a6d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Y2xtiqOhyUagLaCd4JUdQFq9_qeHBQGq
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: szG-n7RgdkAdoHaWL1nXO_Zg0Ba0wlmBU3SahB4pjwmxRo4QTSoWIw==

GET
H2 200 22.c3832689.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 42 KB
12 KB 43ms
39ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/22.c3832689.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

d5dd51858c25c8f35b6d808746ec3c11750d0b6796b607cf720fa3c86d6e1bb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 06 Feb 2021 01:20:27 GMT
content-encoding: gzip
age: 2287552
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:45 GMT
server: nginx
etag: W/"2b69413df831a59bc270b140595f3bee"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: iMEU9wUKynYc7wphCZL7mwA6w7CPcuFS
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Jj6bYMQydvRpcLskf9ZFJfH8f7Pkc3UnG9v_y9LTX7xC0xKUBS1XAw==

GET
H2 200 13.a9247e5d.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 70 KB
21 KB 43ms
40ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/13.a9247e5d.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

a46a8c9098978eb78708da11a88cf5b7d8f3d691c499aa23a56938beebed5adb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 29 Jan 2021 03:47:32 GMT
content-encoding: gzip
age: 2969927
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 28 Jan 2021 22:54:33 GMT
server: nginx
etag: W/"905ca25975ecfcc9b76946365bc9cd59"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: VuhVz5c7IL2_3PBsS5Fx124ohSHZgK7i
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: JnhRpht798EG511GZvhVXMr_byLr3kKtwQPi5hsVekqe0hx29Sw6HA==

GET
H2 200 29.69384517.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 48 KB
15 KB 43ms
40ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/29.69384517.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

70bedf6699398da0f7fa3be459809c0701fe7de1de2e4fff0718be5f65600db9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 06 Feb 2021 01:30:19 GMT
content-encoding: gzip
age: 2286960
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:45 GMT
server: nginx
etag: W/"a4be40481b3d6f225b9f914e9d1e2d0f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: stuRfcIcwvNZqy8u880991iTue6.9S3G
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 789UR95f9a-r4-PpR_M3dezBVznJHg-PdK0eSUs4PaUVdWH8JUiQcQ==

GET
H2 200 12.8c7dd5ee.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 29 KB
8 KB 44ms
41ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/12.8c7dd5ee.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

7f5c6e767ba72fae587de73bc9e9ebaf14a949042332953f90662c784c007809

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 03 Feb 2021 04:02:39 GMT
content-encoding: gzip
age: 2537020
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 02 Feb 2021 22:38:12 GMT
server: nginx
etag: W/"0c6be271de03c613b6960dfc110e6734"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: j_4_MdWNRsVrXZiN07pBST1p1qio5rQm
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: hx8Z59bOdoUtDbB5NisL2lJWeLXQps5CYTP_4mG-_XKp23b1eNR6jg==

GET
H2 200 15.ba891359.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 39 KB
10 KB 43ms
40ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/15.ba891359.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

2d3474f74f49ea05fe008ac0707fa6e2f3adba2b990b5c46d61f3a465023eae2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 22 Jan 2021 01:29:44 GMT
content-encoding: gzip
age: 3582995
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 21 Jan 2021 17:01:10 GMT
server: nginx
etag: W/"c35bc9563c8d6e811ec2f39f529dc431"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: g3X4lgKb9tt7RdBN2YYfNAQpmCUl3xub
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 8lTBa6DF571l5SDrI0mBgNbomjwszFuivNArI613yNBWUSLhqi2pAg==

GET
H2 200 35.9da4441f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 52 KB
18 KB 43ms
40ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/35.9da4441f.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

2a0dcc78da2fbb1fcfe754652282ee9e51a1e8b8dd2f1164ccd38ba23ea7d789

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 07 Feb 2021 00:47:42 GMT
content-encoding: gzip
age: 2203117
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:45 GMT
server: nginx
etag: W/"9abfc23518ff7d358e25cade17a2d86e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: d80aBwb04EFIcibVorbXlOyvc48kRff8
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 4IKwbAkOueRIhohoh8XEatHEubuJ0ziSncvEGeyZF3cxjmoGbtYkEA==

GET
H2 200 33.6dcbce8f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 24 KB
10 KB 44ms
41ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/33.6dcbce8f.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

1a613cec529d335c4758874a4b8249ddf6921d238969f33ac58289dddada5388

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 06 Feb 2021 02:22:52 GMT
content-encoding: gzip
age: 2283807
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:45 GMT
server: nginx
etag: W/"95f111c83ae06bebf035d1b81b96b8c8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: vZMR9WV7oAI.mz1BOoi7AVGpzvgbmD6I
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: k940O_CbkGApdu43Vskhk2DFxCH6KpB-nvCgdHvSD5SOakJKYqjxzg==

GET
H2 200 8.b94e6c9f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 60 KB
21 KB 44ms
41ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/8.b94e6c9f.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

cae6601eec3262f0496682bc1cced8b0fabc8636c4645562c4952a81d02c5283

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 08 Feb 2021 02:35:09 GMT
content-encoding: gzip
age: 2110270
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:46 GMT
server: nginx
etag: W/"367141ca772a2b6bf33a53efb589a530"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 79jSbZ8P8PlWIby_nvWympqtz7uVNA2P
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: UYBhTH7kkkP39D1OaH64Z3JaItjyVo0vw5xAd53ErpgwsZX6e84Iaw==

GET
H2 200 main~493df0b3.b9402cb4.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 20 KB
7 KB 44ms
42ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~493df0b3.b9402cb4.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

1cd351f07deee99fcd89ece5c143f930e79faf83eb0111ef9b0ac1492e288277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 22:16:23 GMT
content-encoding: gzip
age: 1348196
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 16 Feb 2021 21:33:15 GMT
server: nginx
etag: W/"c0bae371615a8842bc97f3f4f26f1a1e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: G56f3Sl0CWNba70DI4sS89QRWddGg3Eb
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: U1zhTWaGCB4gUUW7nnwBBW2RyIhSQJggpgXv6-aoI_Nm8SslseHnVA==

GET
H2 200 main~970f9218.b407d543.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 55 KB
15 KB 44ms
42ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~970f9218.b407d543.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

f99898fbb77a8b86890a5e8d0fd1364cc55eb5764b2dd8cf899a585eb58757e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 22:09:06 GMT
content-encoding: gzip
age: 139033
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 02 Mar 2021 21:36:41 GMT
server: nginx
etag: W/"57355fac499eb22ccdeb86bc435104c2"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: No0Rvs.GcvE6h7mrZALb7jM6VIlcOYTk
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: d9PIYRZ_Kx_n9G8_EO6zXaXQp5tF0lVaqKVfYGd5cCei77vf0YEDPw==

GET
H2 200 main~89e24786.cd237a36.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 60 KB
17 KB 44ms
42ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~89e24786.cd237a36.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

4034b946d27c8d1b17b893e14085aca0784e3902ad2aca3be4f17c02c681be43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 03 Mar 2021 17:58:34 GMT
content-encoding: gzip
age: 67665
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 03 Mar 2021 17:15:03 GMT
server: nginx
etag: W/"599434ea6918e02929257bba4934759b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: JSj284z3Fi4sQsUNZ6wOSIbJfe6_IiX_
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: AN50rGkOn3B6AJefg8BbgquCrcK2MFn9vt6jd0VDkm5cK_qt8YEfTA==

GET
H2 200 main~53ca99a6.1b3ad02f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 26 KB
9 KB 44ms
42ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~53ca99a6.1b3ad02f.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

8eb0d6befea8fe88818af0f2d7aea343202c24d935f538831bceb4e453bd4e18

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 03 Mar 2021 17:58:34 GMT
content-encoding: gzip
age: 67665
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 03 Mar 2021 17:15:03 GMT
server: nginx
etag: W/"e9f5f69dd679141b6ca6d6ebf56db206"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: MbRWxZ1J77pZPQ0amTcWb8UF62j0wKWF
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: XYXsIwO7JZP5uFhA0p1aKlBwNR1Dl5nMS1Bc6ItOnE4oHTA7BLUqeg==

GET
H2 200 0.45eb4005.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7A4A 17 KB
6 KB 37ms
35ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/0.45eb4005.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

65d29e040c59a5e843952c3f0da27028455dc63372440602d129681883891276

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 12 Feb 2021 02:34:41 GMT
content-encoding: gzip
age: 1764698
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 11 Feb 2021 15:02:23 GMT
server: nginx
etag: W/"7e689afacd5eb298702f393c9c2f70f8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: meASu2JEFoyVpwOxkLJiMpQwEpCiiXJl
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: wO8dpnomYMKIyYOtWPCT_WMDOkEnNOoAUiYUh_1szg0kc9XcDjTPLQ==

GET
H2 200 1.0af467a5.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7A4A 68 KB
20 KB 37ms
35ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/1.0af467a5.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

817c7a8de5f73b3bd9358babbbd8f904fa639279f18bc86d320fcfb7fcfa8485

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 06 Feb 2021 01:42:28 GMT
content-encoding: gzip
age: 2286231
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:44 GMT
server: nginx
etag: W/"aedd244e100709f43b70a84bb3945ca6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: kErXw93froxamEp2BnqkXpG57uNk3Qr1
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: kDseBlqNzTWQ3WXLuVDyRw7wwYCIPOkU1GCW_T7EY_4-NnK2lEFPEw==

GET
H2 200 28.f9670e37.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7A4A 42 KB
12 KB 37ms
36ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/28.f9670e37.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

45fe1a3f8f9f78ac64a025b533edd3296325b88ac638c78e23836e85414cb66d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 17 Feb 2021 21:16:40 GMT
content-encoding: gzip
age: 1265379
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 17 Feb 2021 21:05:34 GMT
server: nginx
etag: W/"f180a9c22af2d95df2ffc6944369b038"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: IA1L1yp0sXLW7dRNSZ.4dN8OwTXpaNlP
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: oaLkiMue-VnJhFb_ZcpgptrT7jUDq5Qf590_bbq8V__Gr6ySBb0QCg==

GET
H2 200 2.497d9c43.chunk.css
js.driftt.com/core/assets/css/ Frame 7A4A 1 KB
1 KB 37ms
36ms Stylesheet
text/css 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/2.497d9c43.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

9066c399df39fc448ea3597ef0b67e9f987a58d466b3dd3a61b1d505e18516eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 05 Feb 2021 02:00:33 GMT
content-encoding: gzip
age: 2371546
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 04 Feb 2021 22:21:52 GMT
server: nginx
etag: W/"53a4a9c8842e24b41fd0229969b6d146"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: .O1dHgw8YNKCPtYTHo80Zq7QNICiatCH
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ySJvXPNEKFJ1oxhibeBlfUzsFQPic-9tygIEKkxlYGYPTbbZ1ru3qw==

GET
H2 200 2.71f04a13.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7A4A 27 KB
10 KB 40ms
39ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/2.71f04a13.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

df0e1ab988d451dcf5eaca26de327dc716a2cbc85bd348aa33d4a42a5f996d66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 24 Feb 2021 14:26:30 GMT
content-encoding: gzip
age: 685189
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 24 Feb 2021 14:05:53 GMT
server: nginx
etag: W/"983fafe09a6e34607464014289317ed0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: bEv6ky4XS_332Gx9TlBW98BcAv.fQ1PB
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: PHBF6naDEhqvAsUA_ffN6kbVe2Lx-i2CzI_zyuqSFv0UBDW_U1bYpg==

GET
H2 200 25.02e62d23.chunk.css
js.driftt.com/core/assets/css/ Frame 7A4A 8 KB
2 KB 37ms
36ms Stylesheet
text/css 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/25.02e62d23.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

475dbccf84ca50f8d13df95ef5a85c58198fd65fefa481850453de7feb2d4bb2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 14:58:50 GMT
content-encoding: gzip
age: 1201649
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 18 Feb 2021 14:27:58 GMT
server: nginx
etag: W/"4a7ea3158114815c3ce4a439e64bb20f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: KU6XFS_YxAtnBlsAldU1clPlI0WqvkeV
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: rnQO2G38Mg9ySp6IvXyFSE96sx2FFv4Z45p5pqgsaq5JLVMzHp9oKg==

GET
H2 200 25.67fe4478.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7A4A 65 KB
19 KB 40ms
35ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/25.67fe4478.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

8d5adb87a00b3d248771577cd715c3a79d550e8e623128168c9c7c0a20124806

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 22:09:07 GMT
content-encoding: gzip
age: 139032
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 02 Mar 2021 21:36:39 GMT
server: nginx
etag: W/"48ca142c686c1551b81947aed9689cc7"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 9.rONCHygJ_oxVlAf_sRsdHwUriltBPA
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: T-D_TBWPGK_m3J7cYovnyxsuFXVxwkF6bsiIDXPKImwyIdOrpDrJzQ==

GET
H2 200 36.56cefaf3.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 6 KB
3 KB 36ms
8ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/36.56cefaf3.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

e9f1723d153401796dcde6f2d1fbf9a6e2181ac7e94049fc88126fbff1abd38d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 06 Feb 2021 01:50:09 GMT
content-encoding: gzip
age: 2285770
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:45 GMT
server: nginx
etag: W/"199a90762d66f2a85b69771e3ad0d5d5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: QapLgE7Hrz7BOH3CyhE2UBgsF1vU.UM6
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 2pjKsHw8xA34bBoYGW_32r475KVGjaKDGDKxDGIhtNodniqmMmOzsA==

GET
H2 200 34.fe729046.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 107 KB
34 KB 63ms
35ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/34.fe729046.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

ff04dd81bb93731c0d1f8e7d384b370f26b93f4352980404fcdc4518e386bedd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 01 Feb 2021 07:29:10 GMT
content-encoding: gzip
age: 2697429
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 29 Jan 2021 18:47:31 GMT
server: nginx
etag: W/"b75bf38c8eee61f620998bf4e506f0a8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: sSsGb8qv3FA_x9pHEEYoEYgTo0k7yLWg
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: SsaO_SNLn63f6QcKdj103XfxCGG_Lfhl7bEMHlNcJQb4Ka2i6qNFag==

GET
H2 200 26.91e0f92d.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 27 KB
9 KB 63ms
35ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/26.91e0f92d.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

457b4bd3410faf074da387900f87abc1e845269e857219560bce3ead8260d103

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 13 Feb 2021 01:38:42 GMT
content-encoding: gzip
age: 1681657
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 12 Feb 2021 20:45:21 GMT
server: nginx
etag: W/"2203aa06cd7f5410d671168ef758e8ca"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: PmzBRtQDYNPhuMGNNzvx8GHWAfPbX59V
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: x5hNwsZ0sTsHBKb2pthAQu-854NxAWptNVOsspke4Buf0iKYB33fjA==

GET
H2 200 32.92beb56c.chunk.css
js.driftt.com/core/assets/css/ Frame 5950 2 KB
1 KB 61ms
34ms Stylesheet
text/css 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/32.92beb56c.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

11c0f76b0414f025f6d8790a111f70421b4b0e816a93317188736671360192ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 24 Feb 2021 14:26:30 GMT
content-encoding: gzip
age: 685189
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 24 Feb 2021 14:05:51 GMT
server: nginx
etag: W/"1103e1501b63c165063174303b93cb83"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: y7YyIAyIDJLJEcHCBriUBL3qXrAfEiHo
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: CrNMc2o2nyv8_PHzSMWGcp8dNRW9Jne2-cQfUTX7gJKX-Q9uFRCpmQ==

GET
H2 200 32.006d9a64.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 5 KB
2 KB 64ms
37ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/32.006d9a64.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

3a20dd690bb8b873e65040ac190e289a3c2d6c4debee865f4619f306cf2c9544

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 10 Feb 2021 18:20:29 GMT
content-encoding: gzip
age: 1880750
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 10 Feb 2021 16:07:16 GMT
server: nginx
etag: W/"e75834d1c478af776c281151aa135393"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: aAyVtfRdt4J4u0lrxoSzzhFObOhQBbOZ
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: r_-dOn0KRIomZCGcIz8DxLunXsZzJnZcqu1WfSbEHw4taSkGTsu98Q==

GET
H2 200 0.45eb4005.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 17 KB
6 KB 36ms
35ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/0.45eb4005.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

65d29e040c59a5e843952c3f0da27028455dc63372440602d129681883891276

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 12 Feb 2021 02:34:41 GMT
content-encoding: gzip
age: 1764698
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 11 Feb 2021 15:02:23 GMT
server: nginx
etag: W/"7e689afacd5eb298702f393c9c2f70f8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: meASu2JEFoyVpwOxkLJiMpQwEpCiiXJl
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: JIebcYk5x_fHvXQZDI0eAjX1u5JT1hWrs_QsnlP2J_y27XZN5fTBdA==

GET
H2 200 31.e776e5b0.chunk.css
js.driftt.com/core/assets/css/ Frame 5950 6 KB
1 KB 36ms
36ms Stylesheet
text/css 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/31.e776e5b0.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

f8e3f110b75b3f1951f50fb7795c6eaf5bee4f07b787a1b535b39e734c7f1723

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 07 Feb 2021 00:52:24 GMT
content-encoding: gzip
age: 2202835
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:43 GMT
server: nginx
etag: W/"9f36443a9402e1e03bf8070ddc88b8db"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: E0JJ7iOWJmWtm1hXpwMRK75TEoLvG7xD
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: OvwCfSoFH4HEFpllT_6NHeaM6bWHqwuwU4yFcAQeJtdbIzvs_XP4xA==

GET
H2 200 31.097eee16.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 2 KB
2 KB 37ms
36ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/31.097eee16.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

7cc5de02e755067bd3c580c61e3cbe314b42aad5fc2e1a8219a22020048c8caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 06 Feb 2021 02:53:32 GMT
content-encoding: gzip
age: 2281967
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:45 GMT
server: nginx
etag: W/"3812ca4c1f28ecca4240842e05a0c358"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: oAFdKDj5aLNhNSbXlzF8QvviPtLEBFZ2
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: P-nxL79yyMPGeonzAAK8EyVfu05AuilVARMqJ_vYt5pYrqBhKKaBsA==

GET
H2 200 1.0af467a5.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 68 KB
20 KB 35ms
34ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/1.0af467a5.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

817c7a8de5f73b3bd9358babbbd8f904fa639279f18bc86d320fcfb7fcfa8485

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 06 Feb 2021 01:42:28 GMT
content-encoding: gzip
age: 2286231
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:44 GMT
server: nginx
etag: W/"aedd244e100709f43b70a84bb3945ca6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: kErXw93froxamEp2BnqkXpG57uNk3Qr1
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: rpkjdSWACwpJZ_HfF113Awf2iwgVCb9WNMZ2SaBIcuIzyN7ZrNc2Rg==

GET
H2 200 24.07aa08a5.chunk.css
js.driftt.com/core/assets/css/ Frame 5950 7 KB
2 KB 42ms
39ms Stylesheet
text/css 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/24.07aa08a5.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 08 Feb 2021 00:46:24 GMT
content-encoding: gzip
age: 2116795
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:43 GMT
server: nginx
etag: W/"189aeffd571884559dababa22c66d75a"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 1aSTl_6gyhge2weRQRNW6xkjw517PNux
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: zStE62avlDsSFa4x-w387hW6YeOFa1icF4MEvsX7T7inwQWhn_R0GA==

GET
H2 200 24.d1e2ba0d.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 38 KB
13 KB 42ms
38ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/24.d1e2ba0d.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

8509f8b66ce83784c82b29f557979cee1cdeafcfa4ea5b43e6301700ac1d6332

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 29 Jan 2021 07:52:15 GMT
content-encoding: gzip
age: 2955244
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 21 Jan 2021 17:01:10 GMT
server: nginx
etag: W/"f2a5c91c1591ed94eeaed7fae317b092"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 2AQjxf3nt1nSuxCXbjxVOHBQYs0oqO4g
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: yZL25HRnwUvANfAx2p9s3xkksvEiuCnrwmp2cBqV0z2-uas8M9BArA==

GET
H2 200 20.ec5afb3b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 50 KB
14 KB 44ms
40ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/20.ec5afb3b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

16bab25394f47e60db69b3a75ace1574b150a268353e17096619ba5ba96e208d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 08 Feb 2021 00:31:27 GMT
content-encoding: gzip
age: 2117692
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:45 GMT
server: nginx
etag: W/"3cd2b5a6bcf9f406aacdee5be662461f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: LTEkK2LMjjpmGesY_B9uFNlbejd8B9H8
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 8Dcc9xtGXQzRn-yl6bsXRmAGut3K8BZLZREzzc03uSKI6vqLLs0FyQ==

GET
H2 200 2.497d9c43.chunk.css
js.driftt.com/core/assets/css/ Frame 5950 1 KB
1 KB 42ms
38ms Stylesheet
text/css 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/2.497d9c43.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

9066c399df39fc448ea3597ef0b67e9f987a58d466b3dd3a61b1d505e18516eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 05 Feb 2021 02:00:33 GMT
content-encoding: gzip
age: 2371546
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 04 Feb 2021 22:21:52 GMT
server: nginx
etag: W/"53a4a9c8842e24b41fd0229969b6d146"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: .O1dHgw8YNKCPtYTHo80Zq7QNICiatCH
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 6gQQcxekNXtV042r8LRaB-vNw5GcXIjL58KBbcTsf6Hd4DU5so8BCw==

GET
H2 200 2.71f04a13.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 27 KB
10 KB 44ms
40ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/2.71f04a13.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

df0e1ab988d451dcf5eaca26de327dc716a2cbc85bd348aa33d4a42a5f996d66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 24 Feb 2021 14:26:30 GMT
content-encoding: gzip
age: 685189
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 24 Feb 2021 14:05:53 GMT
server: nginx
etag: W/"983fafe09a6e34607464014289317ed0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: bEv6ky4XS_332Gx9TlBW98BcAv.fQ1PB
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: OkrZre8qI5SE6k_1JynsgsMxvwygmyDd_rxuSoYcMt0RZcfsBl2CPQ==

GET
H2 200 23.401111da.chunk.css
js.driftt.com/core/assets/css/ Frame 5950 11 KB
3 KB 42ms
39ms Stylesheet
text/css 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/23.401111da.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

21a7fd6ffd2b55bfa0ccf4acfd4d9cc37e78151ce5cb9e65b2d665baafab02af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 12 Feb 2021 21:31:49 GMT
content-encoding: gzip
age: 1696470
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 12 Feb 2021 20:45:19 GMT
server: nginx
etag: W/"fd9003fd2c8558fd680914f594d24a3c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: iZ_edPNL4zjllLQDBErmUJN6_5HVa15E
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: M0i73V-Zfa3ErT1EIJHPjUCTNteLadsjf378nVhElPZfvMxK1KZzdA==

GET
H2 200 23.d97926a4.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 17 KB
7 KB 38ms
35ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/23.d97926a4.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

01ce75526fbe1b6dce324233fc46e7f15e7ae9efe2fbcfd6f8233384ead5277b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 01 Mar 2021 15:17:04 GMT
content-encoding: gzip
age: 250155
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 01 Mar 2021 14:50:14 GMT
server: nginx
etag: W/"7fd6360c24f8735134dbc8681845283d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: PBb3SQCeUzROF0f1FRLjH4ZE7jmmm4Lz
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: tyxV7PO38DN2a5NqiZ9DVJNXTZXaI_Zw5_Jo-0839nFqHikIw-rLYw==

GET
H2 200 17.32f9cabf.chunk.css
js.driftt.com/core/assets/css/ Frame 5950 10 KB
3 KB 42ms
39ms Stylesheet
text/css 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/17.32f9cabf.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

6089b789ee60ea0cc2d4516759ff40956d494f13ad6d4bc4d2ed1367e954dbc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 29 Jan 2021 01:04:25 GMT
content-encoding: gzip
age: 2979714
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 28 Jan 2021 22:54:32 GMT
server: nginx
etag: W/"abfbfd1c01b16d22d1a4bd5284d3669e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: a13NeaRIE80WYTeW5E8WBqObvOaa_H_O
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 2HbF0omri9jD5SQesuovZrKc5XlLjJnsjon6VNWl9Q8naqdTUmTPAg==

GET
H2 200 17.02dab135.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 16 KB
6 KB 38ms
36ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/17.02dab135.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

495ad8e9eba9fc3d77cf6394c96103ceb2662f7ea6ca8dbeb3103a1f788c6dfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 22:56:27 GMT
content-encoding: gzip
age: 136192
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 02 Mar 2021 22:37:10 GMT
server: nginx
etag: W/"e275ba88472be117a1c0f676649b2f3e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 5FoZ9KUd1m4AgJ.9yPPUg_CcDHOwvun9
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: aLK6oMDiKn73ZC45nIunCajLlhPbjmJ-5yZhD6ICTWTKnPahFGS0zg==

GET
H2 200 14.030b3a74.chunk.css
js.driftt.com/core/assets/css/ Frame 5950 32 KB
6 KB 42ms
40ms Stylesheet
text/css 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/14.030b3a74.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

8000784b8ad16be2521f60ca8b5b9075e1f5a439e5c5f1439e29ecf7fa2ea10f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 24 Feb 2021 14:26:30 GMT
content-encoding: gzip
age: 685189
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 24 Feb 2021 14:05:51 GMT
server: nginx
etag: W/"6e2fda6ebf9f63306518fdca9fbb153a"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 2wgMARUzL9B9TR3zBEepJYFzTbZ7ftXC
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: tPeBoHUcmFEF9mYkMFb-HFRPB0eAgKzFje4ifeqN4hM9nijXriMbcA==

GET
H2 200 14.4d41a047.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 62 KB
19 KB 39ms
36ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/14.4d41a047.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

3d51e745465abe8a29c925908bf4e3a02620c4991796e7defdf1a693e856b06f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 22:09:07 GMT
content-encoding: gzip
age: 139032
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 02 Mar 2021 21:36:39 GMT
server: nginx
etag: W/"e16bc1a88419a78bab847d00c1068de0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: f0okmXUe.MuWD068kqtQjUO6DwM.SyNm
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: HKtAUaxEjSZPSskNHQ9g5SO1F_N9S0zJesBXbaaW2rnKgt0MiOQSug==

GET
H2 200 19.37689260.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 18 KB
6 KB 39ms
36ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/19.37689260.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

d885685469bade59322e7f32e1b686831102266e713dfd7b8a0c7da456b76d15

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 22:09:07 GMT
content-encoding: gzip
age: 139032
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 02 Mar 2021 21:36:39 GMT
server: nginx
etag: W/"4956ce258b1e5ec25b38fbddcfc17f56"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: V7Pg9xNhxx7OeTZcYyNuqZZZFgqMS0Qt
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: UXl-lwbWvOFROH5F49ft3OAQB_v-8GU1-PJmfDaY4687_lyuSIjTMA==

GET
H2 200 27.51e30a41.chunk.css
js.driftt.com/core/assets/css/ Frame 5950 10 KB
2 KB 42ms
40ms Stylesheet
text/css 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/27.51e30a41.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

f8981397ca0b967449e9e9208109a2762f25d0edf7d7e458788592b6438e5fcc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 13 Feb 2021 05:27:35 GMT
content-encoding: gzip
age: 1667924
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 12 Feb 2021 18:51:23 GMT
server: nginx
etag: W/"d70456ae6ec3d990da312845907053b4"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 6BajYYGdno3x7VuZKpcyAuH4fDYnf7G_
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 2qTC7DwTKKZ3E0OJ0Upo5tLlytS-PckdPciHdjXYtUGIVOIpHpJeQg==

GET
H2 200 27.b7752226.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 16 KB
7 KB 37ms
36ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/27.b7752226.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

ffc05ad3d7e83cf14f5b20be10e1a18d57a366496237efb5d467f7371e431d19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 22:09:07 GMT
content-encoding: gzip
age: 139032
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 02 Mar 2021 21:36:39 GMT
server: nginx
etag: W/"08be1da6293079b09b92f87345cd6c85"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: WRMyZxFfJNQCWBHsRUbr_B_SKchJmRed
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: R2MKloamfUkcLcCn5-AxNZaMtigjZeHez2xxqtUILmUSnNCEkvG3KQ==

GET
H2 200 wm3vc3smix6y.json Show response
embeds.driftcdn.com/embeds/ Frame 7A4A 25 KB
8 KB 216ms
141ms XHR
application/json 13.224.193.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://embeds.driftcdn.com/embeds/wm3vc3smix6y.json
Requested by: Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-96.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f9cf7349ed3d9c90d4dce3a5da745c0bcd5cd766da866c5ded48b08dab43a7cd

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 12:46:20 GMT
content-encoding: gzip
x-amz-cf-pop: FRA2-C1
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Wed, 03 Mar 2021 22:51:11 GMT
server: AmazonS3
etag: W/"998207eb090ef0046b0c5052c03bc114"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json; charset=UTF-8
via: 1.1 3b02f73dccc5077f1ad544a27a475ed6.cloudfront.net (CloudFront)
cache-control: public, max-age=30
x-amz-cf-id: 8nEPWVa4QvqI82lf2U78mBVlmnhiReYQUy1Eaqf-8zjJ7REi2ECDEQ==

POST
H/1.1 200
OK v2 Show response
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame 7A4A 25 B
697 B 128ms
127ms XHR
application/json 3.94.218.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/widget/init/v2

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-94-218-138.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
Authorization
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 04 Mar 2021 12:46:20 GMT
server: istio-envoy
requestid: d97dbb8ffacc7929
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
x-envoy-upstream-service-time: 13
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 25
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

OPTIONS
H/1.1 200
OK v2
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame 0
0 460ms
112ms Preflight
text/plain 3.94.218.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/widget/init/v2

Protocol

HTTP/1.1

Server

3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-94-218-138.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://js.driftt.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Thu, 04 Mar 2021 12:46:20 GMT
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/plain
allow: POST,OPTIONS
requestid: drift9cb595841c68fc721201df562ae
content-length: 13
x-envoy-upstream-service-time: 0
server: istio-envoy

GET
H2 200 43.0bd3f7fc.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7A4A 17 KB
6 KB 33ms
33ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/43.0bd3f7fc.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

f79a8aa00d3bd94f428463ac9c44896172d23e0f0f6d6fe4f05f1c9b593e702c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=60710b1d-ddfc-4b21-909f-3e69b117bbd6&sessionStarted=1614861978&campaignRefreshToken=8eeb9d5b-6562-4d0d-ab39-1769961601ec&pageLoadStartTime=1614861973436
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 08 Feb 2021 00:41:34 GMT
content-encoding: gzip
age: 2117085
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:45 GMT
server: nginx
etag: W/"533cfc95735c653dd37e8e6b8d17383d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: ERTUxDMtR8wGkYOicn7jsyBINk5Gat3C
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: id5HR3zALIlf6cuzKlst0rQWY_wKtklkXaHD-lql7GnLVWpvOxvNww==

POST
H2 200 widget_bootstrap Show response
bootstrap.api.drift.com/ Frame 7A4A 3 KB
2 KB 521ms
300ms XHR
application/json 52.22.71.46
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://bootstrap.api.drift.com/widget_bootstrap

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.22.71.46 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-22-71-46.compute-1.amazonaws.com

Software

Resource Hash

3a074a64a5789a0c23746618f420574461d369ee14413c1fa5702d57dfbfa0d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 04 Mar 2021 12:46:20 GMT
content-encoding: gzip
requestid: 1bff766f6b3bf26
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 1413
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

OPTIONS
H2 200 wm3vc3smix6y
targeting.api.drift.com/hours/availability/combined/ Frame 0
0 328ms
107ms Preflight
text/plain 34.204.215.213
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/hours/availability/combined/wm3vc3smix6y

Protocol

Server

34.204.215.213 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-204-215-213.compute-1.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization
Origin: https://js.driftt.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Thu, 04 Mar 2021 12:46:20 GMT
content-type: text/plain
content-length: 18
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
allow: HEAD,GET,OPTIONS
requestid: drift94b5c9940daafadfce81e93a144

OPTIONS
H2 200 track
event.api.drift.com/ Frame 0
0 370ms
107ms Preflight
text/plain 18.205.49.143
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://event.api.drift.com/track

Protocol

Server

18.205.49.143 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-205-49-143.compute-1.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://js.driftt.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Thu, 04 Mar 2021 12:46:20 GMT
content-type: text/plain
content-length: 13
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
allow: POST,OPTIONS
requestid: drift4ea2d854afa83abada021862ab0

GET
H2 200 wm3vc3smix6y Show response
targeting.api.drift.com/hours/availability/combined/ Frame 7A4A 41 B
485 B 123ms
123ms XHR
application/json 34.204.215.213
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/hours/availability/combined/wm3vc3smix6y

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.204.215.213 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-204-215-213.compute-1.amazonaws.com

Software

Resource Hash

a9885038c50d2ae4af29f5089c02051b3c87caccc4d8e42b4fe56208c16478ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI4ODMyMjExMjUwIiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTQ1NTM3NCIsImV4cCI6MTY0NjM5Nzk4MCwiaWF0IjoxNjE0ODYxOTgwfQ.1-xoPeekxjrAKYA9EevgFgqezuoj3La-W6ibSH0ih-DA7omXGO_T4XdGE5jdzzJVIbHofzWfFffwC5bpT6VPMg

Response headers

date: Thu, 04 Mar 2021 12:46:20 GMT
requestid: 7f07d82ac8b7f9e2
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 41
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

GET
H2 200 css
fonts.googleapis.com/ Frame 7A4A 4 KB
749 B 14ms
14ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open%20Sans|Open%20Sans:bold&display=swap

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/2.71f04a13.chunk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

754fac4810074e8a762844e6929031a73054640d0a51e8428653762553e0a3a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://js.driftt.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 04 Mar 2021 11:34:39 GMT
server: ESF
date: Thu, 04 Mar 2021 12:46:20 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 04 Mar 2021 12:46:20 GMT

POST
H2 200 track Show response
event.api.drift.com/ Frame 7A4A 696 B
1 KB 109ms
109ms XHR
application/json 18.205.49.143
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://event.api.drift.com/track

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.205.49.143 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-205-49-143.compute-1.amazonaws.com

Software

Resource Hash

a2e1106161ff14d35a82502d659e238eba2d26f91f60a2c542b0f9a0304281a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI4ODMyMjExMjUwIiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTQ1NTM3NCIsImV4cCI6MTY0NjM5Nzk4MCwiaWF0IjoxNjE0ODYxOTgwfQ.1-xoPeekxjrAKYA9EevgFgqezuoj3La-W6ibSH0ih-DA7omXGO_T4XdGE5jdzzJVIbHofzWfFffwC5bpT6VPMg
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 04 Mar 2021 12:46:20 GMT
requestid: da7941db2ffdabf1
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 696

GET
H2 200 43.0bd3f7fc.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 5950 17 KB
6 KB 32ms
31ms Script
application/javascript 13.224.193.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/43.0bd3f7fc.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.845c2373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-72.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

f79a8aa00d3bd94f428463ac9c44896172d23e0f0f6d6fe4f05f1c9b593e702c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 08 Feb 2021 00:41:34 GMT
content-encoding: gzip
age: 2117086
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:45 GMT
server: nginx
etag: W/"533cfc95735c653dd37e8e6b8d17383d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: ERTUxDMtR8wGkYOicn7jsyBINk5Gat3C
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: qNimZMHMKWKDObvScWDG5OLqJVjWMq3n1I4XaWS5pJzNdFV6d80gYg==

GET
H3-Q050 200 css
fonts.googleapis.com/ Frame 5950 4 KB
721 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open%20Sans|Open%20Sans:bold&display=swap

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/2.71f04a13.chunk.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

754fac4810074e8a762844e6929031a73054640d0a51e8428653762553e0a3a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://js.driftt.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 04 Mar 2021 11:28:08 GMT
server: ESF
date: Thu, 04 Mar 2021 12:46:20 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 04 Mar 2021 12:46:20 GMT

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v18/ Frame 5950 9 KB
9 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open%20Sans|Open%20Sans:bold&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://js.driftt.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 01 Mar 2021 18:15:32 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:28 GMT
server: sffe
age: 239448
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9132
x-xss-protection: 0
expires: Tue, 01 Mar 2022 18:15:32 GMT

GET
H2 200 mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/ Frame 5950 9 KB
9 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open%20Sans|Open%20Sans:bold&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://js.driftt.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 25 Feb 2021 19:41:26 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:10:27 GMT
server: sffe
age: 579894
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9080
x-xss-protection: 0
expires: Fri, 25 Feb 2022 19:41:26 GMT

POST
H/1.1 200
OK bulk Show response
metrics.api.drift.com/monitoring/metrics/event2/ Frame 7A4A 25 B
697 B 121ms
121ms XHR
application/json 3.94.218.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/event2/bulk

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-94-218-138.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI4ODMyMjExMjUwIiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTQ1NTM3NCIsImV4cCI6MTY0NjM5Nzk4MCwiaWF0IjoxNjE0ODYxOTgwfQ.1-xoPeekxjrAKYA9EevgFgqezuoj3La-W6ibSH0ih-DA7omXGO_T4XdGE5jdzzJVIbHofzWfFffwC5bpT6VPMg
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 04 Mar 2021 12:46:22 GMT
server: istio-envoy
requestid: c24b96e335b5d91f
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
x-envoy-upstream-service-time: 13
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 25
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

OPTIONS
H/1.1 200
OK bulk
metrics.api.drift.com/monitoring/metrics/event2/ Frame 0
0 113ms
112ms Preflight
text/plain 3.94.218.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/event2/bulk

Protocol

HTTP/1.1

Server

3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-94-218-138.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://js.driftt.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Thu, 04 Mar 2021 12:46:21 GMT
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/plain
allow: POST,OPTIONS
requestid: drift2d020d74fca92a5969a66115ebe
content-length: 13
x-envoy-upstream-service-time: 0
server: istio-envoy

OPTIONS
H/1.1 200
OK bulk
metrics.api.drift.com/monitoring/metrics/add/ Frame 0
0 108ms
108ms Preflight
text/plain 3.94.218.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/add/bulk

Protocol

HTTP/1.1

Server

3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-94-218-138.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://js.driftt.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Thu, 04 Mar 2021 12:46:24 GMT
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/plain
allow: POST,OPTIONS
requestid: drift91279ab488fab9ac9495d3cea73
content-length: 13
x-envoy-upstream-service-time: 0
server: istio-envoy

POST
H/1.1 200
OK bulk Show response
metrics.api.drift.com/monitoring/metrics/add/ Frame 7A4A 25 B
696 B 114ms
112ms XHR
application/json 3.94.218.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/add/bulk

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-94-218-138.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI4ODMyMjExMjUwIiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTQ1NTM3NCIsImV4cCI6MTY0NjM5Nzk4MCwiaWF0IjoxNjE0ODYxOTgwfQ.1-xoPeekxjrAKYA9EevgFgqezuoj3La-W6ibSH0ih-DA7omXGO_T4XdGE5jdzzJVIbHofzWfFffwC5bpT6VPMg
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 04 Mar 2021 12:46:25 GMT
server: istio-envoy
requestid: 26ab657609638344
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 25
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

OPTIONS tp2
spcollector.pathfactory.com/com.snowplowanalytics.snowplow/ Frame 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: spcollector.pathfactory.com
URL: https://spcollector.pathfactory.com/com.snowplowanalytics.snowplow/tp2

Verdicts & Comments Add Verdict or Comment

215 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.www2.fireeye.com/	1970-01-19 17:17:33	Name: __cfduid Value: df10813e901cf41ca46cac76e0067c9261614861977
.www2.fireeye.com/	1970-01-19 16:34:23	Name: __cf_bm Value: f235741f5146472723ff4f566d7a2c66b6b0cb0b-1614861977-1800-AWtRI9H/LsMkaC4UqCxg261/JFAHMgGssbMUVcFcwYLfELkgClNaw/+J0VlFskrxioZvYOX2MzzgVMoHyMwtalo=
.fireeye.com/	1970-01-19 16:34:23	Name: mboxEdgeCluster Value: 37
www.fireeye.com/	1970-01-19 16:34:23	Name: drift_campaign_refresh Value: 8eeb9d5b-6562-4d0d-ab39-1769961601ec
.fireeye.com/	1969-12-31 23:59:59	Name: check Value: true
www.fireeye.com/	1970-01-23 08:13:14	Name: liveagent_ptid Value: e6b4eb5a-ed41-4d1e-a28f-c7ef7949f1e2
.fireeye.com/	1970-01-20 10:08:26	Name: mbox Value: session#8c817fb9472841ea9586bc91739ed06f#1614863839\|PC#8c817fb9472841ea9586bc91739ed06f.37_0#1678106779
www.fireeye.com/	1969-12-31 23:59:59	Name: liveagent_sid Value: e6b4eb5a-ed41-4d1e-a28f-c7ef7949f1e2

9 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	debug	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: [bugsnag] Loaded!
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: currentPagePath :: /blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: [object Object]
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: [object Object]
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: 668634536.1614861974
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: cookie value
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: cookie value
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: cookie value
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: cookie value

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

8443343.fls.doubleclick.net
abm2.listenloop.com
adservice.google.com
adservice.google.de
analytics.twitter.com
app.cdn.lookbookhq.com
attr.ml-api.io
b91.yahoo.co.jp
bat.bing.com
bootstrap.api.drift.com
c.la2c2.salesforceliveagent.com
cdnjs.cloudflare.com
cloud.typography.com
connect.facebook.net
d.la1-c1-ia5.salesforceliveagent.com
d.la2c2.salesforceliveagent.com
embeds.driftcdn.com
event.api.drift.com
fireeye.tt.omtrdc.net
fonts.googleapis.com
fonts.gstatic.com
g.microsoft.com
googleads.g.doubleclick.net
js.driftt.com
js.maxmind.com
jukebox.pathfactory.com
lftracker.leadfeeder.com
maxcdn.bootstrapcdn.com
metrics.api.drift.com
munchkin.marketo.net
px.ads.linkedin.com
s.ml-attr.com
s.yimg.com
s.yimg.jp
s7.addthis.com
secure.adnxs.com
segment.prod.bidr.io
snap.licdn.com
spcollector.pathfactory.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
targeting.api.drift.com
v1.addthisedge.com
v2.listenloop.com
www.facebook.com
www.fireeye.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www2.fireeye.com
z.moatads.com
spcollector.pathfactory.com
104.111.232.231
104.17.70.206
104.244.42.131
104.244.42.133
104.75.88.112
13.108.248.135
13.108.248.7
13.110.65.53
13.224.193.72
13.224.193.96
13.32.24.102
142.250.185.70
142.250.185.98
151.101.12.157
18.205.49.143
182.22.24.252
182.22.30.204
184.30.21.162
185.33.221.14
2001:4de0:ac19::1:b:1a
23.79.148.198
2606:4700:300b::a29f:f67d
2606:4700:3036::ac43:dfcf
2606:4700::6810:125e
2606:4700::6810:262f
2620:119:50e3:101::6cae:b45
2620:1ec:21::14
2620:1ec:c11::200
2a00:1288:80:800::7001
2a00:1450:4001:802::2002
2a00:1450:4001:803::2002
2a00:1450:4001:808::2003
2a00:1450:4001:809::2002
2a00:1450:4001:80f::2008
2a00:1450:4001:810::2003
2a00:1450:4001:811::200a
2a00:1450:4001:812::2004
2a00:1450:4001:827::200e
2a00:1450:400c:c1b::9d
2a02:26f0:6c00:28c::25ea
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
3.94.218.138
34.194.181.251
34.204.215.213
52.142.114.176
52.204.168.112
52.22.71.46
52.51.251.137
54.155.47.148
54.85.197.191
65.9.58.60
65.9.58.81
68.67.153.60
014de295141a456ceda8e3c4762085e53dca50f91ddf65906d227f70cf0b1a55
01ce75526fbe1b6dce324233fc46e7f15e7ae9efe2fbcfd6f8233384ead5277b
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
083be3c59862e11bbcda4128a12a7d9934f461ac881ed75af92b1c1b3615c576
0e28cd255cac05ac63cb7b021b9436cbf1bd24b34218edefc7b9675bbcb6dec7
0ee4b65b9b48a7df2e164fa20a74dc412fe4e439751a24aa5b4eb44f0dc7a141
0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a
0fadbe1e06ca947cfe99260be96d47e427e047adb36abc1569b6650969de845c
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11c0f76b0414f025f6d8790a111f70421b4b0e816a93317188736671360192ba
14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c
16bab25394f47e60db69b3a75ace1574b150a268353e17096619ba5ba96e208d
185eea1826de12c3127604e8f6c8ac493c80c73f702beef7692e0f1cec7f2d1d
1a613cec529d335c4758874a4b8249ddf6921d238969f33ac58289dddada5388
1c7c6cbe8b5beb7e138cfcc8f6301d21b35437e5559be7afd0afe3f536d5fc02
1cd351f07deee99fcd89ece5c143f930e79faf83eb0111ef9b0ac1492e288277
1cddcd88d3332d560856627ab2cecc7d9aa6c9d616729701ae13902d1671d0b0
1de5a2b057fc1fd85e8b3ccffa91101c8304a88b32fccb33e19d7657a1460dae
21a7fd6ffd2b55bfa0ccf4acfd4d9cc37e78151ce5cb9e65b2d665baafab02af
21e22194e6431ec7de2a9a80aa0dc9b8a9ed4eb20090f08ea587592056719dcd
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
2a0dcc78da2fbb1fcfe754652282ee9e51a1e8b8dd2f1164ccd38ba23ea7d789
2d3474f74f49ea05fe008ac0707fa6e2f3adba2b990b5c46d61f3a465023eae2
2e791cea0b4e689b8d862850ce773d23b07402255ace1c27e1a55e90cccd88f7
3091b6187cdf72d32615fd3df8c882e3cf6ca0f3e8b010d5f4f937ab2d619d94
325788f630aa3ff90d75e60d764ebba3adf2d304671b57e327fe3801bbdad9de
355604a949ef95ceffcd21a7e9b5ed27c95d847f95127e0ddad5aa1793f1bb74
3a074a64a5789a0c23746618f420574461d369ee14413c1fa5702d57dfbfa0d9
3a20dd690bb8b873e65040ac190e289a3c2d6c4debee865f4619f306cf2c9544
3aadac47cf44df595934bec631a78bf2ba62081ab95528e684a85b4c74453e77
3d51e745465abe8a29c925908bf4e3a02620c4991796e7defdf1a693e856b06f
3f05c4e7ede408c51e0eb199f9faa8e96d65b20d7c912620cbc9e6638ac2ad56
4034b946d27c8d1b17b893e14085aca0784e3902ad2aca3be4f17c02c681be43
4086c8cd4c3361452c1c1da9af3034fc90f4a375c4f6195f31d6dcf1c7b56f00
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
457b4bd3410faf074da387900f87abc1e845269e857219560bce3ead8260d103
459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc
45ca09e03879a2cb24fa5ac0a5ab4b783745dd5a7cb6094ce83ce6d12fc2cf70
45fe1a3f8f9f78ac64a025b533edd3296325b88ac638c78e23836e85414cb66d
475dbccf84ca50f8d13df95ef5a85c58198fd65fefa481850453de7feb2d4bb2
495ad8e9eba9fc3d77cf6394c96103ceb2662f7ea6ca8dbeb3103a1f788c6dfb
4cf52cc73734aa71f26f6a10be9aeec89602af45bf0f9abd5c8445a076c1ae1a
4ecd284b8811543e88f4c470ba7b3fe3f4b7a458c512bb92ab41d2b491aee6ca
524713cc2d4e2a28cfbc20d0285d0ff41253dfd756c5855cf8d01e92f7aec303
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
561b79715e1ae709c1e4a028d11fed5ef303dd59e9449955aed54b5f55f87e06
56bf97572cc7de5a19131a062e5e0e64ffa38dc71e87cdfa7c0e481e15f2d628
5a02661584f317e632282f0bfb0c07211061a64296f51b771ea504471f4a47e0
5b701db4813b82b18ad7f0db593b1dcc5c435f7be396ef3a937f8ed1ec7b343d
5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55
5cd804ec7036cddeb6403cd02cb908ebc248fe66e865dfc205df718463e3167c
5f3b103a1268f862a5e432d607f8e5220dea9d301d13565b0ecded3ad9c25ab2
6089b789ee60ea0cc2d4516759ff40956d494f13ad6d4bc4d2ed1367e954dbc5
60f2336dfa08d0c8e7ca93cb115ab859c2c39763ad4298d90815aa21e3ebd2d2
6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df
63896532a7015ab5b7288359c02124980a5075e9267f0ba3fbfc7c3f5038b478
64eeca223bd8f3fb9a22d9f6c43548ebdcd69860225972625aadb8700f1081e9
65d29e040c59a5e843952c3f0da27028455dc63372440602d129681883891276
68f5ba64662612eb585b4774d2b304e84ee48ef6f25c70189070d9f64b9d428a
70bedf6699398da0f7fa3be459809c0701fe7de1de2e4fff0718be5f65600db9
754fac4810074e8a762844e6929031a73054640d0a51e8428653762553e0a3a4
757eb886edd9a887fc95b701c88b08191eb743657027636c0c9d4973547ebb4a
7890a581466568a8c35161d8ef506e5b89ee96de3f9fa1a236282d2b2d21d849
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
79b2448738716f0daf11d4a206e105e3b79e9d082f9c9bf4ad2bd55e591a1a3c
7cc5de02e755067bd3c580c61e3cbe314b42aad5fc2e1a8219a22020048c8caa
7d6fd646e0efeb5d1209c2d9008343cb061cc7d70408fbd108f683dbc4d17fa8
7f5c6e767ba72fae587de73bc9e9ebaf14a949042332953f90662c784c007809
8000784b8ad16be2521f60ca8b5b9075e1f5a439e5c5f1439e29ecf7fa2ea10f
817c7a8de5f73b3bd9358babbbd8f904fa639279f18bc86d320fcfb7fcfa8485
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84a91ff2a1a995e3816750f53342b4499bfefc817a8ee1a5d4b401433692d510
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8509f8b66ce83784c82b29f557979cee1cdeafcfa4ea5b43e6301700ac1d6332
8d5adb87a00b3d248771577cd715c3a79d550e8e623128168c9c7c0a20124806
8eb0d6befea8fe88818af0f2d7aea343202c24d935f538831bceb4e453bd4e18
9066c399df39fc448ea3597ef0b67e9f987a58d466b3dd3a61b1d505e18516eb
92168f9c582b93d5be39f76128f2f1bb1bc99f299d6b86a3c43bba56531ab6be
9b935949913b686e1e44928fb476ad5611303afc06e844ff620f59370d9c77bd
9e3a9103c80346b1b39bea3de46f44a462b3f594fa45e7206252bc41d7e3e855
9e7ea2b4ba8e2bcc4a964d6192e4671dc5f6863a1c7e35b52b229a3c1e67a68d
9ea676fe4ccc25f0dbbdf6ac9e58070d359b1c692a93f3647c53807a421f64ea
9f63d2f7e82142027bc7af4bb8ac91874a40e954548ae99f8339fedf2195b16c
a0a0933f843198c607baaf63f153e3fb5fd900d91f31d37d0f71b53ca66c4ab9
a2e1106161ff14d35a82502d659e238eba2d26f91f60a2c542b0f9a0304281a6
a46a8c9098978eb78708da11a88cf5b7d8f3d691c499aa23a56938beebed5adb
a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c
a83836ec8efa8e402e410455200c7a01b33e8e390c7b9ddfa5ab3224a0d44286
a965f26b036c4084eec09f133dd99f5c1755015cc4b473fc4ec4c43c10d13acc
a9885038c50d2ae4af29f5089c02051b3c87caccc4d8e42b4fe56208c16478ce
ac8511a575f9ff43c005f8be9f0fb7b81b8aebf2fd2e1df8df7809df4b77cc07
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
aeb54739ad664ca0dde2785d1a4c64495b8d91e7eee6ab4d7788769655746f88
af8a20e6bd6c6de708d7aeffdd3afab1a47a00f91b53618d246cdb73410f147c
b397476bcbcf8c9eae3f82007cc4f9495661b367e02e6d3dea6e15f0610ef20a
b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d
b82c98e8c4f4a5c771ef6f061634b0fe49da9f53f915cdf0f576b1cf655db0c1
bb14942536ec7dcd2374fce90c6f5d1b61d2ae0122d3a1c23bf80a3e65092b8d
bbb4cc2dcde1b446e1e944793a5cb11ff8dcec18fd942a49d6161c6750daf396
c084b47104c493fb377b6d35d8c08df67d773f6dcf8294c0a7360710cd8cacbd
c986afd07a4082d65befeef18869a4cd5e00f3ac6e8228d49658802c7453a1b8
cae6601eec3262f0496682bc1cced8b0fabc8636c4645562c4952a81d02c5283
d296982cdbe646ba29da5e0904939812bcf9e6f38dde316289112b780462352f
d5dd51858c25c8f35b6d808746ec3c11750d0b6796b607cf720fa3c86d6e1bb0
d78bfcf1f62b6a4a6c403372ad3a4f46fcf2bda72822ae206129d38de72f4d84
d885685469bade59322e7f32e1b686831102266e713dfd7b8a0c7da456b76d15
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
ddeec9dced8be575598e18285dac68896a44a1a39645c772ec6bebd284384067
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df0e1ab988d451dcf5eaca26de327dc716a2cbc85bd348aa33d4a42a5f996d66
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9dbd9e7736d96ca79a74b174f2768829dd7d4da33ae7584add9fc72d1ade08e
e9f1723d153401796dcde6f2d1fbf9a6e2181ac7e94049fc88126fbff1abd38d
eb65531710810f4faff6e7a2e8e0ef1eeff7134b3f1acf6f9eab6954928add3e
ec44afb38e3d06cd15bcf6eab1b1197b4c26d5aaefbe1f72192585c3e90ded35
ec6c227c1ada277214116eaef4c092b26a3b33cf6427ec2a370788a7505094f7
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f07f057501bc4abe6b55685f023eaf5e74dc8cc33a74339e273e224b3a05baf3
f20b7aacff69fbfc6fc0aaff9220bab48d3ce87c45bd077fea61e5d9e7662c2c
f684d50dc9b24df0a4845f688a45b856d945f79d79549240187e171e1655f236
f79a8aa00d3bd94f428463ac9c44896172d23e0f0f6d6fe4f05f1c9b593e702c
f860c06834d62704936c27cf6437bf5ea3ed1500eccdf037012e353a22fd6c7a
f8981397ca0b967449e9e9208109a2762f25d0edf7d7e458788592b6438e5fcc
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
f8e3f110b75b3f1951f50fb7795c6eaf5bee4f07b787a1b535b39e734c7f1723
f99898fbb77a8b86890a5e8d0fd1364cc55eb5764b2dd8cf899a585eb58757e3
f9cf7349ed3d9c90d4dce3a5da745c0bcd5cd766da866c5ded48b08dab43a7cd
fbcc2c7d4dfbc5d0251c789843b8d7edf25306dfa23188ad267e2786357233c0
ff04dd81bb93731c0d1f8e7d384b370f26b93f4352980404fcdc4518e386bedd
ffc05ad3d7e83cf14f5b20be10e1a18d57a366496237efb5d467f7371e431d19

www.fireeye.com Open in urlscan Pro 2606:4700:300b::a29f:f67d Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

183 Requests

99 %HTTPS

41 %IPv6

42 Domains

55 Subdomains

51 IPs

7 Countries

2457 kBTransfer

6811 kBSize

8 Cookies

28 Outgoing links

Redirected requests

183 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.fireeye.com Open in urlscan Pro
2606:4700:300b::a29f:f67d Public Scan

Screenshot
Live screenshot

Full Image

183
Requests

99 %
HTTPS

41 %
IPv6

42
Domains

55
Subdomains

51
IPs

7
Countries

2457 kB
Transfer

6811 kB
Size

8
Cookies

183 HTTP transactions
10 data transactions